SecuVault: A Secure and Private Self-Sovereign Identity Wallet for Windows Platform

Self-Sovereign Identity (SSI) represents a novel digital identity model on the Internet that establishes a unified identity layer. However, as a key component of the SSI system, we cannot simply transplant the design of other digital wallets to the design of self-sovereign digital wallets. On the one hand, the design of existing digital wallets struggles to protect the execution flow of the Windows-side wallet. On the other hand, self-sovereign digital wallets must consider privacy when presenting credentials. To address these challenges, we propose an SSI wallet, SecuVault, that takes both security and privacy into consideration. Our solution safeguards the wallet's execution flow and enforces access control based on Virtualization-Based Security (VBS) enclave and Trusted Platform Module (TPM), effectively preventing adversaries from stealing sensitive information. In addition, we employ Pointcheval-Sanders (PS) signature to enable selective disclosure of credential attributes, allowing users to protect other private attributes when presenting a credential. Finally, we develop a prototype of SecuVault and perform a comprehensive performance evaluation and security analysis.