DID文档

有关可选扩展和其他验证方法类型，请参见 验证方法类型 [[?DID-EXTENSIONS]]。

这些示例仅供参考，最佳实践是避免将同一[=verification method=]用于多个目的。

  {
    "@context": "https://www.w3.org/ns/did/v1.1",
    "id": "did:example:123",
    "authentication": [
      {
        "id": "did:example:123#z6MkmM42vxfqZQsv4ehtTjFFxQ4sQKS2w6WR7emozFAn5cxu",
        "type": "Multikey", // external (property value)
        "controller": "did:example:123",
        "publicKeyMultibase": "z6MkmM42vxfqZQsv4ehtTjFFxQ4sQKS2w6WR7emozFAn5cxu"
      }
    ],
    "capabilityInvocation": [
      {
        "id": "did:example:123#z6Mkvtac9bidSz9bBttzn7Yg3oCDHvMY2FtkFLs6SXRQGdQR",
        "type": "Multikey", // external (property value)
        "controller": "did:example:123",
        "publicKeyMultibase": "z6Mkvtac9bidSz9bBttzn7Yg3oCDHvMY2FtkFLs6SXRQGdQR"
      }
    ],
    "capabilityDelegation": [
      {
        "id": "did:example:123#z6MknxsdF4CGVxhRNsx6TvXPFczaHEkajKBBwu75uwBmgpom",
        "type": "Multikey", // external (property value)
        "controller": "did:example:123",
        "publicKeyMultibase": "z6MknxsdF4CGVxhRNsx6TvXPFczaHEkajKBBwu75uwBmgpom"
      }
    ],
    "assertionMethod": [
      {
        "id": "did:example:123#z6MkgYhVuWq4hyc7ZKBGhsY7pb5Bc8V6VPXGPG3EPja8JBFR",
        "type": "Multikey", // external (property value)
        "controller": "did:example:123",
        "publicKeyMultibase": "z6MkgYhVuWq4hyc7ZKBGhsY7pb5Bc8V6VPXGPG3EPja8JBFR"
      }
    ]
}
      

