Relationship between entities, identities and attributes / identifiersDecentralized identifiers (DIDs) can be used to enable self-sovereign identities.
Self-sovereign identity (SSI) is an approach to digital identity that gives individuals control over the information they use to prove who they are to websites, services, and applications across the web. SSIs build upon decentralized identifiers (DIDs). Without SSI, individuals with persistent accounts (identities) across the internet must rely on a number of large identity providers, such as Facebook (Facebook Connect) and Google (Google Sign-In), that have control of the information associated with their identity.[2][3][4] If a user chooses not to use a large identity provider, then they have to create new accounts with each service provider, which fragments their web experiences. SSI offers a way to avoid these two undesirable alternatives. In a self-sovereign identity system, the user accesses services in a streamlined and secure manner, while maintaining control over the information associated with their identity.[5][6] This model of digital identity based on SSI puts users in full control of their identity data and addresses key limitations of centralized and federated identity providers, including security vulnerabilities, large-scale data breaches, limited privacy protections, and insufficient user control.[7]
The TCP/IP protocol provides identifiers for machines, but not for the people and organisations operating the machines. This makes the network-level identifiers on the internet hard to trust and rely on for information and communication for a number of reasons: 1) hackers can easily change a computer’s hardware or IP address, 2) services provide identifiers for the user, not the network. The absence of reliable identifiers is one of the primary sources of cybercrime, fraud, and threats to privacy on the internet.[8]
With the advent of blockchain technology, a new model for decentralized identity emerged in 2015.[9] The FIDO Alliance proposed an identity model that was no longer account-based, but identified people through direct, private, peer-to-peer connections secured by public/private key cryptography. Self-Sovereign Identity (SSI) summarises all components of the decentralized identity model: digital wallets, digital credentials, and digital connections.[3]
Digital identity systems
Digital identity systems have traditionally been built around centralized or federated identity providers, where identity data is created, stored, and controlled by third-party organizations. While these models have enabled large-scale online services, they have also introduced significant challenges, including single points of failure, large-scale data breaches, limited interoperability, and reduced user control over personal information. As a result, individuals and organizations are often required to repeatedly disclose sensitive data and rely on intermediaries to authenticate and authorize access across digital services.[7]
Self-Sovereign Identity (SSI) emerges as a response to these limitations by redefining how digital identities are created, managed, and used. SSI is a user-centric identity paradigm in which individuals and organizations act as the primary controllers of their digital identities, rather than relying on centralized authorities. In this model, identity data is held by the subject—typically in a digital wallet or agent—and shared selectively with relying parties only when required.
SSI systems are commonly built upon Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs). DIDs provide decentralized, cryptographically verifiable identifiers that enable secure authentication without centralized registries, while verifiable credentials allow trusted issuers to attest to specific claims about an identity subject. These credentials can be presented and verified cryptographically, often without direct interaction with the issuer at the time of verification.
A defining characteristic of SSI is its emphasis on privacy, user autonomy, and interoperability. Techniques such as selective disclosure and minimal disclosure reduce unnecessary data exposure, while open standards ensure that identities and credentials can be reused across systems and domains. Governance frameworks and trust models complement the technical architecture by defining who may issue credentials and under what conditions they are trusted.
In this context, SSI represents a shift from institution-centric identity management toward a decentralized, user-controlled, and standards-based identity ecosystem, capable of supporting secure and privacy-preserving interactions across digital services.
SSI-based Identity Management System
SSI systems build on decentralized identifiers to enable individuals and organizations to own, manage, and selectively disclose their identity information. Their design emphasizes user sovereignty, verifiable credentials issued by trusted parties, selective and minimal disclosure of data, secure wallet or agent architectures, governance frameworks for trust and compliance, and usability features such as recovery and cross-device support. Together, these design aspects aim to balance security, privacy, interoperability, and user experience.
