Design and Evaluation of a Self-Sovereign Identity System with a Custodial Wallet

https://doi.org/10.1007/978-3-032-22088-2_8

Transcript

1. 2025 8th International Conference on Blockchain Technology and Applications (ICBTA 2025) Design and Evaluation of a Self-Sovereign Identity System with a Custodial Wallet December 13, 2025 Koshi IKEGAWA and Tatsuya SATO Services Computing Research Dept. Hitachi, Ltd. Research & Development Group ©Hitachi, Ltd. 2025. All rights reserved
2. Koshi IKEGAWA and Tatsuya SATO. “Design and Evaluation of a Self-Sovereign Identity System with a Custodial Wallet”. ICBTA 2025. Background｜Self-Sovereign Identity (SSI) Self-Sovereign Identity (SSI)[1] provides a user-centric identity model in which individuals control their identifiers and disclose only the attributes required for a given interaction. ❚ SSI is a paradigm where individuals control their own digital identifiers and credentials. ❚ Users can disclose only the attributes required for a specific interaction, improving both privacy and usability. ❚ This approach aligns with regulations such as the GDPR[2], which emphasize data minimization and explicit consent. 2 [1] Sovrin Foundation: “Principles of SSI v3” (2022), https://sovrin.org/principles-of-ssi [2] European Parliament, “General Data Protection Regulation (GDPR)” https://eur-lex.europa.eu/eli/reg/2016/679 ©Hitachi, Ltd. 2025. All rights reserved
3. Koshi IKEGAWA and Tatsuya SATO. “Design and Evaluation of a Self-Sovereign Identity System with a Custodial Wallet”. ICBTA 2025. Challenge｜Large-Scale SSI and Custodial Wallets Large-scale SSI deployments require custodial wallets to support users with diverse capabilities, but such centralization introduces performance and scalability challenges. ❚ In principle, SSI recommends non-custodial wallets that store digital identities on user-owned devices. ⬦ ①However, large-scale SSI services must also support elderly users, minors, and users with low IT literacy who may not manage keys locally. ⬦ ②Custodial wallets operated by service providers become necessary; ⬦ ③but they can create performance and scalability bottlenecks. Non-custodial (stored on user-owned devices) Custodial (stored on centralized servers) Issuer ③Bottlenecks ①He can't manage 3 ②Use Custodial Delegate ©Hitachi, Ltd. 2025. All rights reserved
4. Koshi IKEGAWA and Tatsuya SATO. “Design and Evaluation of a Self-Sovereign Identity System with a Custodial Wallet”. ICBTA 2025. Contributions This work proposes a selectable wallet architecture, a performance evaluation method for custodial wallets, and a performance model that estimates required agent capacity. ① Selectable Wallet Architecture ❚ This work proposes a wallet-selectable SSI architecture that combines custodial and non-custodial wallets in one system. ② Performance Evaluation Method ❚ It presents a performance evaluation method for custodial wallets using ACA-Py SSI Agents and Indy Blockchain, focusing on VC issuance and VP verification. ③ Performance Model ❚ Based on the results, it builds regression-based performance models that estimate the number of agent instances required to meet throughput requirements. 4 ©Hitachi, Ltd. 2025. All rights reserved
5. Koshi IKEGAWA and Tatsuya SATO. “Design and Evaluation of a Self-Sovereign Identity System with a Custodial Wallet”. ICBTA 2025. OSS Implementation of SSI System The Linux Foundation (LF) provides various open-source software (OSS) to realize SSI. ❚ LF Decentralized Trust (LFDT) provides “Hyperledger Indy”, a public-permissioned blockchain for VDR. ❚ The OpenWallet Foundation (under the LF) provides interoperable agent frameworks such as ACA-Py. ❚ “Hyperledger AnonCreds” defines and implements Verifiable Credentials (VC) and Verifiable Presentations (VP) with selective disclosure and revocation capabilities. Issuer → ACA-Py Issue VC Holder → ACA-Py Present VP Verifiable Credential Verifiable Presentation → AnonCreds → AnonCreds Verifier → ACA-Py Wallet Write 5 DID Documents VDR (Verifiable Data Registry) →Hyperledger Indy (Blockchain) Read ©Hitachi, Ltd. 2025. All rights reserved
6. Koshi IKEGAWA and Tatsuya SATO. “Design and Evaluation of a Self-Sovereign Identity System with a Custodial Wallet”. ICBTA 2025. Related Work｜Performance Evaluation Studies of ACA-Py SSI Agent Several studies have evaluated the performance characteristics of ACA-Py SSI Agent. ❚ Pflanzner et al. [3] ⬦ analyzed ACA-Py latency in both cloud and on-premise environments and showed that local deployments can reduce write latency by up to 85% and read latency by up to 50%. ❚ Siqueira et al. [4] ⬦ evaluated multi-user Holder performance using ACA-Py and found that CPU usage becomes the primary bottleneck as concurrency increases. No research exists that verifies the scalability of custodial wallet architectures that multiplex multiple ACA-Py SSI Agents. ❚ ⇨ This is our motivation for researching performance modeling for large-scale SSI services. 6 [3] Pflanzner et al. “Latency analysis of blockchain-based SSI applications”. Future Internet 14(10) (2022). https://doi.org/10.3390/fi14100282 [4] Siqueira et al. “Performance evaluation of self-sovereign identity use cases”. IEEE International Conference on DAPPS (2023). https://doi.org/10.1109/DAPPS57946.2023.00026 ©Hitachi, Ltd. 2025. All rights reserved
