Source-linked AI summary
A Survey on Essential Components of a Self-Sovereign Identity
Alexander Mühle, Andreas Grüner, Tatiana Gayvoronskaya, Christoph Meinel
TL;DR
Self-Sovereign Identity research uses inconsistent terminology and architectures, limiting scientific understanding of the field. This paper synthesizes SSI architecture and four essential components, concluding that decentralized registries clarify how blockchain-based identities and verifiable claims are organized.
Problem
SSI terminology and architecture vary widely, while existing documentation is often practical or promotional, limiting a coherent scientific understanding of the field.
Method
The paper surveys blockchain-based SSI architecture and four components: identifiers, authentication, verifiable claims, and claim storage.
Results
The survey distinguishes Identifier Registry and Claim Registry Models, clarifies verifiable-claim terminology, and reviews on-chain and off-chain storage options.
Takeaways & Limitations
SSI systems center user-controlled identifiers and claims, with blockchain-enabled registries supporting decentralized identity management while claim issuers remain trusted entities.
Takeaways & Limitations
User-controlled off-chain claim storage can create serious data-loss and data-theft risks because of limited redundancy.
Abstract
from arXiv · showhide
This paper provides an overview of the Self-Sovereign Identity (SSI) concept, focusing on four different components that we identified as essential to the architecture. Self-Sovereign Identity is enabled by the new development of blockchain technology. Through the trustless, decentralised database that is provided by a blockchain, classic Identity Management registration processes can be replaced. We start off by giving a simple overview of blockchain based SSI, introducing an architecture overview as well as relevant actors in such a system. We further distinguish two major approaches, namely the Identifier Registry Model and its extension the Claim Registry Model. Subsequently we discuss identifiers in such a system, presenting past research in the area and current approaches in SSI in the context of Zooko's Triangle. As the user of an SSI has to be linked with his digital identifier we also discuss authentication solutions. Most central to the concept of an SSI are the verifiable claims that are presented to relying parties. Resources in the field are only losely connected. We will provide a more coherent view of verifiable claims in regards to blockchain based SSI and clarify differences in the used terminology. Storage solutions for the verifiable claims, both on- and off-chain, are presented with their advantages and disadvantages.
I. INTRODUCTION
The introduction frames Self-Sovereign Identity as a loosely defined identity-management system in which individuals own and manage digital identities independently from services. It motivates the survey by noting divergent architectures and limited scientific documentation across SSI initiatives.
- I. INTRODUCTION: SSI lets individuals fully own and manage their digital identities independently from services.The concept remains loosely defined, but these core properties have emerged.
- I. INTRODUCTION: SSI security requires protecting personal data, minimizing exposure, and supporting persistent identities without contradicting a right to be forgotten.Control and consent may also extend to identity removal.
- I. INTRODUCTION: Identity portability should let users use their identity wherever they want without dependence on a particular identity provider.This requirement is presented alongside the broader diversity of SSI projects and initiatives.
- I. INTRODUCTION: The survey addresses widely varying SSI terminology and architectures amid documentation that is often practical or promotional rather than scientifically useful.Its objective is to provide an overview, deeper understanding, and account of the current state of the art.
II. SELF-SOVEREIGN IDENTITY ARCHITECTURE
SSI shifts identity management from provider-centered systems to a user-centric architecture in which users control identifiers and verifiable claims. Claims are issued by attestations, while identifier–public-key pairings enable authentication and public verification on a blockchain identifier registry.
- II. SELF-SOVEREIGN IDENTITY ARCHITECTURE: SSI is user-centric: claim issuers attest to user attributes, users control the resulting identity, and relying parties receive only the necessary identity information.This architecture replaces provider-centered identity management with user control over disclosed identity components.
- II. SELF-SOVEREIGN IDENTITY ARCHITECTURE: The SSI architecture organizes interactions among claim issuers, users, and relying parties around user-controlled identity information.The architecture and actor relationships are summarized in Figure 3.
- II. SELF-SOVEREIGN IDENTITY ARCHITECTURE: The identifier registry links identification and authentication by letting users manage identifiers and verifiable claims while binding identifiers to users through authentication methods such as asymmetric cryptography.A blockchain pairing between an identifier and public key allows anyone reading the blockchain to verify the identifier by challenging the user.
III. IDENTIFICATION
The section frames identifier design through Zooko’s Triangle, balancing distributed choice, security, and human readability. It then surveys random, centralized, and blockchain-assisted identifiers, including UUIDs, self-authenticating schemes, ENS, and uPort.
- III. IDENTIFICATION: Zooko’s Triangle describes the difficulty of making identifiers simultaneously distributed, secure, and human-readable.Distributed means avoiding central registration and verification, while secure means securely unique and collision-free.
