Encrypted verifiable credentials

A method implemented at a computing system for requesting a credential issuer for a subset of verifiable data that is contained in a verifiable credential (VC) or verifiable data that can be derived from the VC, comprising,

• receiving a first verifiable credential (VC) from a credential issuer, the VC containing one or more claims about a subject entity;
• obtaining a public key of the credential issuer;
• encrypting the first VC by the public key of the credential issuer;
• generating one or more instruction(s), at least one of the instructions instructing the credential issuer to extract a subset of data that is contained in the first VC or derive a portion of data from the first VC;
• issuing a second VC, on behalf of the subject entity, to the relying entity, in which at least one claim of the second VC is associated with at least one of the one or more instruction(s), such that the second VC grants the relying entity a scope of permission to access the subset of data that is to be extracted from the VC or the portion of data that is to be derived from the VC,
• sending the encrypted first VC and the second VC to the credential issuer or a relying entity such that if the encrypted VC and the instruction(s) are sent to the relying entity, the relying entity is triggered to forward the encrypted VC and the instruction(s) to the credential issuer;
• causing the credential issuer to generate a response containing the subset of verifiable data or the portion of data and proof code, the proof code being configured to prove validity of the subset of data or the portion of data;
• and
• causing the credential issuer to send the response to the computing system associated with the credential holder or to the relying entity.

A computer program product comprising one or more computer-readable hardware storage devices having thereon computer-executable instructions that are executable by one or more processors of a computing system for configuring the computing system to request a credential issuer for a subset of verifiable data that is contained in a verifiable credential (VC) or verifiable data that can be derived from the VC by at least configuring the computing system to perform the following:

• receive a verifiable credential (VC) from a credential issuer, the VC containing one or more claims about a subject entity;
• obtain a public key of the credential issuer;
• encrypt the VC by the public key of the credential issuer;
• generate one or more instruction(s), at least one of the instructions instructing the credential issuer to grant a scope of permission associated with the encrypted VC to a relying entity, the scope of permission comprising at least permission to access a subset of data that can be extracted from the VC or a portion of data that can be derived from the VC;
• send the encrypted VC and the instruction(s) to the credential issuer or the relying entity;
• such that if the encrypted VC and the instruction(s) have been sent to the relying entity, the relying entity forwards the encrypted VC and the instruction(s) to the credential issuer;
• cause the credential issuer to generate a response containing the subset of verifiable data or the portion of data and proof code, the proof code being configured to prove validity of the subset of data or the portion of data;
• and
• cause the credential issuer to send the response to the computing system associated with the credential holder or to the relying entity.