Decentralized identifiers (DID) has shown great potential for sharing user identities across different domains and services without compromising user privacy. DID is designed to enable the minimum disclosure of the proof from a user's credentials on a need-to-know basis with a contextualized delegation. At first glance, DID appears to be well-suited for this purpose. However, the overall security of DID has not been thoroughly examined. In this paper, we systemically explore key components of DID systems and analyze their possible vulnerabilities when deployed. First, we analyze the data flow between DID system components and analyze possible security threats. Next, we carefully identify potential security threats over seven different DID functional domains, ranging from user wallet to universal resolver. Lastly, we discuss the possible countermeasures against the security threats we identified.

No abstract

No abstract

Internet service providers have usually collected and maintained user data necessary for their services. Recently, many SP(Service Provider)s supply users with integrated services which combine existent user data of other service providers. When UdP(User Data Provider) provides SP with user data, it should acquire user consent to preserve user privacy and to avoid future responsibility. However, UdP has not direct session with user, so it is very difficult that the UdP acquires user consent directly from the user. In addition, if user may give its consent base on individual UdP, this may be inconvenient for user. In this paper, we propose a unified user consent acquisition and delivery mechanism for multi-source user data integrated service. We introduce DA(Delegation Authority) for user consent acquisition and delivery. DA acquires user consent to UdP's data providing from user and generates an ELA(Electronic Letter of Authorization) from user consent information, and sends it to SP. SP sends the ELA with user data request to UdPs, which use the ELA for deciding whether to provide user data. We design ELA Scheme, message protocols and other components such as bindings, metadata and identifier. The proposed mechanism enables user to control explicitly its own data flow and to give its consent to all SP servicerelated UdPs only for one interaction.

No abstract