7. Party Credential
The Party Credential is based upon the Verifiable Credentials Data Model v2.0 and is the basement for all IAA Parties such as Natural Persons(wallets, private keypair), Services, Legal Persons, other Participants, Web Sites etc etc, in fact this general purpose credential is intended to be extended into specialized Credentials(see Party Credential Specializations)
This is how
Party Credential will be defined by the following attributes
||URI||Yes||A resolvable link to the holder verificationMethod to be used to uniquely identify ONE and ONLY key pair|
||policy in ODRL||No||A list of
||String||No||A list of literals representing Identity Attributes to be used in a ABAC context|
||String||No||A list of literals representing Identity Roles to be used in a RBAC context|
VERY IMPORTANT NOTE
The credentialSubject.id must identify the DID Document that contains the verificationMethod(keypair) referenced by
gx:holder property that belong to/is controlled by the Credential Holder, with this solution the PartyCredential VC can be publicly published in case contains no sensitive data or keep private in case contains PII - Personal Identifiable Information.
7.1 Private Party Credentials
All the Party Credential containing PII are not considered to be published and reachable via their id to everybody, instead they are intended to be stored in secure storage such as Wallet, Device Secure Storage, Vault, etc. As an example of this kind of credential let’s consider a NaturalPersonCredential issued by a Legal Participant to one of his users that contains Name, Surname, identityAttributes, Roles, etc etc, MUST NOT be published as the other Credentials(e.g. ServiceOffering) with the purpose of entitling a Natural Person to interact with Relying Parties(RP) in a certain ecosystem. In this scenario, it makes sense also consider “selective disclosure” during interacting with other RP and whether or not to submit it to the compliance engine.
7.2 Public Party Credentials
All Party Credential that contains data that can publicly be accessed and queried by everybody. As an example for this kind of credential let’s consider a MembershipCredential issued by a LegalParticipant who run an Ecosystem to another Participant to attestates his Membeship status.
In the example below the issued party credential id is not public and the credentialSubject.id is a did:key referencing a keypair owned by the Holder
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32
8. Party Credential lifecycle
- expired if the expiration datetime is older than current datetime or the certificate containing the key used to sign the claim has expired.
- if the key used to sign the array is revoked.
- if the credentialStatus has the statusPurpose property set to “revocation” and the value of status at position credentialIndex is true
- suspended if the credentialStatus has the statusPurpose property set to “suspension” and the value of status at position credentialIndex is true
- deprecated if another verifiable credential with the same identifier and the same signature issuer has a newer issuance datetime.
- active only if none of the above.
9. Party Credential Status
Verifiable Credentials is a fundamental component of secure data and identity systems, enabling the issuance and presentation of trustworthy and tamper-proof credentials. However, in dynamic and evolving environments, it is crucial to establish mechanisms for the timely revocation or suspension of these credentials in case of compromised or outdated information.
The use of Credential Status Lists (CSL), specifically the W3C Verifiable Credentials Status List v2021, addresses this need by providing a standardized approach to manage and communicate the revocation status of verifiable Credentials.
When a Verifiable Credential is issued, the issuer has the option to embed a reference to the Credential Status List (CSL) entry associated with the credential. This reference, often in the form of a Uniform Resource Identifier (URI), enables relying parties (commonly verifiers) to promptly determine the current status of the credential’s validity.
To validate a presented Verifiable Credential, the relying party retrieves the referenced Credential Status List entry using the provided URI. This entry contains information about the revocation status of the credential, allowing the relying party to check if the credential is still valid, has been revoked/suspended, or has any other relevant status.
Relying parties can periodically update their local copy of the Credential Status List from trusted sources to ensure they possess the most current revocation status information. This practice prevents reliance on outdated or incorrect information, enhancing the overall security of the ecosystem.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
10. Party Credential Specializations
Here are defined some of the possible Party Credential specializations.
10.1 Natural Person Party Credential
This credential is issued by a Participant to entitle a natural person(usually one of his users) to interact with other Relying Parties belonging to other Participants
This is how
Natural Person Party Credential will be defined by the following attributes in addition to Party Credential attributes
||String||Yes||Name of the natural person|
||String||Yes||Surname of the natural person|
10.2 Legal Person Party Credential
This credential is issued by a Legal Person Participant to entitle another legal person(usually one of his users) to interact with other Relying Parties belonging to other Participants in behalf of
This is how
Legal Person Party Credential will be defined by the following attributes in addition to Party Credential attributes
||String||Yes||Organization Identifier used in the eIDAS rules|
10.3 Service Party Credential
This credential is issued by a Participant to entitle a automated service(usually automated process that perform task ) to interact with other Relying Parties belonging to other Participants
This is how
Service Party Credential will be defined by the following attributes in addition to Party Credential attributes
||URI||Yes||The base URL endpoint where the service is accessible|