18 MAPPING SELF SOVEREIGN IDENTITY MODELS TO THE TRUST FRAMEWORK

OIX has ensured that this framework model addresses the needs of both ‘traditional’ centralised identity models and newer Self Sovereign privacy-centric digital identity models.

In the Self Sovereign model the provider of the Wallet the user, or holder, utilises to manage their Digital Identity is likely to take the role of the Identity Provider as described in this guide. Accordingly, a ‘Smart Wallet’ is required that works for the user to enable the rules of the Relying Party to be easily fulfilled.

The below diagram shows how the roles and constructs used in Self Sovereign models map to a Digital ID as described in this guide:

 

 

 

 

 

 

 

 

 

 

 

The below diagrams and tables explore how SSI roles overlay on some of the examples of how a Digital ID works referred to earlier in this guide. 

The use of a Passport Digitized Credential is a good example of a single layered self-sovereign transaction:

1. User Requests check-in from carrier
2. Carrier requests passport info from traveller
3. User authenticates to Digital ID Smart Wallet and Requests passport
4. Digital ID Smart Wallet makes request to Issuer
5. Issuer asks User to Verify request to share digital passport
6. User Approves request to share digital passport
7. Issuer issues digital passport to Digital ID Smart Wallet
8. Digital ID Smart Wallet shares digital passport

 

 

However, once the Digital ID, or a Rules Agent, starts to derive credentials, the Digital ID or Rules Agent  also plays the role of verifier and issuer, resulting in a more complex picture. The below Diagram shows how this works with a Rules Agent:

 

1. User Requests an account creation from Relying party
2. Relying party discloses rules to holder
3. User authorizes Digital ID Smart Wallet to accept rules from Relying party and to provide required identity information to Rules Agent
4. Smart wallet provides required identity information to Rules Agent
5. Rules Agent issues derived credential to Digital ID Smart Wallet
6. Digital ID Smart Wallet shares derived credential to relying party

 

 

The Relying Party is also an Issuer when it creates an Access Credential for the user to use to access their account with that Relying Party. So it also becomes the verifier of its issued credential:

1. Relying Party offers User the ability to user their Digital ID Smart Wallet to access their account  
2. User accepts this offer
3. User goes to their Digital ID Smart Wallet
4. Relying Party issues their authenicator rules to the Digital ID Smart Wallet
5. Relying Party issues their an accoutn key into the Users Digital ID Smart Wallet, which is bound to the correct authenticators.
6. User wishes to access their accoint with the Relying Party
7. Relying party asks the user to present their account key.
8. User presents their accoint key to the Relying Party.