Self-Sovereign Identity

A globally unique persistent identifier that does not require a centralized registration authority. DIDs are cryptographically verifiable and resolve to DID Documents containing public keys and service endpoints.

• Uses W3C standard format: did:example:123456abcdef
• Enables mutual TLS authentication without certificate authorities
• Each DID is controlled by the entity that holds the associated private key
• Supports key rotation and recovery mechanisms natively

Tamper-evident digital attestations that are cryptographically signed by an issuer and held by the subject in their own digital wallet. These credentials can be selectively disclosed without revealing the entire document.

• Uses zero-knowledge proofs for minimal disclosure
• Supports revocation registries for credential invalidation
• Enables a healthcare provider to prove board certification without revealing their full employment history
• Format: JSON-LD with linked data integrity proofs

The subject of an identity holds and manages their own private cryptographic keys, eliminating the risk of a centralized honeypot of credentials being breached. Key material never leaves the holder's secure environment.

• Hardware security modules and secure enclaves protect key material
• Supports biometric recovery and social recovery mechanisms
• Eliminates the password database attack vector entirely
• Enables offline verification scenarios

The ability to reveal only the minimum necessary information from a credential to satisfy a verifier's request. This implements the principle of data minimization required by GDPR and HIPAA.

• Prove age over 18 without revealing exact birthdate
• Demonstrate hospital affiliation without exposing employee ID
• Uses BBS+ signatures and CL signatures for efficient selective disclosure
• Reduces compliance surface area during audits

SSI systems are built on open standards that ensure credentials issued by one institution are verifiable by any other without bilateral agreements or proprietary integrations.

• Built on W3C Verifiable Credentials Data Model
• Uses DIDComm messaging protocol for secure peer-to-peer communication
• Enables cross-institutional federated learning consent without custom APIs
• Eliminates vendor lock-in for identity infrastructure

The identity holder can migrate their credentials and identifiers between different wallet providers and platforms without losing continuity or requiring re-issuance from original sources.

• Credentials are stored as portable JSON-LD documents
• DID methods support ledger migration paths
• Prevents a single technology provider from holding identity hostage
• Critical for long-term clinical credential lifecycle management

A globally unique, persistent identifier that requires no centralized registration authority. DIDs are cryptographically verifiable and resolve to DID Documents containing public keys and service endpoints.

• Uses W3C DID Core specification for interoperability
• Enables institutions to authenticate without a central certificate authority
• Supports key rotation without changing the identifier itself

Tamper-evident digital credentials that are cryptographically signed by an issuer and held by a subject. In healthcare federated learning, VCs can attest to institutional compliance certifications, researcher qualifications, or patient consent status.

• Conform to W3C Verifiable Credentials Data Model
• Support selective disclosure via zero-knowledge proofs
• Revocable through credential status lists without central registry

The distributed generation, storage, and rotation of cryptographic keys across independent nodes. Unlike federated key management for model encryption, DKM focuses on individual identity keys that subjects control directly.

• Uses Hierarchical Deterministic key derivation for recovery
• Enables threshold signatures requiring multiple parties to authorize
• Prevents single-node compromise from exposing entire identity infrastructure

The automated workflow for dynamically obtaining, tracking, and enforcing granular patient permissions across decentralized nodes. In SSI architectures, consent receipts are themselves verifiable credentials.

• Aligns data usage with specific legal bases under GDPR
• Enables real-time consent revocation propagated across the network
• Provides cryptographically auditable proof of authorization for every training round

An immutable, append-only distributed ledger that records identity operations—DID creation, credential issuance, and revocation events—without storing personally identifiable information on-chain.

• Uses Merkle tree structures for tamper-evident logging
• Provides regulatory-grade chain of custody for identity events
• Enables cross-institutional verification without shared databases

The legal principle that digital patient information remains subject to the governance of its jurisdiction of origin. SSI enforces sovereignty by keeping identity claims under the subject's control rather than in a central registry.

• Addresses data residency requirements across national boundaries
• Enables compliance with GDPR, HIPAA, and local privacy laws simultaneously
• Shifts control from institutional silos to the data subject