Connections & Trust
UniMe keeps three things for its user: the credentials they hold, the connections to the organizations they have dealt with, and the activities that record what passed between them. Organizations provide evidence of why they are trustworthy, such as a verified website, the credentials they hold themselves and the ecosystems they belong to. UniMe, Impierce's open-source European Identity Wallet, checks that evidence and shows it to the user, so they can judge for themselves whom to connect with.
What are credentials, connections and activities?
A credential is something an organization states about the user, a connection is the organization itself, and an activity is one exchange between the two. The user owns all three. Every credential in UniMe is linked to the connection that issued it, and every activity is linked to the connection it happened with.
| Object | What it is | What it contains |
|---|---|---|
| Credential | A signed statement about the user, such as a diploma, a badge or a membership, in any of UniMe's supported formats | The signed credential, a display name, the issuer's name and logo, the dates it is valid, its status and a link to the connection it came from |
| Connection | An organization the user has interacted with | Name, website, first and last interaction, the evidence UniMe found (whether the website is verified, which public credentials the organization holds and which ecosystems it belongs to) and which credentials were last shared with it |
| Activity | One exchange with a connection: connecting, receiving credentials or sharing credentials | The connection, the kind of exchange, the date and the credentials involved |
The user sees connections and activities in the Activity tab, and credentials in the Me tab. Credentials and keys live in an encrypted Stronghold vault on the device, and connections and activities stay on the device as well. Impierce runs no backend that holds any of it.
How does a connection come about?
A connection starts when the user scans a QR code or opens a link from an organization. The organization is either an issuer that offers credentials over OpenID for Verifiable Credential Issuance (OpenID4VCI), or a verifier that asks for credentials over OpenID for Verifiable Presentations (OpenID4VP).
UniMe then gathers the evidence described below and shows the organization on the accept-connection screen. If the user already knows the organization, the screen says so and shows their shared history. The connection is only stored once the exchange completes, so an organization the user declined leaves no trace in the wallet.
A connection that already exists is updated on every later exchange: UniMe refreshes the organization's name, website and evidence, and records a new activity.
What does UniMe check before the user accepts an organization?
UniMe checks three kinds of evidence and shows the outcome on the accept-connection screen, so the user decides with the facts in view. Every check runs from the device against public information the organization has published. Nothing is reported back to the organization or to Impierce.
| Evidence | What it proves | What the user sees |
|---|---|---|
| Verified website (domain linkage) | The organization that signs the request also controls the website it names | A "Verified Domain", "Unverified Domain" or "Untrusted Domain" label next to the website |
| Public credentials | Which credentials the organization itself holds and publishes, such as an accreditation or a registration | A list of certifications, each with the issuer that signed it and that issuer's verified website |
| Ecosystem membership | Which groups of organizations publicly vouch for it | The ecosystems the organization belongs to, each with its leader and members |
How does UniMe tell organizations apart?
Internally, UniMe identifies every connection by the organization's decentralized identifier (DID): a globally unique identifier the organization controls and that resolves to its public keys. The user never has to deal with it. The accept-connection screen shows the organization's name, logo and website, and the DID does its work in the background: it is what UniMe checks the website against, where it finds the organization's public credentials, and what ties the organization's exchanges together into one connection. Two organizations with the same name and website are still two connections if their DIDs differ.
A verifier's request carries its DID. An issuer's credential offer carries only a URL, so UniMe looks for the issuer's DID document at /.well-known/did.json on that URL. An organization that publishes no DID cannot become a connection. In practice organizations use did:web, the DID method that ties a DID to a domain and lets an organization rotate keys and publish its public credentials. The user's own identity in UniMe is a did:jwk, which needs no web server.
UniMe needs one verifiable identifier for every organization it shows the user, so it can check the website, find the organization's public credentials and recognize the organization next time. A DID gives all of that, where a plain URL or a name gives none of it. So every connection is identified by a DID, and an issuer that publishes none cannot connect. We accept that some issuers cannot connect for now, in exchange for one clear trust model for issuers and verifiers alike.
