Privacy-Preserving Data Storage and Use
A key pillar of Humanity Protocol’s self-sovereign identity (SSI) framework is the decentralized storage of user VCs combined with the use of zero-knowledge cryptography that keeps these potentially personally identifiable information (PII) private, giving users full control of whether/how their data are accessed by other third-party applications.
Protection 1: Data Encryption & Private Key Management
An issued user VC is bound to the user’s wallet with the underlying metadata encrypted using AES-GCM quantum-resistant symmetric private key. The user maintains sole control of their private key, which is stored across decentralized nodes on a key-share network (e.g. Lit Protocol), allowing for a more robust key recovery process analogous to the account abstraction (ERC-4337) wallets on the Ethereum Mainnet.
Protection 2: Data Atomization & Decentralized Storage
All encrypted user VC non-PII metadata are atomized and stored on a decentralized storage-focused blockchain (e.g. IPFS), preventing any single entity from having a full set of the metadata. The index of all non-PII VCs is saved (as encrypted Merkle Tree) in Humanity Protocol on-chain smart contracts.
To further protect PII user metadata, the associated VCs are saved on the trusted off-chain HP Core Platform (with sharding) and accessible in the form of zero-knowledge proofs via HP's data and identity oracles (serving as the zero-knowledge prover).
Protection 3: Privacy-Preserving Data Use
Decrypted user data is accessed only through user authorization, ensuring a fully privacy-preserving environment. Two methods of 'use-access' are implemented:
Direct sharing of non-PII VC (e.g. status of being a unique human being)
Indirect sharing of PII VCs in the form of zero-knowledge verifiable presentations (VPs): Applications can query HP's data and identity oracles for additional information, generating zero-knowledge proofs to ensure accuracy and validity. The query-return never contains unencrypted PII, maintaining user privacy.