Managing verifiable credential linkages using decentralized identity
AssigneeAmerican Express Travel Related Services Company, Inc.
InventorsAndras L. Ferenczi, Mukund Shankar SimhaRaghu
Life of this patent
Estimating the term…
Abstract
Disclosed are various embodiments for managing a graph of decentralized identifiers (DIDs) associated with verifiable credentials (VCs) and verifiable credential linkages or relationships including those denoting linkages amongst verifiable credentials of different users. The DID tree graph can be maintained and managed to ensure that the DIDs and corresponding VCs are accurate and that the linkages or relationships between DIDs and corresponding VCs are still valid. The DID tree graph can be queried to identify DIDs associated with a DID subtree representing an established relationship or linkage between one or more VCs.
Claims20
A system, comprising:
- a computing device comprising a processor and a memory;
- and
- machine-readable instructions stored in the memory that, when executed by the processor, cause the computing device to at least:
- receive, from a verifier device, a query comprising a decentralized identifier (DID) associated with a verifiable credential;
- identify a graph subtree associated with the DID, the graph subtree being included in a graph database comprising a plurality of nodes and a plurality of edges representing relationships between a plurality of DIDs;
- generate a graph subtree presentation associated with the graph subtree;
- transmit the graph subtree presentation to the verifier device in response to the query;
- receive a cryptographic challenge associated with an edge in the graph subtree;
- create a signed cryptographic challenge by using a linkage private key to sign the cryptographic challenge;
- and
- return the signed cryptographic challenge.
A method, comprising:
- receiving a verifiable credential associated with a user, the verifiable credential being received for verification;
- extract a root decentralized identifier (DID) from the verifiable credential;
- query a linkage service to obtain a graph subtree presentation identifying a plurality of related DIDs associated with the root DID;
- verify the verifiable credential based at least in part on a verification of the plurality of related DIDs included in the graph subtree presentation;
- send a cryptographic challenge associated with an edge in the graph subtree presentation to the linkage service;
- and
- receive a signed cryptographic challenge from the linkage service created by signing the cryptographic challenge with a linkage private key.
A non-transitory, computer-readable medium, comprising machine-readable instructions that, when executed by a processor of a computing device, cause the computing device to at least:
- receive a request to establish a linkage between a first decentralized identifier (DID) and a second DID from a client device associated with a first user;
- generate a verifiable credential (VC) associated with a third DID, the VC representing a relationship between the first DID and the second DID;
- sign the VC with a linkage private key;
- update a graph database to include the relationship between the first DID and the second DID;
- and
- transmit the VC to the client device.
Dependencies are inferred from the claim text.