Decentralized Identifier (DID)

A W3C standard for a tamper-evident, cryptographically verifiable digital credential that uses Decentralized Identifiers to enable privacy-respecting, selective disclosure of claims about a subject. A VC contains the issuer's DID, the subject's DID, a set of claims, and a digital signature for non-repudiation. The holder presents a verifiable presentation aggregating multiple VCs without revealing the underlying raw data, a critical mechanism for proving data ownership without exposing proprietary training datasets.

A JSON-LD document associated with a DID that contains the cryptographic material and service endpoints necessary for authentication and interaction. Key components include:

• verificationMethod: Public keys for signature validation
• authentication: Mechanisms to prove DID control
• service: Endpoints for credential exchange or data storage The DID Document is resolved from a Verifiable Data Registry (VDR), such as a distributed ledger or decentralized storage network, and is essential for validating provenance attestations tied to enterprise content.

The practice of recording a cryptographic hash of a DID Document or provenance record on a distributed ledger to create an immutable, publicly verifiable timestamp. This anchors the DID's existence and state at a specific point in time without storing sensitive data on-chain. For enterprise data provenance, anchoring the hash of a Content Credential or dataset fingerprint to a ledger like Ethereum or Hyperledger provides a trustless proof of origin that survives organizational dissolution and prevents backdating of IP claims.

The process of taking a DID as input and retrieving its corresponding DID Document from the target Verifiable Data Registry. Resolution follows a standardized algorithm defined in the DID Core specification, involving:

• Method-specific resolution: Each DID method (e.g., did:web, did:ethr) defines its own read operation
• Dereferencing: Retrieving a specific resource within the DID Document, such as a public key or service endpoint For retrieval-bot access management, a content gateway can resolve a publisher's DID to fetch their current Content Licensing API endpoint and verify authorization tokens in real-time.

An identity architecture model where an individual or organization holds exclusive control over their identity data and how it is shared, without reliance on a centralized identity provider. SSI is built on three pillars:

• Decentralized Identifiers (DIDs) for persistent, cryptographically verifiable identifiers
• Verifiable Credentials for portable, privacy-preserving attestations
• Digital Wallets for secure key and credential storage In the context of data provenance, SSI enables a content creator to prove authorship of a training dataset to an AI model provider without exposing the dataset itself, using a Zero-Knowledge Proof of Origin derived from their DID.

A system that mediates the creation, verification, updating, and deactivation of Decentralized Identifiers and their associated DID Documents. A VDR can be implemented on:

• Distributed ledgers: Ethereum, Hyperledger Indy, ION (Bitcoin-anchored)
• Decentralized storage: IPFS, Swarm
• Web infrastructure: did:web hosted on standard HTTPS servers For enterprise provenance, the choice of VDR impacts data sovereignty and availability guarantees. A did:web implementation allows organizations to host DIDs on their own domain, aligning with existing DNS-based trust models while maintaining cryptographic verifiability.