# Towards a Catalogue of Self-Sovereign Identity Design Patterns
## 3 Self-Sovereign Identity Design Patterns and Their Classification
### Patterns and Their Classification
The former are classical power of attorney rights, while the latter are use cases where parents or custodians are acting in the name of their children, and entities such as IoT devices are acting in the name of their owners/controllers. (3.4) _VAcc_ should be used for proving needed accreditations that ensure compliance with the standards and requirements, and (3.5). An example of such is formal accreditation for higher education institutions received from Ministries, which gives them the right to issue formal diplomas. Lastly, (3.5) _VAuth_ should be used as authorisation proof for accessing permissioned ledgers. These VC data formats play the role of an access token for accessing services, or, in this case, a permissioned ledger. An example of such is seen in the EBSI onboarding processes. The remaining patterns within this category are solving problems related to flexibility, privacy, and data minimisation. (3.6) _Selective Content Generation_ and (3.7) _Selective Content Disclosure_ support the creation of customised credentials and presentations, allowing data minimisation by generating (3.6) VCs according to the holders' specific requirements, or (3.7) VPs according to the verifiers' requirements. Both enable the holder to disclose the minimum amount of data necessary for a particular interaction by utilising mechanisms such as atomic credentials, selective disclosure signatures, hashed values and zero-knowledge proof (ZKP) [14]. By utilising selective content disclosure, identity holders can create VPs consisting of only a subset of attributes from one or more credentials that are required for a \begin{table}
\begin{tabular}{l l} \hline \hline
**Design Pattern** & **Summary** \\ \hline Onboarding or & Provision of an entity onboarding service to register identifiers in the DID \\ DID Registration & registry (required when using private and consortium blockchains) [34]. \\ \hline Linking & The onboarding or registration of DIDs should be linked to verifiable credential issuance. Onboarding requires identity verification, which must be substantiated [35]. \\ \hline \hline \end{tabular}
\end{table} 
Table 2: SSI design patterns, classified into the Onboarding category. particular interaction. Moreover, they can provide attributes without actually revealing their value. For example, if an identity holder wants to prove his/her age, he/she can use selective disclosure to share only the year of birth from the driver's licence, while not revealing the rest of the attributes, such as day and month of birth, address, etc. Additionally, by using ZKP, he/she can prove that, for example, he/she is over 18 years old without revealing the actual date of birth. This is especially useful in situations where identity holders do not trust the verifiers. (3.8) _Time-Constrained Access_ and (3.9) _One-Off Access_ patterns provide privacy and flexibility, and allow identity holders to restrict access to shared credentials to (3.8) specific time frames, or (3.9) limit it to one-time access only. This is important, as the holder's identity data should not be accessed or verified without a legitimate reason after completing the initial identification process [14]. (3.10) _Expiration Time_ enhances trust, increases data accuracy, and reduces misuse and/or abuse of credentials. It enables issuers to restrict the effectivity of credentials, as identity is a dynamic concept, meaning the holder's identity attributes and conditions may change. Therefore, credentials should not be long-term or effective permanently. On the other hand, (3.11) _Effective Time_ allows differentiation between the time of the issuance and the time when the credential becomes valid.