Decentralized Identity

Authorization occurs after a successful authentication. Authorization determines what permissions or rights an authenticated entity has and then grant it access to authorized services and resources. 

A blockchain is a list of immutable records, called blocks, that are cryptographically linked. Each block contains a cryptographic hash of the previous block. Integrity of the whole blockchain can be verified by iteratively verifying the hash values all the way back to the original genesis block. A blockchain that is distributed over a network is called a distributed ledger. 

Cryptography is a study of techniques for secure communication over insecure channels such as the internet. Two major categories of cryptography are symmetric-key cryptography and asymmetric-key cryptography. Symmetric-key cryptography uses a single key for both encryption and decryption. On the other hand, asymmetric-key cryptography uses two separate keys: a public key for encryption and private key for decryption. 

A decentralized identifier (DID) is a globally unique identifier (URI) that does not require a centralized registration authority because it is registered with a decentralized network. 

A digital identifier is a unique information used to identify people, organizations, or things within a context. Examples of digital identifiers are social security numbers (SSN), e-mail addresses and decentralized digital identifiers. 

A digital identity of an entity is a unique fact of who or what the entity is in the digital world. A digital identity that is connected to a real-world Identity is called a digital twin. 

A digital signature is a cryptographic scheme for verifying authenticity of digital messages and documents. A digital document that is cryptographically signed is tamper-evident. In asymmetric cryptography, a private key is used for signed a document whereas a public key is used for verifying the document. 

A distributed ledger is a blockchain that is distributed across several nodes in a network. To record a new transaction into a distributed ledger, the nodes in the network must vote by a consensus protocol. Once a consensus is reached, all nodes update themselves with the copy of the new ledger. Examples of consensus protocols include Proof of Work, Proof of Stake and practical Byzantine Fault Tolerance. 

An entity is any singular, identifiable and separate object, e.g. an individual, an organization, a system, etc. 

A hardware security module (HSM) is a physical computing for managing and safeguarding cryptographic keys. A HSM contains a secure storage for cryptographic keys and crypto-processor chips for executing cryptographic operations such as key generation and digital signature. 

A cryptographic hash function is a one-way function for converting a digital message into a seemingly random bit array of a fixed size. For a given hash value, it is infeasible to reverse-engineer the hash function and obtain its original message, called the hash preimage.  

A holder is a role of an entity that holds a verifiable credential, created by an issuer. A holder can present her verifiable credential in the form of a verifiable presentation to a verifier. 

An identity of an entity is a unique fact of who or what the entity is. 

An identity management (IM) is a framework of policies and technologies for ensuring that the people in an enterprise have appropriate accesses to resources. 

Identity proofing is a process of verifying and authenticating the identity of an individual accessing an application or a service. It prevents fraudsters from gaining an access to sensitive data of legitimate users. Identity proofing includes, for example, verifying that uploaded credentials such passports and driving licenses are valid. 

An identity trust fabric (ITF) is a storage for cryptographic proofs of decentralized identities and verifiable credentials. An ITF enables decentralized trust between credential issuers, credential holders and service providers without relying on a centralized authority. An ITF can be built on a distributed ledger. A decentralized public key infrastructure (DPKI) is a component of an identity trust fabric. 

An issuer is a role of an entity that asserts claims about itself or another entity. An issuer creates a verifiable credential from these claims and send to a holder. 

A public key infrastructure (PKI) is a system for managing cryptographic public keys. A PKI system includes hardware, software, policies and roles, such as a certificate authority, for creating, managing distributing, storing and revoking public key certificates. A public key infrastructure that is built on a distributed ledger is called a decentralized public key infrastructure (DPKI) and forms a component of an identity trust fabric. 

Self-Sovereign Identity (SSI) is a concept where individuals are empowered to own, control and manage their digital identities without an intervening authority. An SSI platform can be implemented by using the blockchain technology as an identity trust fabric. 

A verifiable claim is an assertion made about an entity, which is tamper-evident and can be cryptographically verified. 

A verifiable credential is a set of one or more verifiable claims about an entity. A verifiable credential is created by an issuer and held by a holder. 

A verifiable presentation is a presentation of a verifiable credential, which is tamper-evident and can be cryptographically verified. A verifiable presentation is created by a holder and verified by a verifier. 

A verifier is a role an entity that verifies a verifiable presentation from a holder. A verifier is also known as a relying party or a service provider. 

A zero-knowledge proof (ZKP) is a cryptographic protocol by which one party (called the prover) can prove to another party (the verifier) that she knows something without revealing its underlying information or content. One application of a ZKP is selective disclosure for minimal revealing information in a credential.