Identity services and authentication in distributed networks

A computer-implemented for managing identities in a network, in particular in a distributed network, the method comprising the steps of

• generating, by a first user device, a first cryptographic key pair comprising a first public key;
• submitting, by a user of the first user device, the first public key to an identity service;
• registering, by the identity service, the first public key under a main user identifier;
• generating, by a second user device of the user, a second cryptographic key pair comprising a second public key;
• submitting, by the user of the first and the second user devices, the main user identifier and the second public key to the identity service;
• providing, by the identity service, to the user of the first and the second user devices, an authentication request/form to authenticate with respect to the first public key;
• generating, by the first user device, authentication information that is valid with respect to the first public key;
• receiving, by the identity service, an authentication response comprising the authentication information of the first user device being valid with respect to the first public key;
• and
• registering, upon successful authentication, the second public key under the main user identifier.

A distributed network comprising a plurality of nodes including hardware processors, wherein the distributed network is configured to perform a method comprising:

• maintaining, by an identity service, user accounts under a main user identifier, the user accounts supporting a method of authentication by the user;
• generating, by an application frontend, a session public key of a public key verification scheme;
• providing, by the application frontend, the session public key to the identity service;
• obtaining, by the application frontend, a certification from the identity service, the certification comprising the session public key and an application user identifier, the application user identifier being derived from the main user identifier and an application frontend identifier,
• wherein the application user identifier is an identifier that provides an identity for the respective user of the distributed network with or for a corresponding application or application service of the distributed network;
• and
• the application frontend identifier relates to an identity of the application frontend between the respective user and the corresponding application or application service of the distributed network.

A computer program product for operating a network, the computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions executable by one or more of a plurality of nodes to cause the one or more of the plurality of nodes to perform a method comprising:

• generating, by a user first device, a first cryptographic key pair comprising a first public key;
• submitting, by a user of the first user device, the first public key to an identity service;
• registering, by the identity service, the first public key under a main user identifier;
• generating, by a second user device of the user, a second cryptographic key pair comprising a second public key;
• submitting, by the user of the first and the second user devices, the main user identifier and the second public key to the identity service;
• providing, by the identity service, to the user of the first and the second user devices, an authentication request/form to authenticate with respect to the first public key;
• generating, by the first user device, authentication information that is valid with respect to the first public key;
• receiving, by the identity service, an authentication response comprising the authentication information of the first user device being valid with respect to the first public key;
• and
• registering, upon successful authentication, the second public key under the main user identifier.