Protocol Architecture

The Protocol Architecture forms the foundation of IOST 3.0's Decentralized Identity (DID) system. This document outlines the fundamental specifications, data structures, and mechanisms that enable secure, interoperable digital identities.

DID Identifier Format

IOST 3.0 implements the W3C DID standard with a specific method identifier:

did:iost:<specific-idstring>

Where:

did: The scheme identifier
iost: The method identifier specific to IOST blockchain
specific-idstring: A unique identifier string conforming to method-specific format

Identifier Generation

IOST DIDs can be generated through multiple mechanisms:

Deterministic Key Derivation: Generated from cryptographic keys
Account-Based: Derived from existing IOST accounts
UUID-Based: For systems requiring traditional identifiers
Biometric-Based: Unique identifiers derived from biometric templates (hardware integration)

Subnets and Namespaces

IOST 3.0 supports hierarchical identifiers for organizational and specialized use cases:

did:iost:org:<organization-id>:<entity-id>

did:iost:subnet:<subnet-id>:<entity-id>

This enables isolated identity domains while maintaining global resolution capabilities.

DID Document Structure

Each IOST DID is associated with a DID Document containing the following core components:

Core Components

Context (@context): Defines the schema and vocabulary for the document
Identifier (id): The DID that the document describes
Controller (controller): DIDs with authority to make changes to the document
Verification Methods (verificationMethod): Cryptographic keys and other verification materials
Authentication (authentication): Methods that can be used to authenticate the DID subject
Service Endpoints (service): Services associated with the DID subject
Biometric Binding (biometricBinding): IOST-specific extension linking DIDs to biometric verification
Timestamps and Proofs: Metadata about document creation, updates, and cryptographic proofs

IOST-Specific Extensions

IOST 3.0 extends the standard DID Document with additional features:

Layer 2 References: Links to Layer 2 identity data
Trust Level Assertions: Standardized trust level claims
Recovery Configuration: Advanced recovery mechanisms
Privacy Settings: Granular privacy controls

DID Resolution

IOST 3.0 implements a multi-layered DID resolution system:

Resolution Methods

On-Chain Resolution: Direct blockchain-based resolution for maximum security
Layer 2 Resolution: Optimized resolution through Layer 2 for high efficiency
Distributed Cache Network: Edge-cached resolution for high performance
Local Resolution: Offline resolution capabilities for certain use cases

Resolution Parameters

Standard parameters for customizing resolution behavior:

Parameter	Description	Values
`resolveType`	Resolution method to use	`on-chain`, `layer2`, `cache`, `local`
`versionTime`	Resolve document as of a specific time	ISO timestamp
`versionId`	Resolve specific version by ID	String
`trustLevel`	Minimum required trust level	Integer (0-3)
`includeDeactivated`	Include deactivated DIDs	Boolean

DID Operations

IOST 3.0 supports the full lifecycle of DID operations:

Create: Generating a new DID and associated document

Registration on the IOST blockchain

javascript

// Example DID creation
const iostDID = require('@iost/did-sdk');

async function createNewDID() {
  // Generate keys
  const keyPair = await iostDID.generateKeyPair();
  
  // Create DID with default document
  const did = await iostDID.create({
    publicKey: keyPair.publicKey,
    controller: [],  // Self-controlled by default
    serviceEndpoints: []
  });
  
  return {
    did: did.id,
    document: did.document,
    privateKey: keyPair.privateKey
  };
}

Read: Resolving DIDs to retrieve their associated DID Document

javascript

// Example DID resolution
const iostDID = require('@iost/did-sdk');

async function resolveDID(didString, options = {}) {
  const resolution = await iostDID.resolve(didString, {
    resolveType: options.resolveType || 'layer2',
    versionTime: options.versionTime,
    trustLevel: options.trustLevel || 0
  });
  
  return resolution.didDocument;
}

Update: Modifying an existing DID Document

javascript

// Example DID update
const iostDID = require('@iost/did-sdk');

async function updateDIDService(didString, privateKey, serviceEndpoint) {
  // Resolve current document
  const currentDoc = await iostDID.resolve(didString);
  
  // Create update payload
  const update = {
    id: didString,
    service: [
      ...currentDoc.didDocument.service,
      {
        id: `${didString}#new-service`,
        type: "IOSTService",
        serviceEndpoint: serviceEndpoint
      }
    ]
  };
  
  // Sign and submit update
  const updated = await iostDID.update(update, privateKey);
  return updated.didDocument;
}

Deactivate: Permanently deactivating a DID

javascript

// Example DID deactivation
const iostDID = require('@iost/did-sdk');

async function deactivateDID(didString, privateKey) {
  const result = await iostDID.deactivate(didString, privateKey);
  return result.success;
}

DID Methods Registry

IOST 3.0 provides a registry system for specialized DID methods:

Method	Format	Description	Status
`did:iost`	`did:iost:<idstring>`	Core IOST DID method	Active
`did:iost:bio`	`did:iost:bio:<idstring>`	Biometric-anchored DIDs	Active
`did:iost:org`	`did:iost:org:<org-id>:<entity-id>`	Organizational DIDs	Active
`did:iost:subnet`	`did:iost:subnet:<subnet-id>:<idstring>`	Subnet-specific DIDs	Active
`did:iost:temp`	`did:iost:temp:<idstring>`	Temporary/short-lived DIDs	Active
`did:iost:cross`	`did:iost:cross:<chain-id>:<foreign-did>`	Cross-chain linked DIDs	Proposed

Storage Architecture

IOST 3.0 implements a hybrid storage model balancing security, privacy, and efficiency:

On-Chain Storage

Minimalist data stored directly on blockchain:

