arXiv subjects

Hakan Yildiz

Publications and source records attributed to Hakan Yildiz.

8 recordsLinked to original sources

arXiv2026

interID -- An Ecosystem-agnostic Verifier-as-a-Service with OpenID Connect Bridge

Self-Sovereign Identity (SSI) enables user-controlled, cryptographically verifiable credentials. As EU regulations mandate EUDI Wallet acceptance by 2027, SSI adoption becomes a compliance necessity. However, each SSI Verifier exposes different APIs with distinct request parameters, response formats, and claim structures, requiring custom wrappers and dedicated infrastructure, contrasting with OpenID Connect (OIDC) where standardized protocols enable seamless integration. interID is an ecosystem-agnostic platform unifying credential verification across Hyperledger Aries/Indy, EBSI, and EUDI ecosystems. We extend interID with an OIDC bridge providing Verifier-as-a-Service, enabling SSI verification through standard OIDC flows. Organizations receive ID Tokens with verified credential attributes without implementing Verifier-specific logic or deploying infrastructure. The multi-tenant architecture leverages Keycloak with strict tenant isolation. Key innovations include PKCE support, scope-to-proof-template mappings translating OIDC scopes into ecosystem-specific verification requests, and a security analysis identifying novel attack surfaces at the intersection of OIDC, SSI, and multi-tenant architectures, threats covered by neither RFC 6819 nor existing SSI analyses alone. Our evaluation demonstrates security equivalence to production identity providers through threat modeling identifying 11 attack vectors, including seven beyond RFC 6819's scope. Integration analysis shows organizations can adopt SSI authentication with comparable effort to adding traditional federated providers. By combining familiar OIDC patterns with SaaS deployment, our work lowers integration and operational barriers, enabling regulatory compliance through configuration rather than custom development.

cs.CR↗

arXiv2025

interID -- An Ecosystem-agnostic Verifier Application for Self-sovereign Identity

Self-Sovereign Identity is a transformative paradigm in digital identity management, empowering individuals with full control over their credentials. However, the coexistence of diverse SSI ecosystems, such as the European Digital Identity and the European Blockchain Services Infrastructure, poses significant challenges for cross-ecosystem interoperability due to technological and trust framework differences. This paper introduces \textit{interID}, a modular credential verification application that addresses this fragmentation by orchestrating ecosystem-specific verifier services. Our key contributions include: (1) an ecosystem-agnostic orchestration layer that interfaces with multiple SSI verification services, (2) a unified API that abstracts underlying protocol complexities for service providers, and (3) a practical implementation that bridges three major SSI ecosystems: Hyperledger Indy/Aries, EBSI, and EUDI. Evaluation results demonstrate that interID successfully verifies credentials across all tested wallets with minimal performance overhead, while maintaining a flexible architecture that can be extended to accept credentials from additional SSI ecosystems. This work offers both a technical solution and architectural pattern for achieving interoperability in SSI verifier implementations.

cs.ET↗

arXiv2024

ELMO2EDS: Transforming Educational Credentials into Self-Sovereign Identity Paradigm

Digital credentials in education make it easier for students to apply for a course of study, a new job, or change a higher education institute. Academic networks, such as EMREX, support the exchange of digital credentials between students and education institutes. Students can fetch results from one educational institute and apply for a course of study at another educational institute. Digital signatures of the issuing institution can verify the authenticity of digital credentials. Each institution must provide the integration of EMREX using its identity management system. In this paper, we investigate how digital credentials can be integrated into the Self-Sovereign Identity ecosystem to overcome the known issues of academic networks. We examine known issues such as the authentication of students. Self-Sovereign Identity is a paradigm that gives individuals control of their digital identities. Based on our findings, we propose ELMO2EDS, a solution that 1) converts digital credentials from EMREX to a suitable Self-Sovereign Identy data format, 2) enables authenticating a student, and 3) enables issuing, storing, and verification of achieved study.

cs.CY↗

arXiv2022

A Tutorial on the Interoperability of Self-sovereign Identities

Self-sovereign identity is the latest digital identity paradigm that allows users, organizations, and things to manage identity in a decentralized fashion without any central authority controlling the process of issuing identities and verifying assertions. Following this paradigm, implementations have emerged in recent years, with some having different underlying technologies. These technological differences often create interoperability problems between software that interact with each other from different implementations. Although a common problem, there is no common understanding of self-sovereign identity interoperability. In the context of this tutorial, we create a definition of interoperability of self-sovereign identities to enable a common understanding. Moreover, due to the decentralized nature, interoperability of self-sovereign identities depends on multiple components, such as ones responsible for establishing trust or enabling secure communication between entities without centralized authorities. To understand those components and their dependencies, we also present a reference model that maps the required components and considerations that build up a self-sovereign identity implementation. The reference model helps address the question of how to achieve interoperability between different implementations.

