Self-Sovereign Identity: A Systematic Review, Mapping and Taxonomy

Abstract

Self-Sovereign Identity is a user-centric identity model. In this model, the user maintains and controls their data. When requested by a service provider, user data is sent directly by the user, without the intermediation of third parties. Thus, in Self-Sovereign Identity, the participation of known identity providers for proof of identity is reduced, which increases user privacy. This identity model has attracted the attention of researchers and organizations around the world. All this interest increased the number of scientific articles published on the subject. The analysis of published materials showed that ideas and proposals are very diverse and dispersed.Although there are few systematic reviews, they lack methodological rigor and are limited to a small subset of published works.This study presents a rigorous systematic mapping and systematic literature review covering theoretical and practical advances in Self-Sovereign Identity. We identified and aggregated evidence from publications to answer four research questions, resulting in a classification scheme used to categorize and review publications. Open challenges are also discussed, providing recommendations for future work.

Leveraging Self-Sovereign Identity, Blockchain, and Zero-Knowledge Proof to Build a Privacy-Preserving Vaccination Pass

“…In [11], digital identity is defined as the representation of an entity linked to a specific context. Linking digital identity to specific contexts is a commonly accepted idea in the literature [18,46,31].…”

“…The four IAM models. Constant lines represent interactions, and dashed lines mean trust [46] An identity management system defines how entities are identified, authenticated, and authorized to access restricted access services [18]. Digital identity and IAMs can be modeled in different ways.…”

“…Facebook, Google, and Twitter. These companies have become substantial data silos, trapping people in an oligarchy of few IDPs without portability among themselves [46].…”

“…Although a precise definition of SSI is still under debate, as discussed in [46], [40] and [18], the SSI literature solidifies the idea that the user should own and manage their data. In other words, both attributes and credentials, which can be self-signed or signed by third parties, must be controlled only by users, who present their data to SPs whenever they desire.…”

“…SSI is a user-centric paradigm of digital identity [1,46]. In an SSI-based ecosystem, the user is central to identity management, having control and cryptographic guarantees over shared personal data.…”