...
| Table of Contents | ||
|---|---|---|
|
1. Credential LifeCycle
...
in Wallet
Credential holders should be able to retrieve, securely store and manage various types of digital credentials, including educational, professional, and other verifiable credentials in the Wallet.
1.1. Importing Credentials into Wallet
The wallet must seamlessly integrate with a variety of credential issuers, ensuring a streamlined process for credential issuance and updates into the wallet.
A user-friendly and customizable customisable mechanism should be in place to facilitate integration with credential issuers. This ensures a simplified and efficient addition of new credentials to the wallet.
| Tip |
|---|
Use Case Robert applies for health insurance with XYZ Insurance. Upon verifying his details, XYZ Insurance issues the policy and sends it to Robert via email. The email contains a QR code. When Robert scans the QR code with his mobile phone, the wallet app prompts him to enter the policy ID and date of birth for security. Upon entering the details, Robert receives the Policy Credential in the wallet. |
| Info |
|---|
|
1.2. Secure Storage of Credentials in Wallet
The wallet must provide a secure environment for storing sensitive credential information, implementing encryption techniques to protect stored credentials and ensuring that only authorized authorised users can access and decrypt the information.
1.3. Organise and Manage Credentials in Wallet
The wallet must provide mechanisms to organise the credentials and should support features such as,
Ordering of credentials in the wallet
Ability to categorise the credentials based on type
Ability to give a name to the credential
1.4. Remove a Credential from the Wallet
The wallet must allow the holder the ability to remove credentials from the wallet.
| Tip |
|---|
Use Case Moris plans a trip to the Caribbean, purchases flight tickets, and adds the ticket credentials to his wallet. However, due to unforeseen circumstances, he has to cancel the trip. To tidy up his wallet, he decides to remove the ticket credentials:
|
1.5. Transfer of Credentials from One Device to Another
The credentials can be transfered from one device to another (when credentials are locally stored in a device) by the holder. The transfer can happen subject to the binding of credentials to the new device has to happen once again.
| Tip |
|---|
Use Case Amanda, in the process of upgrading her phone, needs to transfer all her data, including credentials and documents, to her new device. With no automatic cloud wallet integration available, she follows these steps:
|
2. Presentation and Sharing of Credentials
The wallet must empower credential holders with control over their digital credentials, allowing them to decide when and how to share specific information.
2.1. Presenting Credentials in
...
Standardised Formats
The holder should be able to digitally present the credentials to relying parties or verifiers through a secure and standardized standardised format, making it interoperable and convenient for various verification scenarios.
...
To enhance privacy, the holder should be able to choose and share specific attributes of a credential without revealing unnecessary details, giving them control over the information disclosed.
| Tip |
|---|
Hari, a 19-year-old, was riding his bike when he was stopped by a Traffic Police officer. Observing Hari's youthful appearance, the officer decided to verify Hari's age since the country has a minimum age limit of 18 for individuals to ride a vehicle. The officer requested Hari to show his credentials for age verification. In response, Hari accessed his mobile wallet, while the police officer opened his verification application. The officer then initiated an authorization request to Hari's device. Hari's wallet retrieved the request object, which requested for the claim "ageOver18" from his driving license to be shared. The wallet informed Hari that the Police Officer was seeking confirmation of whether the age is over 18 or not. Considering that his driving license credential contained the claim "ageOver18," Hari authorized the sharing of this information with the police officer. |
| Info |
|---|
Reference:
|
| Info |
|---|
Selective Disclosure Signatures |
2.3. Mode of Sharing
The wallet should provide a mechanism for the holder to share the credentials in a secure and standardized standardised manner using standard protocols.
...
QR Code Sharing
Method: Generate a QR code representation of the verifiable credentials.
Usage: Users can display the QR code on their device, and verifiers can scan it to receive the credential information. This method is efficient and can be used in offline scenarios.
Secure URL or Links
Method: Create a secure URL link to the verifiable credentials.
Usage: Users can share the link with verifiers, who can then access the credential information through a secure online connection. This method is convenient for remote verification.
Bluetooth Sharing
Method: Leverage Bluetooth technology for secure data transmission.
Usage: Users can share their credentials with Bluetooth-enabled devices, providing a wireless and secure means of transferring information.
NFC (Near Field Communication) Sharing
Method: Transmit credential information between devices using NFC.
