Decentralized identity authentication framework for distributed data

A method of granting and sharing credentials in a shared private permissioned blockchain shared among network members of a blockchain network, the method comprising:

• implementing, by a registry server of a distributed network of security registry nodes that manage access to a shared private permissioned blockchain data structure maintained by the network members, a claims verification process including:
• receiving, by the registry server and from a requesting user application, a request to authenticate identity claims of a requesting user to permit access to data stored in blocks in the shared private permissioned blockchain shared among network members, the request including:
• (i) identity documentation identifying the requesting user and captured by the requesting user application at a time of making the request and (ii) claims made by an entity administrator supporting a role, as determined by rules of a trust framework adopted by the network members;
• storing in a private storage by the registry server, the (i) identity documentation and (ii) the claims;
• redacting pictures captured of the requesting user from the (i) identity documentation and (ii) the claims;
• and
• sending the identity documentation and the claims via an external validator interface to a validator server;
• upon obtaining, by the registry server via the external validator interface and from the validator server, an approval validating:
• (i) the identity documentation and (ii) the claims made by an entity administrator, generating and sending to the requesting user application a one-time token for creating a public-private key pair;
• and
• upon receipt from the requesting user application, of a public key of a public-private key pair generated by the requesting user application using the one-time token, granting, by the registry server, a credential in the blockchain network based upon the validation of (i) the identity documentation and (ii) the claims, the credential being stored in a public key registry at the registry server as a trusted triple data structure comprised of (a) the public key, (b) a link to an enterprise application on a server corresponding to the registry server, and (c) one or more third-party accreditations in the claim as validated;
• and
• responsive to a receiving, by the registry server and from a blockchain network member, a verification request to verify the credential submitted by the requesting user in an electronic communication with the blockchain network member, providing, by the registry server, the trusted triple data structure as verification of the credential to the blockchain network member as requested;
• to enable the blockchain network member to provide data from blocks stored in the shared private permissioned blockchain data structure to only credentialed users;
• and
• wherein no registry node contains credentials for all users permitted access to the shared private permissioned blockchain data structure.

A system for authenticating requestors and granting access to a permissioned blockchain network shared among enterprise entities, the system comprising:

• a registry server including a hardware processor and software that when executed implement;
• receiving from a requestor's user application, by a registry server, a first request by a requestor to access the permissioned blockchain network;
• authenticating the requestor based at least in part upon submissions of evidence by the requestor, including:
• storing, in a private storage by the registry server, from the request:
• (i) identity documentation and (ii) claims;
• redacting pictures captured of the requestor from the (i) identity documentation and (ii) the claims;
• and
• sending the (i) identity documentation and (ii) the claims without pictures via an external validator interface to a validator server;
• and
• granting a distributed digital credential to the requestor to access the permissioned blockchain network;
• receiving by the registry server, a second request by the requestor to withdraw from accessing the permissioned blockchain network;
• rescinding the distributed digital credential issued to the requestor, by deleting data comprised of:
• (a) a public key, and (b) a link to an enterprise application on a server for which the requestor is being authenticated;
• and
• removing personally identifiable information of the requestor.

A non-transitory computer readable medium storing instructions for authenticating requestors and granting access to a permissioned blockchain network shared among enterprise entities, which instructions when executed by one or more hardware processors perform:

• receiving from a requestor's user application, by a registry server, a first request by a requestor to access the permissioned blockchain network;
• authenticating the requestor based at least in part upon submissions of evidence by the requestor, including:
• storing, in a private storage by the registry server, from the request:
• (i) identity documentation and (ii) claims;
• redacting pictures captured of the requestor from the (i) identity documentation and (ii) the claims;
• and
• sending the (i) identity documentation and (ii) the claims without pictures via an external validator interface to a validator server;
• and
• granting a distributed digital credential to the requestor to access the permissioned blockchain network;
• receiving by the registry server, a second request by the requestor to withdraw from accessing the permissioned blockchain network;
• rescinding the distributed digital credential issued to the requestor, by deleting data comprised of:
• (a) a public key, and (b) a link to an enterprise application on a server for which the requestor is being authenticated;
• and
• removing personally identifiable information of the requestor.