When designing a decentralized identity management system based on Decentralized Identifiers and Self-Sovereign Identity principles, one can start from a reference architecture involving Issuers, Holders, and Verifiers, with digital wallets or agents acting on behalf of identity subjects. A specific identity infrastructure can then be selected that encapsulates the following layers:[7]
Entry Layer – serves as the user-facing interface for identity subjects and relying parties, supporting interactions with wallets or agents, and enforcing security, authentication, and access-control mechanisms, as well as auxiliary (orthogonal) services;
Core Layer – comprises processing components that implement the core identity functions, including DID resolution and credential revocation;
Storage Layer – consists of storage and registry components responsible for maintaining the system state, including DID records and revocation information, which the decentralized identity management system relies upon to establish trust and support interactions among Issuers, Holders, and Verifiers.
Technical aspects
SSI addresses the difficulty of establishing trust in an interaction. In order to be trusted, one party in an interaction will present credentials to the other parties, and those relying on the parties can verify that the credentials came from an issuer that they trust. In this way, the verifier's trust in the issuer is transferred to the credential holder.[10] This basic structure of SSI with three participants is sometimes called "the trust triangle".[3]
It is generally recognized that for an identity system to be self-sovereign, users control the verifiable credentials that they hold, and their consent is required to use those credentials.[11] This reduces the unintended sharing of users' personal data. This is contrasted with the centralized identity paradigm where identity is provided by some outside entity.[12]
A SSI example of a studentA SSI example in the European Union
The European Union is exploring decentralized digital identity through a number of initiatives including the International Association for Trusted Blockchain Application (INATBA), the EU Blockchain Observatory & Forum and the European SSI Framework. In 2019, the EU created an eIDAS compatible European Self-Sovereign Identity Framework (ESSIF). The ESSIF makes use of decentralized identifiers (DIDs) and the European Blockchain Services Infrastructure (EBSI).[14][15]
Korea
The Korean government created a public/private consortium specifically for decentralized identity.[16]
Germany
In the German and European legal area, there are two regulations that are of particular importance for the topic. These include the eIDAS Regulation, which forms the most important framework for trust in electronic identification in the EU and is a fundamental building block of the digital single market. The European Blockchain Service Infrastructure (EBSI)[17] has provided the SSI eIDAS Bridge,[18] as a technical implementation that enables a substantial level of trust.[19] The eIDAS SSI legal report also describes several scenarios of how SSI can fulfill the necessary regulatory conditions.
Furthermore, the General Data Protection Regulation (GDPR) forms the legal basis for the handling of personal data. The EBSI GDPR Legal Report provides more information on this.[20]
Concerns
Implementation and semantic confusion
SSI is a value laden technology whose technical operationalizations differ (see Technical aspects).[21] Therefore, its implementations can vary significantly and embed into the very technology different goals, agenda, and intentions.[22]
The term "self-sovereign identity" can create expectations that individuals have absolute control and ownership over their digital identities, akin to physical possessions. However, in practice, SSI involves complex technical infrastructure, interactions with identity issuers and verifiers, and compliance with legal frameworks. The reality may not align with the perception generated by the term, leading to semantic confusion.[23]
Digital literacy
Critics argue that SSI may exacerbate social inequalities and exclude those with limited access to technology or digital literacy.[22][24] SSI assumes reliable internet connectivity, access to compatible devices, and proficiency in navigating digital systems. Consequently, marginalized populations, including the elderly, individuals in developing regions, or those with limited technological resources, may face exclusion and reduced access to the benefits of SSI.[25]
↑Mühle, Alexander; Grüner, Andreas; Gayvoronskaya, Tatiana; Meinel, Christoph (2018). "A survey on essential components of a self-sovereign identity". Computer Science Review. 30 (1): 80–86. arXiv:1807.06346. doi:10.1016/j.cosrev.2018.10.002. S2CID49867601.
↑Allen, Christopher (April 25, 2016). "The Path to Self-Sovereign Identity". Life With Alacrity. Retrieved February 19, 2021. Users must control their identities.… Users must agree to the use of their identity.
This page is based on this Wikipedia article Text is available under the CC BY-SA 4.0 license; additional terms may apply. Images, videos and audio are available under their respective licenses.
