Verification requirement document for credential verification
The present disclosure is directed to a method and related apparatus and computer readable medium for credential verification using verification requirement document (VRD). A VRD credential verification ecosystem may include but is not limited to a VRD administration system, a first credential management system, a second credential management system, a VRD issuing device, a verifier device, a distributed VRD transaction consensus network, and a distributed credential management transaction consensus network with necessary communication among them.
1. A method for a first credential management system using a verification requirement document (VRD) stored on a distributed VRD transaction consensus network to request credential verification of a credential owner, the method comprising:
(a) when receiving a VRD ID of the VRD and a credential owner identifier from a verifier device, the first credential management system sending the VRD ID to the distributed VRD transaction consensus network to retrieve the VRD, and sending the VRD and the credential owner identifier to a second credential management system, wherein the VRD includes at least one attribute, at least one predicate, or both at least one attribute and at least one predicate with a requirement defining at least one type of credential for verifying each of the at least one attribute and each of the at least one predicate specified in the VRD.
2. The method of claim 1 , further comprising:
(b) the first credential management system receiving a proof from the second credential management system and confirming if the proof satisfies the requirement associated with each of the at least one attribute and the at least one predicate specified in the VRD;
(c) when each requirement is satisfied, the first credential management system sending the proof and at least one of the at least one attribute and the at least one predicate specified in the VRD to a distributed credential management transaction consensus network for validation;
(d) upon receiving a verification response from the distributed credential management transaction consensus network, the first credential management system sending a credential verification result to the verifier device.
3. The method of claim 2 , further comprising: the second credential management system selecting at least one credential of the credential owner, which satisfies the requirement of each of the at least one attribute and the at least one predicate specified in the VRD, sending each of the at least one attribute and the at least one predicate specified in the VRD and a credential identifier of each of the at least one selected credential to the distributed credential management transaction consensus network, and sending the proof received from the distributed credential management transaction consensus network to the first credential management system.
4. The method of claim 2 , wherein the VRD has fields of VRD ID, VRD name, at least one of the at least one attribute and the at least one predicate, and DID of the VRD issuer.
5. The method as claimed in claim 4 , wherein each of the at least one attribute includes a corresponding requirement, an attribute name, and a reveal option, and the corresponding requirement defines the at least one type of credential of the credential owner and includes at least one search condition.
6. The method as claimed in claim 5 , wherein the at least one search condition comprises multiple search conditions that are combined by an OR Boolean operator.
7. The method as claimed in claim 5 , wherein when the reveal option of the at least one attribute specified in the VRD permits reveal, the proof includes a value or content of the at least one attribute.
8. The method as claimed in claim 5 , wherein when the reveal option of the at least one attribute specified in the VRD permits reveal, the verification result includes a value or content of the at least one attribute.
9. The method as claimed in claim 2 , wherein each of the at least one predicate specified in the VRD includes a corresponding requirement, a predicate name, a predicate character, a predicate attribute, a predicate value, and a predicate type, the corresponding requirement defines the at least one type of credential of the credential owner and includes at least one search condition.
10. The method as claimed in claim 9 , wherein the at least one search condition comprises multiple search conditions that are combined by an OR Boolean operator.
11. The method as claimed in claim 2 , wherein the proof includes a zero-knowledge proof corresponding to each of the at least one attribute and the at least one predicate specified in the VRD for verifying that the selected is valid and non-revoked.
12. The method of claim 1 , wherein the credential owner identifier comprises a credential owner ID and an identifier of the second credential management system associated with the credential owner.
13. The method as claimed in claim 1 , wherein the distributed VRD transaction consensus network and the distributed credential management transaction consensus network are blockchains.
14. The method as claimed in claim 1 , wherein the distributed VRD transaction consensus network and the distributed credential management transaction consensus network are separated networks.
15. The method as claimed in claim 1 , wherein the distributed VRD transaction consensus network is integrated into the distributed credential management transaction consensus network.
16. A distributed verification requirement document (VRD) transaction consensus network maintaining a distributed VRD ledger, the network comprises:
a VRD administration system provided by a VRD administer;
a first VRD management node provided by a first VRD operator;
a second VRD management node provided by a second VRD operator;
wherein a VRD administration system, the first VRD management node, and the second VRD administration are communicatively connected;
wherein after a VRD transaction is validated by a predetermined consensus of the distributed VRD transaction consensus network, the VRD transaction is published to the distributed VRD ledger, and the VRD transaction is one of VRD operator registering transaction, VRD operator revoking transaction, VRD issuer registering transaction, VRD issuer revoking transaction, VRD registering transaction, VRD revoking transaction, and VRD retrieving transaction; and
wherein the distributed VRD ledger records multiple VRDs and each VRD has fields of VRD ID, VRD name, at least one of at least one attribute and at least one predicate, and DID of the VRD issuer.
17. The network as claimed in claim 16 , wherein the VRD operator registering transaction comprises public key and DID of a VRD operator, and DID and signature of a VRD administer to publish a VRD operator.
18. The network as claimed in claim 16 , wherein the VRD operator revoking transaction comprises DID of a VRD operator, and DID and signature of a VRD administer who registered the VRD operator to revoke the VRD operator.
19. The network as claimed in claim 16 , wherein the VRD issuer registering transaction comprises public key and DID of a VRD issuer, and DID and signature of a VRD operator to publish the VRD issuer.
20. The network as claimed in claim 16 , wherein the VRD issuer revoking transaction includes DID of a VRD issuer, and DID and signature of a VRD operator who registered the VRD issuer to revoke the VRD issuer.
21. The network as claimed in claim 16 , wherein the VRD registering transaction has fields of VRD ID, VRD name, at least one of at least one attribute and at least one predicate, and DID and signature of a VRD issuer.
22. The network as claimed in claim 21 , wherein each of the at least one attribute specified in the VRD registering transaction includes a corresponding requirement, an attribute name, and a reveal option, and the corresponding requirement defines the at least one type of credential of the credential owner and includes at least one search condition.
23. The network as claimed in claim 22 , wherein the at least one search condition comprises multiple search conditions that are combined by an OR Boolean operator.
24. The network as claimed in claim 21 , wherein each of the at least one predicate specified in the VRD registering transaction includes a corresponding requirement, a predicate name, a predicate character, a predicate attribute, a predicate value, and a predicate type, and the corresponding requirement defines the at least one type of credential of the credential owner and includes at least one search condition.
25. The network as claimed in claim 24 , wherein the at least one search condition comprises multiple search conditions that are combined by an OR Boolean operator.
26. The network as claimed in claim 16 , wherein the VRD revoking transaction has fields of signature and DID of a VRD issuer that registered a VRD, and ID of the registered VRD.
27. The network as claimed in claim 16 , wherein the distributed VRD transaction consensus network is a blockchain.