interID -- 一种无生态系统偏见的验证者即服务系统，结合OpenID Connect桥接
interID -- An Ecosystem-agnostic Verifier-as-a-Service with OpenID Connect Bridge
AI总结：
interID通过OIDC桥接实现无生态系统偏见的验证者即服务，简化SSI验证流程，降低合规门槛。
摘要：
自我主权身份（SSI）使用户能够控制并使用加密可验证的凭证。随着欧盟法规要求到2027年接受EUDI钱包，SSI的采用已成为合规性必需。然而，每个SSI验证器都暴露了不同的API，具有不同的请求参数、响应格式和声明结构，需要定制的封装器和专门的基础设施，这与OpenID Connect（OIDC）形成对比，后者标准化的协议使无缝集成成为可能。interID是一种无生态系统偏见的平台，统一了Hyperledger Aries/Indy、EBSI和EUDI生态系统的凭证验证。我们扩展interID，增加一个OIDC桥接器，提供验证者即服务功能，使通过标准OIDC流程实现SSI验证成为可能。组织可以接收包含已验证凭证属性的ID令牌，而无需实现特定验证器的逻辑或部署基础设施。多租户架构利用Keycloak，具有严格的租户隔离。关键创新包括PKCE支持，将OIDC范围映射到证明模板，将OIDC范围转换为生态系统特定的验证请求，以及安全分析，识别OIDC、SSI和多租户架构交集处的新攻击面，这些威胁既不被RFC 6819也不被现有SSI分析所涵盖。我们的评估通过威胁建模识别出11种攻击向量，包括7种超出了RFC 6819的范围。集成分析表明，组织可以以与添加传统联邦提供者相当的精力采用SSI认证。通过结合熟悉的OIDC模式与SaaS部署，我们的工作降低了集成和运营障碍，使通过配置而非定制开发实现合规成为可能。
英文摘要：
Self-Sovereign Identity (SSI) enables user-controlled, cryptographically verifiable credentials. As EU regulations mandate EUDI Wallet acceptance by 2027, SSI adoption becomes a compliance necessity. However, each SSI Verifier exposes different APIs with distinct request parameters, response formats, and claim structures, requiring custom wrappers and dedicated infrastructure, contrasting with OpenID Connect (OIDC) where standardized protocols enable seamless integration. interID is an ecosystem-agnostic platform unifying credential verification across Hyperledger Aries/Indy, EBSI, and EUDI ecosystems. We extend interID with an OIDC bridge providing Verifier-as-a-Service, enabling SSI verification through standard OIDC flows. Organizations receive ID Tokens with verified credential attributes without implementing Verifier-specific logic or deploying infrastructure. The multi-tenant architecture leverages Keycloak with strict tenant isolation. Key innovations include PKCE support, scope-to-proof-template mappings translating OIDC scopes into ecosystem-specific verification requests, and a security analysis identifying novel attack surfaces at the intersection of OIDC, SSI, and multi-tenant architectures, threats covered by neither RFC 6819 nor existing SSI analyses alone. Our evaluation demonstrates security equivalence to production identity providers through threat modeling identifying 11 attack vectors, including seven beyond RFC 6819's scope. Integration analysis shows organizations can adopt SSI authentication with comparable effort to adding traditional federated providers. By combining familiar OIDC patterns with SaaS deployment, our work lowers integration and operational barriers, enabling regulatory compliance through configuration rather than custom development.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
