Architecture and Methods for Self-Sovereign Digital identity

A method for securely exchanging self-sovereign digital identities comprising:

• Providing personal devices of owners, said devices having an identity engine, the identity engine of an owner having digital identities of the owner;
• Providing an identity service having a memory, said identity service capable of storing public encryption keys into said memory at a memory location determined from a hash provided by the identity engine of an owner;
• said identity service further capable of retrieving public encryption keys stored in said memory at a memory location determined from a hash provided by the identity engine of an owner;
• The identity engine of the first device owner transferring, by reliable means, the identifier of a selected digital identity of the first owner, the identifier of the first owner, to the identity engine of the second device owner;
• and the identity engine of the second device owner transferring, by reliable means, the identifier of a selected digital identity of the second owner, the identifier of the second owner, to the identity engine of the first device owner;
• The identity engine of the first owner calculating the hash of the identifier of the first owner, sending said hash and the public keys of the selected digital identity of the first owner to the identity service, said identity service storing said public keys in a memory location determined from said hash by the identity service;
• and the identity engine of the second owner calculating the hash of the identifier of the second owner, sending said hash and the public keys of the selected digital identity of the second owner to the identity service, said identity service storing said public keys in a memory location determined from said hash by the identity service;
• The identity engine of the first owner calculating the hash of the identifier of the second owner, sending said hash to the identity service, the identity service retrieving public keys from a memory location determined from said hash by the identity service, and transferring said public keys, the public keys of the second owner, to the identity engine of the first owner;
• and the identity engine of the second owner calculating the hash of the identifier of the first owner, sending said hash to the identity service, the identity service retrieving public keys from a memory location determined from said hash by the identity service, and transferring said public keys, the public keys of the first owner, to the identity engine of the second owner;
• The identity engine of the first owner using the Diffie-Hellman method to calculate shared symmetric keys by combining the retrieved public keys of the second owner with the private keys of the selected digital identity of the first owner;
• and the identity engine of the second owner using the Diffie-Hellman method to calculate shared symmetric keys by combining the retrieved public keys of the first owner with the private keys of the selected digital identity of the second owner.
• The identity engine of the first owner using the shared symmetric keys to encrypt the selected digital identity of the first owner including public keys, sending the encrypted digital identity to the second owner, the second owner receiving and decrypting said digital identity of the first owner;
• the identity engine of the second owner using the shared symmetric keys to encrypt the selected digital identity of the second owner including public keys, sending the encrypted digital identity to the first owner, the first owner receiving and decrypting said digital identity of the second owner;
• whereby the first owner and the second owner exchange selected digital identities, including specified claims, attributes, images and public keys, without disclosing the paired private keys.

A method for using consent tokens to reliably grant access to resources of the owner comprising:

• Providing personal devices of owners, said devices having an identity engine, the identity engines of owners having at least one digital identity of the owner, including the sovereign image, and the public copy of digital identities acquired from collaborating owners, a resource owner having resources managed by a custodian service, the custodian service having authority to manage access to the resources of the resource owner, a relying party requesting access to the resources of the resource owner, and a consent data model enabling a resource owner to create a consent token identifying at least the resource owner, the custodian service, the relying party, selected resources of the resource owner, permissions granted by the resource owner to the relying party to access the selected resources, and the expiry data and time of the consent token.
• The resource owner using the identity engine of the resource owner to create a consent token, specifying the resource owner, the custodian service, the relying party, selected resources of the resource owner managed by the custodian service, permissions granted to the relying party to access the selected resources, and the expiry date and time of the consent token.
• The identity engine of the resource owner sending the consent token to the identity engine of the custodian service, the custodian service specifying an attestation agreeing to the permissions specified by the consent token, and the identity engine of the custodian service using the private embossing key of the digital identity of the custodian service to create a digital seal affixing the identity and attestation of the custodian service to the consent token, and returning said attested and sealed consent token to the identity engine of the resource owner;
• The identity engine of the resource owner sending the consent token to the identity engine of the relying party, the relying party specifying an attestation agreeing to the permissions specified by the consent token, and the identity engine of the relying party using the private embossing key of the digital identity of the relying party to create a digital seal affixing the identity and attestation of the relying party to the consent token, returning said attested and sealed consent token to the identity engine of the resource owner;
• The resource owner using the public inspection key of the digital identity of the custodian service to verify the attestation and digital seal affixed by the custodian service to the consent token;
• the resource owner using the public inspection key of the digital identity of the relying party to verify the attestation and digital seal affixed by the relying party to the consent token;
• the resource owner sending the consent token to the relying party if said verifications are both successful;
• The relying party sending the consent token to the resource service, the resource service using the inspection keys of the digital identities of the relying party, the resource owner, and the custodian service to verify the attestations and digital seals affixed to the consent token, granting access to the resources of the resource owner if said verifications are all successful;
• whereby the relying party is reliably granted access to the resources of the owner managed by the custodian service.