Self-Sovereign Identity is an emerging, user-centric, decentralized identity approach utilizing some form of decentralized technology. It provides a means for digital identification without reliance on any external authority, enabling entities to control their identity and data flow during digital interactions while enhancing security and privacy. With the rise of blockchain technology, Self-Sovereign Identity is gathering momentum in academia and industry while the number of research papers increases rapidly. However, Self-Sovereign Identity is still a young unstructured field in its early stages of research. Thus, a systematic mapping methodology was adopted to provide a coarse-grained overview of decentralized and Self-Sovereign Identity and structure the research area by identifying, analyzing, and classifying the research papers according to predefined parameters, which is to say according to their contribution, application domain, IT field, research type, research method, and place of publication. Furthermore, the nature and scope of the research were determined, while existing research topics, gained insights into trends, demographics, challenges, gaps, and opportunities for future research were also presented. The results suggest that validation research and solution proposals prevail, addressing decentralized identity in a general matter. Papers mainly propose systems/solutions, architectures, and frameworks, focusing on authentication, security, privacy, and trust, while there are hardly any studies researching usability, user experience, patterns, and good practices.

Self-Sovereign Identity (SSI) is a novel and emerging, decentralized digital identity approach that enables entities to control and manage their digital identifiers and associated identity data while enhancing trust, privacy, security, and the many other properties identified and analyzed in this paper. The paper provides an overview and classification of the SSI properties, focusing on an in-depth analysis, furthermore, presenting a comprehensive collection of SSI properties that are important for the implementation of the SSI system. In addition, it explores the general SSI process flow, and highlights the steps in which individual properties are important. After the initial purification and classification phase, we then validated properties among experts in the field of Decentralized and Self-Sovereign Identity Management using an online questionnaire, which resulted in a final set of classified and verified SSI properties. The results can be used for further work on definition and standardization of the SSI field.

Self-sovereign identity (SSI) is a user-centric, decentralised identity approach that provides a means for identification, authentication, and authorisation without the involvement of external entities, responsible for identity provisioning and management in current centralised and federated approaches. In general, the basic building blocks of an SSI system include decentralised identifiers, verifiable credentials, identity wallets, a verifiable data registry, and three main actors: issuer, identity holder, and verifier. Even though the SSI field is dominated by proposals, SSI systems can be implemented in different ways, which is reflected in the absence of a well-defined architecture. Thus, the best implementation is still a matter of research, the requirements of the individual system, and its field of application. However, well-designed and implemented systems are crucial to avoiding failures, speeding up the development process, ensuring high quality, and the broader adoption of SSI solutions. Hence, the main objective of this study was to identify design patterns and good practices of the SSI ecosystems by reviewing and analysing the literature, technical documentation, and existing SSI implementations. Therefore, the study is built on existing knowledge, and presents a comprehensive catalogue of thirty-five SSI design patterns that can serve as a starting point for a possible SSI system design.

Self-Sovereign Identity (SSI) is a decentralized, user-centric approach to Identity Management (IdM) that allows users to gain control over their digital identity and data. It brings many advantages and reduces the shortcomings of traditional, centralized IdM systems. Despite its positive features, SSI focuses predominantly on direct interactions between two independent entities. It enables direct identification, authentication, authorization, and access to resources and services where the identity holders are the authenticated bearers of their credentials. On the other hand, it does not primarily address indirect identity control, such as delegation, which is an essential part of life situations and natural human relationships. Delegation is particularly common in organizational contexts and usually arises from the need for greater efficiency, relief, or distribution of work, collaboration, and cooperation and the inability to perform work, tasks, responsibilities, and duties for various reasons. However, it is relatively unexplored within the SSI framework and requires additional research efforts and the development of new approaches. Consequently, our research aimed to reduce the aforementioned gap and comprehensively address delegation in the SSI ecosystem. Thus, we present a novel authority and access delegation model utilizing Verifiable Credentials that enable delegation support for existing use cases, workflows, and processes of organizations and companies, providing resources and services to end users. The model includes delegation building blocks, data objects and data flow, delegation phases and processes, and technology-independent components. It is validated with a case study in the field of education.

Evropska komisija je junija 2021 predlagala novo uredbo eIDAS 2.0, s katero si prizadeva zagotoviti zaupanja vredno, varno in široko uporabno evropsko digitalno identiteto, ki bo vsem Evropejcem omogočila digitalno dokazovanje svoje identitete z namenom dostopanja do digitalnih storitev po vsej Evropski uniji. V okviru uredbe je izdala zahtevo, da morajo države članice EU do leta 2023 svojim državljanom ponuditi kriptografsko varno digitalno denarnico z EU digitalno identiteto, ki naj bi poleg identifikacije, overjanja, avtorizacije in dostopanja do javnih in / ali zasebnih storitev, omogočala tudi varno shranjevanje, upravljanje in deljenje identitetnih podatkov in poverilnic. Kljub prizadevanju za vpeljavo takšne denarnice obstaja še vedno veliko nejasnosti in odprtih vprašanj glede tehničnih podrobnosti. Poleg tega pa se mnogim postavljajo vprašanja o tem, kaj pravzaprav so digitalne denarnice, komu so namenjene, kakšne scenarije uporabe podpirajo ter kako bodo podpirale digitalne procese in z njimi povezano digitalno preobrazbo v trenutnem, širšem ekosistemu IKT rešitev in storitev. V prispevku bomo tako predstavili tehnično ozadje denarnic digitalnih identitet v okviru Evropske digitalne identitete in posodobljene Uredbe eIDAS. Opredelili bomo osnovne koncepte in tipe denarnic, opisali njihove funkcionalne zahteve, predstavili številne scenarije uporabe ter raziskali interakcije denarnic z obstoječimi IKT rešitvami ob upoštevanju standardov in dobrih praks na področju upravljanja identitet.

Delegation of authority remains a critical yet insufficiently addressed capability in Self-Sovereign Identity (SSI) systems. Building on an existing delegation model that introduced the concept of a Verifiable Mandate (VM) for expressing authority and access rights, this paper extends the approach with a rigorous formalization of delegation semantics, enabling unambiguous reasoning over roles, grants, and constraints. The formal model is aligned with standards from the World Wide Web Consortium (W3C), and its constructs are embedded into an extended credential schema that preserves compatibility with the Verifiable Credentials (VC) data model while introducing delegation-specific attributes. A generalized VM schema is defined, supporting both generic and business-specific instantiations, and ensuring structural and semantic interoperability. Policy compliance is operationalized through a policy-based enforcement architecture, where rules are authored in the Rego language and evaluated at runtime by the Open Policy Agent (OPA). The architecture incorporates trusted registries for schema and policy distribution, allowing verifiers to define and enforce context-specific delegation rules in a modular and interoperable manner. Validation through realistic scenarios, such as postal service and academic use cases, demonstrates how formal semantics, schema validation, and language-based policy enforcement can be combined to enable secure, verifiable, and context-aware delegation in SSI ecosystems.