SSI-AWARE: Self-sovereign Identity Authenticated Backup with Auditing by Remote Entities

Abstract

The self-sovereign identity (SSI) model entails the full responsibility and sovereignty of a user regarding his identity data. This identity data can contain private data which is solely known to the user. The user himself is therefore required to manage the whole lifecycle of his private data, including the backup and restore. We show that prior work on how to backup and restore the user's identity data does not meet the requirements of the SSI setting, and we present the first solution which does meet the requirements. Authenticated backup with auditing by remote entities (AWARE) combines SSI sustaining aspects and extends them to create a truly self-sovereign backup-and-restore protocol. In AWARE, trusted, physically met humans, called custodians, hold a secure device. Custodians with a secure device offer an offline backup possibility and a secure channel. The backup and restore are audited by commits on a publicly accessible distributed ledger. These commits are answered by auditing services which are required during restore. Only some auditing services hold relevant data for a restore. The self sovereignty of the user lies in the exclusive information which auditing services hold relevant data. AWARE is the first backup-and-restore mechanism that fully complies with the SSI model. We perform an indepth security-risk analysis of AWARE, showing a risk rating which is comparable to the best risk rating o related non-SSI-compliant backupand-restore mechanisms. We instantiate the AWARE protocol with cryptographic primitives providing a high security level of 256-bit. We show its implementation feasibility by providing a simulation of AWARE, and conclude with an estimated performance analysis on a microcontoller architecture based on our simulation and implementation results in the literature.

Self-Sovereign Identity: A Systematic Review, Mapping and Taxonomy

“…Following our categorization, two publications are in the identity category [67,74]. Both papers present mathematical formulations to detail the problem and proposed solutions for private data recovery, e.g.…”

“…In [67], a private data backup system is proposed, in which trusted audit services and trusted individuals are selected.…”

“…They argued that URLs could leak information, such as the country of origin and other affiliations. They proposed two countermeasures: With regards to private data recovery, there are three works that present this problem and propose solutions [67,74,128]. Two of them [67,74] introduce mathematical formalism and therefore were detailed above.…”

“…They proposed two countermeasures: With regards to private data recovery, there are three works that present this problem and propose solutions [67,74,128]. Two of them [67,74] introduce mathematical formalism and therefore were detailed above. The remaining article [128] in this category also concerns human-computer interaction (HCI).…”

“…With SSI, users are also overloaded with management tasks such as backing up their keys, identities, and credentials and creating and presenting claims. We have mapped publications that propose techniques to derive (self-sovereign) identities from federated and user-centric identities [2,16], and others that worry with the backup and recovery of keys [84,130] and private data [67,74]. Therefore, academia is picking up momentum on this migration challenge.…”