Design and Implementation of a Decentralized Trusted Issuer Registry for Self-Sovereign Identity

Abstract

Verifiable Credentials enable subjects to make claims about one another whose integrity and authenticity can be securely verified. Nevertheless, verifying an issuer's trustworthiness is not possible from the credential alone. Trusted Issuer Registries (TIRs) were created to address this issue. However, the existing designs do not fully meet the needs of Self-Sovereign Identity. This thesis aims to design a novel decentralized, general-purpose Trusted Issuer Registry architecture. To that end, we analyzed existing TIR designs and gathered user requirements from an actual use case using interviews with five experts from the Gaia-X project. The findings indicated, among others, the necessity for issuer identification, authorization, and hierarchical sub-registries, alongside a focus on availability, scalability, security, and flexibility. From that, we inferred an improved TIR design, which was implemented as a prototype. The design leverages Decentralized Identifiers to reference TIRs and leaves implementation-specific details unspecified, specifying only a data model to which every TIR must resolve. The TIR's implementation proves the concept and demonstrates its capabilities. Ultimately, this thesis proposes an improved Trusted Issuer Registry design, contributing to the enhancement of issuer verification in Self-Sovereign Identity.

Research Questions

• RQ1: What are the advantages and disadvantages of existing centralized and decentralized Trusted Issuer Registry designs?
• RQ2: How can a general-purpose Trusted Issuer Registry be designed to meet the needs of Self-Sovereign Identity in Gaia-X ecosystems and address the drawbacks of existing solutions?
  • RQ2.1: What specific functionalities should a Trusted Issuer Registry provide in Gaia-X ecosystems?
  • RQ2.2: What are the requirements for a Trusted Issuer Registry in Gaia-X ecosystems?
  • RQ2.3: What is a suitable technical infrastructure for a Trusted Issuer Registry?
  • RQ2.4: How can scalable governance be achieved?
• RQ3: How can the design be implemented using a concrete technology?