Usage: Users tap their device against an NFC-enabled verifier's device to securely share the credential.2. User Control and Consent.
Deep Linking
Method: Generate a deep link pointing to the specific credential within the Digital Credential Wallet.
Usage: Users share the deep link, and recipients can click or open it to access the credential directly within the app.
Credential Sharing via DLT (Distributed Ledger Technology):
Method: Leverage blockchain or other DLT for secure and tamper-evident credential sharing.
Usage: Credentials are stored on a decentralized decentralised ledger, and users can share proof of credentials without revealing the actual data.
Email or Messaging Integration:
Method: Send encrypted credential information via email or messaging.
Usage: Users send verifiable credentials directly to verifiers through secure communication channels.
2.4. Biometric
...
Authorisation during Sharing
The digital wallet should offer a provision for credential holders to authenticate themselves, preferably utilizing utilising biometrics, before sharing credentials, thereby adding a layer of security. This process also ensures that the credential holder was physically present during the credential sharing, and implicit consent was captured.
...
Verifiers must be able to independently verify the authenticity of the credentials shared by the credential holders.
3.1.
...
Standardised Verification Process
The verifiers should have a standardized standardised and reliable process to identify the type of credentials and independently verify the authenticity of presented credentials to ensure that the credential has not been tampered with and is issued by a trusted issuer.
3.2.
...
Decentralised Verification
The verification process should not rely solely on a centralized centralised authority; verification can happen in a decentralized decentralised manner. Hence, we are recommending the use of Verifiable Credentials for the digital credential wallet.
...
The wallet must automatically identify credential based on the expirations and marking expired credentials as invalid.
...
.
5. Administation
5.1. Governance
5.1.1. Creation of a Wallet Registry
In the context of the system's administration and governance in a country, the creation of a Wallet Registry could be needed. This registry serves the purpose of recording and managing wallets authorized to store credentials that are issued within the country. The primary objective is to establish a controlled environment where issuers can verify the authenticity of a wallet before transferring or sharing credentials to it.
5.1.2. Creation of a Sectorial Issuer Registry
In the governance framework of the system, a Sectorial Issuer Registry can be established. This registry is intended to systematically record and manage information about issuers operating within specific sectors. The goal is to provide a structured approach for overseeing and verifying the legitimacy of issuers before they participate in the issuance and sharing of credentials. This registry can be used by wallets or verifiers to verify by the
5.1.3. Workflow Management for Registration
Should provide a configurable workflow to perform review of the application shared by a wallet solution or Issuer to register into the respective trust registry.
5.2. Issuer Side Administrator
5.2.1. Issuance of Credentials into Registry
As part of the administrative capabilities on the issuer side, the Issuer Side Administrator should have the functionality to add credentials into the registry.
5.2.2. Revocation of Issued Credential
The system should facilitate the revocation and potential reversal of issued credentials by administrators.
5.2.3. Ledger Management
Issuer Side Administrators should have the capability to trace and monitor changes made to a credential using a ledger.
5.2.4. Controls by Issuers
The format of the credential to be Issued
The type of the credential to be issued
The authentication methods for issuing a credential
The authentication methods to share a credential from a wallet
6. Wallet Usage
This section will detail the usage of wallet once the credentials are onboarded on the wallet.
6.1. Credentials for Authentication
This feature allows credential holders to authenticate themselves using selected credentials stored in the wallet, leveraging diverse authentication mechanisms available within the wallet's functionality.
5.1. Authentication Methods
The wallet should be able to support multiple authentication methods, including but not limited to biometrics (fingerprint, facial recognition), PIN, and passphrase. This would enable the holder to have the flexibility to choose and configure their preferred authentication method.
5.2. Secure Authentication Protocols
The wallet should have robust and secure authentication protocols, ensuring the confidentiality and integrity of authentication processes. Industry-standard protocols such as OAuth or OpenID Connect should be used for secure interactions.The type of authentication methods supported by a credential can be defined by the issuer.
6.2. Using Wallet for Signing Documents
This feature allows the user to take a document as input and sign it using the user’s key present in the user’s device which is bounded to a specific credential.
6.2. Using Wallet for storing and sharing Documents
The user can use his wallet like a Personal Vault.
This feature allows the user to save and share personals documents (eg passport, birth certificate, diploma,…)