cs.SE↗

arXiv2022

Decentralized Identifiers and Self-sovereign Identity in 6G

A key challenge for mobile network operators in 6G is to bring together and orchestrate a variety of new emerging players of today's mobile ecosystems in order to provide economically viable and seamless mobile connectivity in form of a multi-stakeholder service. With each new player, be it a cloud, edge or hardware provider, the need for interfaces with secure authentication and authorization mechanisms increases, as does the complexity and operational costs of the public key infrastructures required for the identity and key management. While today's centralized public key infrastructures have proven to be technically feasible in confined and trusted spaces, they do not provide the required security for access control once centralized identity providers must be avoided because of limited cross-domain interoperability, national data protection legislation, or geopolitical-strategic reasons. Recent decentralized identity management concepts, such as the W3C recommendation of Decentralized Identifiers, provide a secure, tamper-proof, and cross-domain identity management alternative for future multi-stakeholder 6G networks without relying on centralized identity provider or certification authorities. This article introduces the concept of Decentralized Identifiers together with the principles of Self-sovereign Identity and discusses opportunities and potential benefits of their application and usage for cross-domain and privacy-preserving identity and key management in 6G networks.

cs.NI↗

arXiv2022

Blade: A Blockchain-supported Architecture for Decentralized Services

Decentralized services and applications provide a multitude of advantages for their users, such as improved privacy, control, and independence from third parties. Anyhow, decentralization comes at the cost of certain disadvantages, such as increased application complexity or communication overhead. This aggravates the development and deployment of decentralized services and applications. In this paper we present Blade, a software platform that aims to ease the effort of development, deployment, and administration of decentralized services by implementing reusable solutions for recurring challenges developers are facing when designing decentralized service architectures. This includes functionality for e.g. identity management, access control, request handling, verification of authenticity and integrity, discovery, or routing. Blade implements all this functionality in a Blade server instance, which can be deployed on a lightweight device, such as a NAS, Raspberry Pi, or router at home. This allows users without expert knowledge to run a Blade instance with already existing hardware with little overhead. Blade supports polyglot Blade modules that implement extended functionality, such as interfaces, frontends, and business logic of decentralized applications, e.g. a decentralized instant messaging service or an online social network. Based on the Oracle GraalVM, Blade modules can be implemented in a variety of programming languages and utilize the functionality provided by the Blade server instance. Blade modules are published in a Ethereum-based decentralized marketplace from where they can be installed directly via the Blade instances...

cs.DC↗

arXiv2022

Towards Decentralized Identity Management in Multi-stakeholder 6G Networks

Trust-building mechanisms among network entities of different administrative domains will gain significant importance in 6G because a future mobile network will be operated cooperatively by a variety of different stakeholders rather than by a single mobile network operator. The use of trusted third party issued certificates for initial trust establishment in multi-stakeholder 6G networks is only advisable to a limited extent, as trusted third parties not only represent single point of failures or attacks, but they also cannot guarantee global independence due to national legislation and regulatory or political influence. This article proposes to decentralize identity management in 6G networks to enable secure mutual authentication between network entities of different trust domains without relying on a trusted third party and to empower network entities with the ability to shape and strengthen cross-domain trust relationships by the exchange of verifiable credentials. A reference model for decentralized identity management in 6G is given as an initial guide for the fundamental design of a common identity management system whose operation and governance are distributed equally across multiple trust domains of interconnected and multi-stakeholder 6G ecosystems.

cs.NI↗

arXiv2014

Convex Hulls under Uncertainty

We study the convex-hull problem in a probabilistic setting, motivated by the need to handle data uncertainty inherent in many applications, including sensor databases, location-based services and computer vision. In our framework, the uncertainty of each input site is described by a probability distribution over a finite number of possible locations including a \emph{null} location to account for non-existence of the point. Our results include both exact and approximation algorithms for computing the probability of a query point lying inside the convex hull of the input, time-space tradeoffs for the membership queries, a connection between Tukey depth and membership queries, as well as a new notion of $\some$-hull that may be a useful representation of uncertain hulls.

cs.CG↗