{
  "@context": "https://www.w3.org/ns/did/v1.1",
  "id": "did:example:123",
  "verificationMethod": [
    {
      "id": "did:example:123#key-0",
      "type": "JsonWebKey",
      "controller": "did:example:123",
      "publicKeyJwk": {
        "kty": "OKP", // external (property name)
        "crv": "Ed25519", // external (property name)
        "x": "VCpo2LMLhn6iWku8MKvSLg2ZAoC-nlOyPVQaO3FxVeQ" // external (property name)
      }
    },
    {
      "id": "did:example:123#key-1",
      "type": "JsonWebKey",
      "controller": "did:example:123",
      "publicKeyJwk": {
        "kty": "OKP", // external (property name)
        "crv": "X25519", // external (property name)
        "x": "pE_mG098rdQjY3MKK2D5SUQ6ZOEW3a6Z6T7Z4SgnzCE" // external (property name)
      }
    },
    {
      "id": "did:example:123#key-2",
      "type": "JsonWebKey",
      "controller": "did:example:123",
      "publicKeyJwk": {
        "kty": "EC", // external (property name)
        "crv": "secp256k1", // external (property name)
        "x": "Z4Y3NNOxv0J6tCgqOBFnHnaZhJF6LdulT7z8A-2D5_8", // external (property name)
        "y": "i5a2NtJoUKXkLm6q8nOEu9WOkso1Ag6FTUT6k_LMnGk" // external (property name)
      }
    },
    {
      "id": "did:example:123#key-3",
      "type": "JsonWebKey",
      "controller": "did:example:123",
      "publicKeyJwk": {
        "kty": "EC", // external (property name)
        "crv": "secp256k1", // external (property name)
        "x": "U1V4TVZVMUpUa0ZVU1NBcU9CRm5IbmFaaEpGNkxkdWx", // external (property name)
        "y": "i5a2NtJoUKXkLm6q8nOEu9WOkso1Ag6FTUT6k_LMnGk" // external (property name)
      }
    },
    {
      "id": "did:example:123#key-4",
      "type": "JsonWebKey",
      "controller": "did:example:123",
      "publicKeyJwk": {
        "kty": "EC", // external (property name)
        "crv": "P-256", // external (property name)
        "x": "Ums5WVgwRkRTVVFnU3k5c2xvZllMbEcwM3NPRW91ZzN", // external (property name)
        "y": "nDQW6XZ7b_u2Sy9slofYLlG03sOEoug3I0aAPQ0exs4" // external (property name)
      }
    },
    {
      "id": "did:example:123#key-5",
      "type": "JsonWebKey",
      "controller": "did:example:123",
      "publicKeyJwk": {
        "kty": "EC", // external (property name)
        "crv": "P-384", // external (property name)
        "x": "VUZKSlUwMGdpSXplekRwODhzX2N4U1BYdHVYWUZsaXVDR25kZ1U0UXA4bDkxeHpE", // external (property name)
        "y": "jq4QoAHKiIzezDp88s_cxSPXtuXYFliuCGndgU4Qp8l91xzD1spCmFIzQgVjqvcP" // external (property name)
      }
    },
    {
      "id": "did:example:123#key-6",
      "type": "JsonWebKey",
      "controller": "did:example:123",
      "publicKeyJwk": {
        "kty": "EC", // external (property name)
        "crv": "P-521", // external (property name)
        "x": "VTI5c1lYSmZWMmx1WkhNZ0dQTXhaYkhtSnBEU3UtSXZwdUtpZ0VOMnB6Z1d0U28tLVJ3ZC1uNzhuclduWnplRGMx", // external (property name)
        "y": "UW5WNVgwSnBkR052YVc0Z1VqY1B6LVpoZWNaRnliT3FMSUpqVk9sTEVUSDd1UGx5RzBnRW9NV25JWlhoUVZ5cFB5" // external (property name)
      }
    },
    {
      "id": "did:example:123#key-7",
      "type": "JsonWebKey",
      "controller": "did:example:123",
      "publicKeyJwk": {
        "kty": "RSA", // external (property name)
        "e": "AQAB", // external (property name)
        "n": "UkhWaGJGOUZRMTlFVWtKSElBdENGV2hlU1F2djFNRXh1NVJMQ01UNGpWazlraEpLdjhKZU1YV2UzYldIYXRqUHNrZGYyZGxhR2tXNVFqdE9uVUtMNzQybXZyNHRDbGRLUzNVTElhVDFoSkluTUhIeGoyZ2N1Yk82ZUVlZ0FDUTRRU3U5TE8wSC1MTV9MM0RzUkFCQjdRamE4SGVjcHl1c3BXMVR1X0RicXhjU253ZW5kYW13TDUyVjE3ZUtobE80dVh3djJIRmx4dWZGSE0wS21DSnVqSUt5QXhqRF9tM3FfX0lpSFVWSEQxdERJRXZMUGhHOUF6c24zajk1ZC1zYU" // external (property name)
      }
    }
  ]
}
      

{
  "@context": "https://www.w3.org/ns/did/v1.1",
  "id": "did:example:123",
  "verificationMethod": [{
    "id": "did:example:123#key-0",
    "type": "Multikey",
    "controller": "did:example:123",
    "publicKeyMultibase": "z6MkmM42vxfqZQsv4ehtTjFFxQ4sQKS2w6WR7emozFAn5cxu"
  }, {
    "id": "did:example:123#key-1",
    "type": "Multikey",
    "controller": "did:example:123",
    "publicKeyMultibase": "z6MtTjFFxQ4sQKS2wmozFAn5cxukmM46WR7e2vxfqZQsv4eh"
  }, {
    "id": "did:example:123#key-2",
    "type": "EcdsaSecp256k1VerificationKey2019",
    "controller": "did:example:123",
    "publicKeyMultibase": "zns2aFDq25fEV1NUd3wZ65sgtht4j5QjFW8JCAHdUJfLwfodt"
  }, {
    "id": "did:example:123#key-3",
    "type": "JsonWebKey",
    "controller": "did:example:123",
    "publicKeyJwk": {
      "kty": "EC", // external (property name)
      "crv": "P-256", // external (property name)
      "x": "Er6KSSnAjI70ObRWhlaMgqyIOQYrDJTE94ej5hybQ2M",
      "y": "pPVzCOTJwgikPjuUE6UebfZySqEJ0ZtsWFpj7YSPGEk"
    }
  }]
}
      