DID Registry: Maps DID identifiers to storage locations and metadata
Public Keys: Essential verification keys
State Transitions: Hash-based record of document updates
Revocation Registry: Credential revocation information

Layer 2 Storage

Extended DID document components stored in Layer 2:

Complete DID Documents: Full document storage
Service Endpoints: Dynamic service declarations
Verification Relationships: Authentication and authorization methods
Metadata: Additional non-critical information

Off-Chain Storage

Private and large-volume data stored securely off-chain:

Encrypted Credentials: Private credential data
Personal Data: User attributes and sensitive information
Document History: Historical document versions
Biometric Templates: Encrypted biometric verification templates

Security Considerations

The IOST DID Method implements several security measures:

Multi-level Key Management: Supporting hierarchical deterministic (HD) key generation and management
Revocation Mechanisms: Clear processes for revoking compromised keys
Replay Attack Prevention: Timestamp and nonce-based protection
Smart Contract Auditing: Rigorous security auditing of DID registry contracts

Privacy Features

Privacy-enhancing features of the IOST DID Method include:

Selective Disclosure: Support for zero-knowledge proofs and selective attribute disclosure
Minimal On-chain Footprint: Limited personal data stored on-chain
Identifier Pairwise Usage: Different DIDs for different contexts
Privacy-preserving Authentication: Biometric verification without exposing templates

Performance Characteristics

The IOST DID Method is optimized for:

Resolution Speed: Sub-second resolution times for cached DIDs
Scalability: Support for billions of DIDs through Layer 2 optimizations
Gas Efficiency: Minimized on-chain operations for cost reduction
Batched Operations: Support for bulk DID operations

Interoperability

The IOST DID Method ensures interoperability through:

Cross-chain Resolution: Support for resolving DIDs across multiple blockchains
Standard Verification Credentials: Compatibility with W3C VC standards
Universal Resolver Integration: Compatibility with the Universal Resolver
DID Method Negotiation: Protocol for interacting with other DID methods

Protocol Compliance

IOST 3.0's DID Protocol adheres to key standards while introducing innovative extensions:

W3C Compliance

Full compliance with:

ERC-3643 Out-of-the-box Support

IOST 3.0's DID protocol provides native compatibility with the ERC-3643 standard for tokenized assets, offering:

Identity Verification Interface: Standardized verification of identity claims for compliant token transfers
Claim Registry Integration: Direct mapping to ERC-3643 claim structures
Cross-Chain Token Compliance: Identity verification across multiple blockchain networks
Permissioned Token Operations: Identity-based access control for tokenized securities
Regulatory-Compliant Interfaces: Ready-to-use components for jurisdictional compliance

The integration enables securities issuers to leverage IOST's identity infrastructure for compliant token operations without additional development work.

Unique Protocol Extensions

IOST-specific enhancements:

Layer 2 Integration: Optimistic rollups for scalable identity operations
Biometric Protocol Extensions: Hardware-integrated continuous authentication
Advanced Trust Levels: Standardized trust framework expressions
Cross-Chain Resolution: Universal resolver for multi-chain compatibility

Technical Specifications Summary

Feature	Specification
Identifier Format	`did:iost:<specific-idstring>` conforming to W3C DID syntax
Public Key Types	Ed25519, secp256k1, RSA (2048+), BLS12-381
Signature Schemes	EdDSA, ECDSA, RSA-PSS, BLS
Document Format	JSON-LD with IOST extensions
Anchoring Mechanism	Dual-layer: blockchain header + Layer 2 batch proofs
Resolution Time	<500ms (cached), <3s (on-chain)
Update Latency	<2s (Layer 2), <30s (confirmed on-chain)
Recovery Methods	Social recovery, multi-sig, biometric, secret sharing
Privacy Features	Selective disclosure, ZKPs, encrypted storage
Cross-Chain Support	Universal resolver, BNB Chain integration, Ethereum compatibility

Summary

Core Components

Innovation & Applications

Roadmap

Smart Contract Guide

Protocol Architecture

DID Identifier Format

Identifier Generation

Subnets and Namespaces

DID Document Structure

Core Components

IOST-Specific Extensions

DID Resolution

Resolution Methods

Resolution Parameters

DID Operations

DID Methods Registry

Storage Architecture

On-Chain Storage

Layer 2 Storage

Off-Chain Storage

Security Considerations

Privacy Features

Performance Characteristics

Interoperability

Protocol Compliance

W3C Compliance

ERC-3643 Out-of-the-box Support

Unique Protocol Extensions

Technical Specifications Summary

Smart Contract Guide

Protocol Architecture ​

DID Identifier Format ​

Identifier Generation ​

Subnets and Namespaces ​

DID Document Structure ​

Core Components ​

IOST-Specific Extensions ​

DID Resolution ​

Resolution Methods ​

Resolution Parameters ​

DID Operations ​

DID Methods Registry ​

Storage Architecture ​

On-Chain Storage ​

Layer 2 Storage ​

Off-Chain Storage ​

Security Considerations ​

Privacy Features ​

Performance Characteristics ​

Interoperability ​

Protocol Compliance ​

W3C Compliance ​

ERC-3643 Out-of-the-box Support ​

Unique Protocol Extensions ​

Technical Specifications Summary ​

Protocol Architecture

DID Identifier Format

Identifier Generation

Subnets and Namespaces

DID Document Structure

Core Components

IOST-Specific Extensions

DID Resolution

Resolution Methods

Resolution Parameters

DID Operations

DID Methods Registry

Storage Architecture

On-Chain Storage

Layer 2 Storage

Off-Chain Storage

Security Considerations

Privacy Features

Performance Characteristics

Interoperability

Protocol Compliance

W3C Compliance

ERC-3643 Out-of-the-box Support

Unique Protocol Extensions

Technical Specifications Summary