How does UniMe verify the organization's website?
A website counts as verified when the same party provably controls both the website and the DID that signs the organization's requests. UniMe fetches a signed configuration from the website, checks it against the DID's keys, and shows "Verified Domain", "Unverified Domain" or "Untrusted Domain" next to the website, on the accept-connection screen and again on the share screen. A verified website is one way to earn the user's trust, not a requirement. How the check works and what an organization publishes is covered in Domain linkage.
How does UniMe find the credentials an organization holds?
An organization can hold credentials of its own, such as an accreditation from a ministry or a membership of a trade body, and publish them from its DID document as public credentials. Under the hood this uses the DIF Linked Verifiable Presentations standard. UniMe resolves the organization's DID, follows every published presentation, and checks the presentation's signature against the organization's keys.
UniMe then checks each credential inside. The credential's signature must verify against the issuer's DID document, the issuer must have a verified website of its own, the credential must not be expired, and a credential that carries a status must be valid. A credential that fails any check is left out, because anyone can host a presentation, so only the credentials that hold up are shown as the organization's certifications. To publish public credentials with UniTrust, see Linked Verifiable Presentations.
How does UniMe discover ecosystems?
An ecosystem is a group of organizations that publicly state they trust each other, run by an ecosystem leader. Membership tells the user something too: an organization that a group it recognizes vouches for is easier to trust than one standing alone. UniMe discovers ecosystems through OpenID Federation: starting from the organization's website, it follows the federation's signed statements up to every trust anchor, and shows each trust anchor as one ecosystem with its name, leader and members.
A trust anchor that runs UniTrust publishes an ecosystem profile with a description, a logo and its members. Any other OpenID Federation trust anchor is shown from its standard federation metadata and member list, so UniMe works with ecosystems that Impierce software did not create. How ecosystems fit the Impierce suite is covered in UniMe in the Impierce ecosystem.
What happens when a credential is revoked?
A revoked credential stays in UniMe and shows as "Revoked", so the user knows and the issuer does not learn when or where the credential was used. An issuer that wants to withdraw a credential cannot reach into the wallet. It can only publish a new status, or issue a replacement.
UniMe checks status through the OAuth Token Status List mechanism: the credential names a status list and its position in it, and UniMe fetches the list directly from the device, both when it receives the credential and again whenever the user opens the wallet or a credential's details. A credential that carries no status, or a status mechanism UniMe does not support, is shown by its validity dates alone. An expired credential shows as "Expired".
Revocation changes nothing about the connection itself. The organization stays in the connections list with its activity history, and the user can collect a replacement credential from it. The user can also delete a connection at any time; the activities recorded with it are kept, so the user's log of what was shared stays complete.
FAQ
Does an organization need to register with Impierce before UniMe accepts it?
No. UniMe verifies an organization from what it publishes: its DID, its website, its public credentials and its ecosystem memberships. The user then decides whether to accept it. Impierce keeps no list of approved organizations.
Can an issuer see when a user shares its credential?
No. A credential is signed once and then lives on the user's device. When the user shares it, the verifier checks the issuer's signature and, where the credential carries one, the status list that the issuer publishes. Fetching a status list does not tell the issuer who asked or why.
What does an organization need to publish to get a "Verified Domain" label?
A DID document at /.well-known/did.json and a DID configuration at /.well-known/did-configuration.json on its website, signed with that DID. UniCore and UniTrust publish both for an organization. The details are in Domain linkage.
Does deleting a connection delete the credentials it issued?
No. Deleting a connection removes the organization from the connections list and keeps both the credentials and the activity history. The user deletes credentials one by one from the credential's own page.
Next steps
Read Domain linkage to get your website verified, or Linked Verifiable Presentations to publish your organization's public credentials.