7. Koshi IKEGAWA and Tatsuya SATO. “Design and Evaluation of a Self-Sovereign Identity System with a Custodial Wallet”. ICBTA 2025. System Design｜Selectable Wallet Architecture The proposed system uses an OSS-based SSI infrastructure and allows each user to choose a custodial or non-custodial wallet. ❚ In the custodial configuration, ACA-Py agents store user DIDs and credentials in a PostgreSQL database operated by the service provider. ❚ In the non-custodial configuration, a “Bifold-Wallet” based on Credo-ts keeps keys and credentials locally on the user’s smartphone. Select Custodial Wallet Select Non-Custodial Wallet Users can choose either wallet 7 ©Hitachi, Ltd. 2025. All rights reserved
8. Koshi IKEGAWA and Tatsuya SATO. “Design and Evaluation of a Self-Sovereign Identity System with a Custodial Wallet”. ICBTA 2025. Evaluation Environment ❚ The SSI system is deployed across multiple virtual machines (VMs), each assigned a specific role. ⬦ VMs Spec: 12 vCPUs, 16 GB RAM, 40GB HDD, Ubuntu 24.04LTS ❚ Issuer/Verifier agents, Holder agents, the Indy ledger, and the custodial wallet database run on separate VMs. ❚ All Holder agents share a single database, emulating a server-side custodial wallet for large-scale SSI services. 8 ©Hitachi, Ltd. 2025. All rights reserved
9. Koshi IKEGAWA and Tatsuya SATO. “Design and Evaluation of a Self-Sovereign Identity System with a Custodial Wallet”. ICBTA 2025. Experimental Design ❚ Before measurement, DIDs, schemas, and credential definitions are registered, and Holder tenants and connections are prepared. ❚ We evaluate two processes: VC issuance (Fig. Left) and VP verification (Fig. Right), each executed in parallel. ⬦ For each test case, 2,400 logs are collected. ⬦ To compute stable throughput, the first and last 200 logs are excluded. VC issuance 9 VP Verification ©Hitachi, Ltd. 2025. All rights reserved
10. Koshi IKEGAWA and Tatsuya SATO. “Design and Evaluation of a Self-Sovereign Identity System with a Custodial Wallet”. ICBTA 2025. Result The evaluation demonstrates that agent multiplexing significantly improves throughput and that the scaling behavior can be approximated with regression-based performance models. ❚ VC issuance improves 2.47× (up to 32.4 TPS) when Holders increase from 1→4 under four Issuers. ❚ VP verification improves 5.24× (up to 63.4 TPS) under four Verifiers. ❚ Within the evaluated range, throughput increases almost linearly as agents are multiplexed. ⬦ This behavior is well fitted by a linear regression model in the small-scale VM configuration. ⬦ However, the marginal TPS gain decreases as more agents are added, suggesting that a quadratic regression model is more suitable for larger-scale deployments. 𝒚 = 𝟒. 𝟖𝟖𝟑𝒙 + 𝟖. 𝟑𝟕𝟕 y = −0.220x2 + 5.980x + 7.279 𝒚 = 𝟕. 𝟓𝟏𝟓𝒙 + 𝟐. 𝟖𝟕𝟎 y = −0.631x2 + 10.669x − 0.284 Improvement becomes smaller little by little 10 VC issuance VP Verification ©Hitachi, Ltd. 2025. All rights reserved
11. Koshi IKEGAWA and Tatsuya SATO. “Design and Evaluation of a Self-Sovereign Identity System with a Custodial Wallet”. ICBTA 2025. Conclusions and Future works This study presented an SSI architecture that introduces a custodial wallet and allows users to select either custodial or non-custodial wallets within a unified system. By multiplexing Issuer, Verifier, and Holder agents on an ACA-Py and Hyperledger Indy infrastructure, the proposed design achieved significant throughput improvements for verifiable credential issuance and verifiable presentation verification. Regression-based performance models derived from experimental results support capacity planning for large-scale SSI services with custodial wallets and motivate future studies on larger agent pools and dynamic scaling. 11 ©Hitachi, Ltd. 2025. All rights reserved
12. Koshi IKEGAWA and Tatsuya SATO. “Design and Evaluation of a Self-Sovereign Identity System with a Custodial Wallet”. ICBTA 2025. Design and Evaluation of a Self-Sovereign Identity System with a Custodial Wallet Koshi IKEGAWA and Tatsuya SATO (Services Computing Research Dept. Hitachi, Ltd. Research & Development Group.) ❚ Background: SSI enable user-controlled, privacy-preserving digital identity management. ❚ Problem: Large-scale SSI deployments require custodial wallets, which can become performance and scalability bottlenecks. ❚ Contribution: This work proposes ①a selectable wallet architecture, ②a performance evaluation method for custodial wallets, and ③a performance model that estimates required agent capacity. ⬦ ①System Design: An Aries/Indy-based infrastructure lets each user choose between custodial ACA-Py wallets and non-custodial Bifold mobile wallets. ⬦ ②Evaluation: We implement the system on multiple VMs and measure VC issuance and VP verification under different degrees of agent multiplexing. ⬦ ③Result: Agent multiplexing significantly improves throughput and is captured by regression models that support capacity planning for large-scale SSI services. VC issuance 12 VP Verification ©Hitachi, Ltd. 2025. All rights reserved