CRII: SaTC: A Framework for Usable Self-Sovereign Digital Identities

The new concept of Self-Sovereign Digital Identities (SSDIs) enables individuals to maintain control over their own data and digital accounts. This approach aims to be safer and more private than traditional systems, such as Centralized Digital Identities or Federated Digital Identities. However, there is a need for more secure and interoperable communication protocols between SSDI systems. Additionally, these systems require enhancements to their user-friendliness, as many people are hesitant to adopt them due to their complexity and lack of full development. The project's novelties are: 1) Conduct the first comprehensive examination of SSDI usability; 2) Create a complete inventory of communication protocols that can function across various SSDI applications. The project's broader significance and importance are: 1) The SSDI paradigm has the potential to significantly improve data privacy and mitigate the impact of data breaches, offering extensive benefits to both the global economy and individual citizens; 2) The research outcomes, including comprehensive usability datasets, will be fully public and open-source, serving as valuable resources for cross-disciplinary projects that investigate human factors in cybersecurity; 3) The project makes a substantial contribution to the fields of digital privacy rights and digital equity. The planned research aims to advance the SSDI field through a multi-phased approach focusing on usability and on the development of practical communication protocols. A two-stage study involving human subjects is poised to identify usability issues within the SSDI lifecycle, guiding the creation of a detailed inventory of SSDI communication protocols. These protocols cover account management, authentication, authorization, certification, revocation, data provenance, non-repudiation, transactions, multi-party signatures, voting, delegation, one-time access tokens, public key infrastructure (PKI), data oracles, and zero-knowledge data storage and retrieval. The developed protocols will form the basis of the framework that will feature an application programming interface (API) and tools for effective SSDI management. Moreover, the research will improve the cryptographic procedures and applications for generating, storing, and managing users' private keys. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.