| CPC H04L 63/10 (2013.01) [H04L 9/3218 (2013.01)] | 20 Claims |

|
1. A computer-implemented method comprising:
sending, to a distributed ledger system, policy data indicating an association between a first credential and a first permission for accessing a computer resource, wherein a first client device receives first credential data representing the first credential;
receiving, by an access gateway system from the first client device, a first request for access to the computer resource;
receiving, from the first client device, first data representing a zero-knowledge proof of possession of the first credential;
verifying, using the first data, that the first client device corresponds to the first credential;
in response to verifying that the first client device possesses the first credential, retrieving, from the distributed ledger system, the policy data corresponding to the first credential;
determining that the policy data grants a possessor of the first credential access to the computer resource; and
in response to determining that the policy data grants the possessor of the first credential access to the computer resource, allowing the first client device access to the computer resource.
|