IBM Decentralized Identity

Digital identity infrastructure struggles with verifiability, interoperability, and speed, especially as data breaches increase and data protection expectations rise. Today, every institution runs its own identity process, pushing individuals to stitch accounts together in ways that create “honeypots” of sensitive identity data. This exposes institutions to risk from poor user access management and incentivizes them to enable secure interoperability. A core difficulty is that physical identity documents were designed for real-world verification, while digital equivalents lack standardized, trustworthy verification features, leading to insecure workarounds like emailing scans of passports or excluding documents from digital workflows altogether.

Decentralized digital identity proposes an identity trust fabric, with blockchain positioned as a suitable foundation. Using decentralized public key infrastructure, users hold credentials in an identity wallet and share cryptographic proofs (hashes) with institutions, enabling authenticity checks without revealing sensitive data. Private keys and personally identifiable information (PII) remain off-chain, and blockchain consensus protects the integrity of hashed data; however, the system’s reliability depends on correct, validated identity registration at the input stage.

Regulatory and operational constraints include GDPR obligations (including the right to be forgotten), evolving international standards, blockchain scalability tradeoffs, the need to validate the trustworthiness of original inputs (often via issuer digital signatures), and exposure to 51% attacks.

IBM’s decentralized identity offering—built on Hyperledger Indy and Hyperledger Aries with the Linux Foundation—targets enterprise and ecosystem needs through interoperable, blockchain-agnostic design and participation in standards bodies. IBM Verify Credentials provides agencies, wallets, browser extensions, SDKs, and samples to issue and verify credentials. Strengths include enterprise-focused compliance and privacy-by-design (selective disclosure and zero-knowledge proofs), while challenges include KYC edge cases (e.g., blacklisted individuals), issuer responsibility for input accuracy, scalability testing, and resiliency risks from edge-device dependence.

• Each institution typically maintains its own identity process for user accounts.
• Emailing a scanned passport is cited as an example of insecure, unverifiable digital document sharing.
• In the described model, users store digital identity credentials in an identity wallet.
• Users can send a public key as a hash to a bank to provide cryptographic proof of authenticity without revealing sensitive data.
• Private keys and PII data remain off-chain in the described decentralized identity approach.
• GDPR compliance includes obligations to protect PII data and a citizen’s right to be forgotten.
• Blockchain best practice in this context stores only a hash of PII data on-chain.
• IBM’s decentralized identity solution is built using Hyperledger Indy and Hyperledger Aries protocols in cooperation with the Linux Foundation.
• IBM Verify Credentials includes a cloud service agency, mobile and browser extension support, and Node.js SDKs.
• IBM is active in over 170 countries.

• “Building the infrastructure for digital identity presents challenges of verifiability, interoperability, and speed.”
• “Consumers are searching for ways to retain full control over their identity data.”
• “The authenticity of identity instruments must be verified with the correct information and source.”
• “An identity trust fabric (ITF) is required for any decentralized digital identity solution.”
• “Decentralized identity allows users to control the privacy of their identity, including minimal, selective, or progressive disclosure of their identity data to any party.”
• “In order for this process to be reliable, the initial registering of an identity in such a decentralized identity system must be correct, valid, and without errors.”
• “Interoperability is a strength of the IBM decentralized identity solution, derived from its efforts to make the solution blockchain agnostic.”
• “Proper implementation of IBM’s decentralized identity solution restricts all PII data from being stored on the blockchain.”
• “Blacklisted individuals will not state their restrictions.”
• “Resiliency from such a system failure or identity loss has yet to be fully tested.”