- III. IDENTIFICATION: Identifiers are grouped into random-generation schemes, centralized registration schemes, and blockchain approaches that seek to combine their advantages.Random schemes use probabilities to avoid collisions, while centralized schemes rely on registration authorities.
- III. IDENTIFICATION: UUIDs let users generate identifiers without central registration, partially satisfying Zooko’s decentralization requirement.UUIDs, also called GUIDs, emerged from the need for globally unique identifiers and include multiple versions with differing properties.
- III. IDENTIFICATION: Self-authenticating schemes use hashes or public/private keypairs to create collision-free, verifiable key-value pairs but are typically not human-readable.These schemes can verify identifiers without third-party input, whereas universal meaningful namespaces are considered impractical.
- III. IDENTIFICATION: ENS applies decentralized bidding to address name squatting, while uPort uses an Ethereum smart-contract address as a persistent identity identifier.The uPort address is derived from the user’s public information described in the passage.
IV. AUTHENTICATION
SSI authentication typically uses public/private key pairs linked to blockchain identifiers, enabling users to prove control of an identity without third-party endpoints. Key recovery is addressed by separating authentication from authorization so authentication keys can be replaced after loss.
- IV. AUTHENTICATION: SSI authentication typically uses a public/private key pair, with the public key stored as the identifier’s blockchain value.This approach is described as Decentralised Public Key Infrastructure.
- IV. AUTHENTICATION: Zero-knowledge properties of asymmetric cryptography allow users to prove control of the identity associated with the blockchain-stored public key.
- IV. AUTHENTICATION: Authentication based on end-user-held secrets avoids third-party endpoints, while separating authentication from authorization enables key recovery or replacement after private-key loss.In the DID scheme, other parties can change the DID document and replace the authentication key.
V. VERIFIABLE CLAIMS
Verifiable claims are central to SSI, requiring issuer signatures to make statements about subjects trustworthy. SSI systems differ in how claims are linked to identities, balancing integrity, privacy, timestamping, revocation, and decentralized trust.
- Verifiable claims: Verifiable claims turn statements about subjects into trustable credentials through issuer signatures and associated metadata such as issuer and validity period.A credential may group multiple claims, while a claim alone is only a statement about a subject.
- Claim registry model: uPort links users to off-chain claim hashes through an on-chain smart-contract registry, enabling claim integrity verification and blockchain-recorded updates.The registry records a mapping between users and claim hashes, while the claims themselves remain off-chain.
- W3C VCWG model: The W3C VCWG model avoids a claim registry and preserves privacy, but issuer-key collusion can evade tamper detection and the approach does not provide blockchain timestamps.It uses the blockchain for identifier-to-authentication-method mappings and includes the identifier in issuer-signed claims.
- Revocation: A registry model can support straightforward revocation because claims are maintained in a physically decentralized central location.The registry could be extended with a revocation mechanism.
- Decentralized trust: Aggregating attestations lets relying parties form decentralized trust models using their own confidence in different attestators, while aggregating claims can support identity reputation models.These approaches extend trust beyond reliance on a single claim issuance or centralized identity service.
VI. STORAGE · A. Public
SSI stores most data off-chain, but essential information such as authentication public keys is typically published on-chain. Users decide which additional information to reveal publicly, with Blockstack and uPort offering public profiles containing keys, names, and profile pictures.
- A. Public: Public SSI data typically includes authentication keys, while users control whether to reveal additional profile information such as names and pictures.Blockstack and uPort provide public profiles that include signing keys, names, and profile pictures.
B. Private
SSI privacy is preserved by keeping most claims off-chain and giving users control over where those claims are stored.
- B. Private: Most claims are stored off-chain rather than publicly, secured through a claim registry or linked to the identifier registry, while users control their storage location.The passage presents user-controlled off-chain storage as a privacy-preserving alternative to publicly disclosing claims.
VII. FUTURE WORK
Future work could develop reputation systems for individual verifiable claims and for identities as a whole. These systems could aggregate and weight attestations to move beyond binary claim reputation.
- VII. FUTURE WORK: Reputation systems could aggregate and weight multiple attestations to derive more nuanced reputations for individual verifiable claims.The paper identifies this as a future direction beyond binary claim reputation.
- VII. FUTURE WORK: An identity-level reputation could be derived from all verifiable claims associated with that identity.
VIII. CONCLUSION
Self-Sovereign Identity has attracted growing interest as digital interactions and user-data analysis increase, promising users greater control without relying on centralized entities. Blockchain enables decentralized identity registries, including the Identity Registry Model and Claim Registry Model, which extend verifiable claims.
- VIII. CONCLUSION: Blockchain-enabled Identity Registry and Claim Registry Models extend verifiable claims through decentralized registries.These models support a more user-centric identity experience without dependence on centralized entities.