System and Method for Digital Identity Management

A system for digital identity (ID) management, comprising:

• an identity governance server having:
• a plurality of hardware and software internal data management units including one or more of:
• a digital identity data store and a digital key management vault;
• a plurality of hardware and software external interfaces to respective external data processors, the external interfaces including one or more of:
• a cloud identity service interface, placing said identity governance server in data communication with a user or user agent through a cloud identity service unit;
• a user identity interface, placing said identity governance server in data communication with a centralized digital identity service, and receiving from said centralized identity service a user domain corresponding to a first user ID;
• a certificate authority interface, placing said identity governance server in data communication with a certificate authority, and receiving certificates therefrom corresponding to a second user ID;
• a block record base interface placing said identity governance server in data communication with a decentralized data block record base, the block record base interface that generates and publishes a first data block confirming association of said first public key and said second public key and signed using said first private key, the block record base interface further generating and publishing a second data block confirming association of said second public key and said first public key and signed using said second private key;
• a digital key pair generator that creates a first pair of digital keys corresponding to said domain enabling cryptographic certification, and a second pair of keys enabling publication of data blocks onto said decentralized data block record base;
• and
• a digital signing unit that provides a digital signature and executes a digital event over a data connection with said identity management server, said digital signature enabled to execute said digital event using either said second user ID on behalf of said first user ID or using said first user ID on behalf of said second user ID.

A method for linking digital identities, comprising:

• generating a first digital identity corresponding to a user, said first digital identity corresponding to a first digital key pair, said first digital key pair comprising a first public key and a first private key;
• generating a second digital identity corresponding to said user, said second digital identity corresponding to a second digital key pair, said second digital key pair comprising a second public key and a second private key;
• publishing an identity linking message to a publicly accessible immutable ledger, said identity linking message encoding a linking of said first and second digital identities, and the identity linking message further comprising a digital signature using said first private key and a digital signature using said second private key so as to establish a publicly verifiable mutual association between said first and second digital identities;
• and
• executing a digital event across multiple digital platforms, using said identity linking message for decentralized digital identity verification of said user, without reliance on a centralized identity service for executing said digital event.

A method for linking digital identities, comprising:

• generating a first digital identity corresponding to a user, said first digital identity corresponding to a first digital key pair, said first digital key pair comprising a first public key and a first private key;
• generating a second digital identity corresponding to said user, said second digital identity corresponding to a second digital key pair, said second digital key pair comprising a second public key and a second private key;
• publishing a first data block to a publicly accessible immutable ledger, said first data block encoding an association of said first and second digital identities, and encoding a first digital signature using said first private key;
• publishing a second data block to said publicly accessible immutable ledger, said second data block encoding an association of said second and first digital identities, and encoding a second digital signature using said second private key;
• and
• executing a digital event using said first and second data blocks for decentralized digital identity verification of said user, without reliance on a centralized identity service for executing said digital event.

A method for digital key management in a digital identity management system, comprising:

• receiving a signal indicating a compromise or loss of a digital key in a first digital key pair comprising a first public key and a first private key;
• using a domain name service (DNS) governance method to verify a digital domain ownership wherein said domain is linked to said first digital key pair;
• publishing an unlinking message to a publicly accessible immutable ledger to revoke an authorization of said lost cryptographic key;
• generating a second digital key pair comprising a second public key and a second private key;
• and
• linking said second key pair to said domain;
• publishing a linking message to said publicly accessible immutable ledger, allowing for digital key recovery without reliance on a centralized authority for said digital key recovery.