|
Now I will focus on identity.
We use W3C Decentralized Identifiers as the identity foundation. The control plane maintains DID documents and public keys over a consortium-controlled registry or ledger, while the data plane uses cached verified key digests and validates lightweight credentials—such as JWT-like credentials carried in requests—so that we avoid expensive per-request identity resolution on the fast path.
Enrollment is controlled by a domain authority: it issues or endorses the DID document and records it in the domain registry. Key rotation and revocation are supported by updating the DID document or adding a revocation entry.
We also include cold-start protection: newly enrolled entities start at a neutral credit level and face conservative rate limits until sufficient observations accumulate, limiting abuse.
So the takeaway is: DIDs let us maintain long-lived accountability without relying on centralized identity authorities, while keeping fast-path verification lightweight. |