Event based transfer of did delegated authority

Patent metadata

Field	Value
Publication number	US-11522858-B2
Application number	US-201916570863-A
Country	US
Kind code	B2
Filing date	Sep 13, 2019
Priority date	Sep 13, 2019
Publication date	Dec 6, 2022
Grant date	Dec 6, 2022

Abstract

Embodiments are related to computing systems and methods for event based transfer of DID delegated authority. An indication is received that a first DID user is attempting to use a delegated DID on behalf of a second DID user. The first DID user has previously been delegated authority to use the delegated DID by operation of a legal relationship or a legal agreement between the first and second DID users. A determination is made if an event has occurred that has changed the legal relationship or the legal agreement between the first and second DID users. If an event has occurred, the delegation of authority to use the delegated DID is automatically revoked such that the first DID user is no longer able to use the delegated DID. If an event has not occurred, the first DID user is allowed to continue to use the delegated DID.

First claim

What is claimed is:

1. A computing system that is implemented in a decentralized network that implements a distributed ledger, the distributed ledger being configured to back one or more decentralized identities (DID) for one or more users of the computing system, the computing system comprising:
one or more processors; and
one or more computer-readable hardware storage devices that store instructions that are executable by the one or more processors to cause the computing system to:
receive an indication that a first DID user is attempting to use a delegated DID associated with a second DID user on behalf of the second DID user, the first DID user having previously been delegated authority to use the delegated DID by operation of one or more of a legal relationship or a legal agreement between the first and second DID users that provides the delegated authority,
wherein the delegated DID is a globally unique identifier (i) that is managed independently of any centralized authority (ii) that is operable to identify the second DID user to an identity system, and (iii) that is currently under control of the first DID user even though the delegated DID uniquely identifies the second DID user, and
wherein the delegated DID is associated with a DID document that describes how the delegated DID is permitted to be used, wherein the DID document includes authorization information that provides the delegated authority to the first DID user, and wherein the DID document includes personally identifiable information (PII) for the first DID user, said PII comprising one or more of a name, address, occupation, family members, or age;

determine if an event has occurred that has changed the legal relationship or the legal agreement between the first and second DID users;
if an event has occurred, automatically revoke the delegation of authority to use the delegated DID and record an indicator in the distributed ledger, wherein the indicator indicates that the first DID user's delegated authority to use the delegated DID has been revoked, and wherein the first DID user is no longer able to use the delegated DID on behalf of the second DID user; and
if an event has not occurred, allow the first DID user to continue to use the delegated DID on behalf of the second DID user.

2. The computing system according to claim 1 , wherein the executed computer-executable instructions further cause the computing system to:
if an event has occurred, cause the first DID user to return control of all DID-related data associated with the delegated DID to the second DID user.

3. The computing system according to claim 1 , wherein the legal relationship is that the first DID user is a parent or other legal guardian of the second DID user, the event being that the second DID user has reached adulthood or that that the legal guardianship has been terminated, the second DID user thus becoming legally independent from the first DID user.

4. The computing system according to claim 1 , wherein the legal relationship is that the first DID user is married to the second DID user, the event being that the second DID user has divorced the first DID user.

5. The computing system according to claim 1 , wherein the legal relationship is that the first DID user is married to the second DID user, the event being that the second DID user has died.

6. The computing system according to claim 1 , wherein the legal agreement is an employment contract that states that the first DID user is an employee of the second DID user, the event being that the second DID user has terminated the employment of the first DID user.

7. The computing system according to claim 1 , wherein the legal agreement is an agreement that states that the first DID user is able to act on behalf of the second DID user, the event being that the second DID user has terminated the agreement.

8. The computing system of claim 1 , wherein determining if the event has occurred comprises:
receiving input from the second DID user that informs that the event has occurred.

9. The computing system of claim 1 , wherein determining if the event has occurred comprises:
automatically determining that the event has occurred based on the legal relationship.

10. A method for event based transfer of decentralized identities (DID) delegated authority, said method being implemented in a computing system that is implemented in a decentralized network that implements a distributed ledger, the distributed ledger being configured to back one or more DIDs for one or more users of the computing system, the method comprising:
receiving an indication that a first DID user is attempting to use a delegated DID associated with a second DID user on behalf of the second DID user, the first DID user having previously been delegated authority to use the delegated DID by operation of one or more of a legal relationship or a legal agreement between the first and second DID users that provides the delegated authority,
wherein the delegated DID is a globally unique identifier (i) that is managed independently of any centralized authority (ii) that is operable to identify the second DID user to an identity system, and (iii) that is currently under control of the first DID user even though the delegated DID uniquely identifies the second DID user, and
wherein the delegated DID is associated with a DID document that describes how the delegated DID is permitted to be used, wherein the DID document includes authorization information that provides the delegated authority to the first DID user, and wherein the DID document includes personally identifiable information (PII) for the first DID user, said PII comprising one or more of a name, address, occupation, family members, or age;

determining if an event has occurred that has changed the legal relationship or the legal agreement between the first and second DID users;
if an event has occurred, automatically revoking the delegation of authority to use the delegated DID and recording an indicator in the distributed ledger, wherein the indicator indicates that the first DID user's delegated authority to use the delegated DID has been revoked, and wherein the first DID user is no longer able to use the delegated DID on behalf of the second DID user; and
if an event has not occurred, allowing the first DID user to continue to use the delegated DID on behalf of the second DID user.

11. The method according to claim 10 , further comprising:
if an event has occurred, causing the first DID user to return control of all DID-related data associated with the delegated DID to the second DID user.

12. The method according to claim 10 , wherein the legal relationship is that the first DID user is a parent or other legal guardian of the second DID user, the event being that the second DID user has reached adulthood or that that the legal guardianship has been terminated, the second DID user thus becoming legally independent from the first DID user.

13. The method according to claim 10 , wherein the legal relationship is that the first DID user is married to the second DID user, the event being that the second DID user has divorced the first DID user.

14. The method according to claim 10 , wherein the legal relationship is that the first DID user is married to the second DID user, the event being that the second DID user has died.

15. The method according to claim 10 , wherein the legal agreement is an employment contract that states that the first DID user is an employee of the second DID user, the event being that the second DID user has terminated the employment of the first DID user.

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Murdoch Brandon
• Patel Ankur

Classifications

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L63/102

  Entity profiles · CPC title

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• H04L63/108

  when the policy decisions are valid for a limited amount of time · CPC title

• H04L63/0884 Primary

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title