        {
          "@context": "https://www.w3.org/ns/did/v1.1",
          "id": "did:example:123",
          "verificationMethod": [
            {
              // A relative DID URL, that will be transformed to the absolute DID URL value did:example:123#key-1
              "id": "#key-1",
              "type": "Ed25519VerificationKey2020",
              "controller": "did:example:123",
              "publicKeyMultibase": "z6MkmM42vxfqZQsv4ehtTjFFxQ4sQKS2w6WR7emozFAn5cxu"
            }
          ],
          "authentication": [
            "#key-1"
          ],
          "capabilityInvocation": [
            "#key-1"
          ],
          "capabilityDelegation": [
            "#key-1"
          ],
          "assertionMethod": [
            // Using relative DID URL #key-1 is equivalent to using the absolute DID URL value did:example:123#key-1
            "did:example:123#key-1"
          ]
      }
      

证明

这些示例仅供参考。有关更多示例，请参见[[[VC-DATA-MODEL]]]。

{
  // external (all terms in this example)
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://w3id.org/citizenship/v4rc1"
  ],
  "type": [
    "VerifiableCredential",
    "PermanentResidentCardCredential"
  ],
  "issuer": {
    "id": "did:key:zDnaeYGXycLmAn5m9akGtdL6rqBspGQPM7QZXW2CvJ3k9c2Bz",
    "image": "data:image/png;base64,iVBORw0KGgo...5CYII="
  },
  "name": "Permanent Resident Card",
  "description": "Government of Utopia Permanent Resident Card.",
  "credentialSubject": {
    "type": [
      "PermanentResident",
      "Person"
    ],
    "givenName": "JANE",
    "familyName": "SMITH",
    "gender": "Female",
    "image": "data:image/png;base64,iVBORw0KGgoAA...kJggg==",
    "residentSince": "2015-01-01",
    "commuterClassification": "C1",
    "birthCountry": "Arcadia",
    "birthDate": "1978-07-17",
    "permanentResidentCard": {
      "type": "PermanentResidentCard",
      "identifier": "83627465",
      "lprCategory": "C09",
      "lprNumber": "999-999-999"
    }
  },
  "validFrom": "2025-01-04T00:00:00Z",
  "validUntil": "2026-01-04T23:59:59Z",
  "proof": {
    "type": "DataIntegrityProof",
    "created": "2025-01-04T15:02:36Z",
    "verificationMethod": "did:key:zDnaeYGXycLmAn5m9akGtdL6rqBspGQPM7QZXW2CvJ3k9c2Bz#zDnaeYGXycLmAn5m9akGtdL6rqBspGQPM7QZXW2CvJ3k9c2Bz",
    "cryptosuite": "ecdsa-rdfc-2019",
    "proofPurpose": "assertionMethod",
    "proofValue": "z5CK4DPN7...Jpqwp"
  }
}
      

{  // external (all terms in this example)
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://w3id.org/citizenship/v4rc1"
  ],
  "type": [
    "VerifiableCredential",
    "PermanentResidentCardCredential"
  ],
  "issuer": {
    "id": "did:example:123#key-1",
    "image": "data:image/png;base64,iVBORw0KGgo...5CYII="
  },
  "name": "Permanent Resident Card",
  "description": "Government of Utopia Permanent Resident Card.",
  "credentialSubject": {
    "type": [
      "PermanentResident",
      "Person"
    ],
    "givenName": "JANE",
    "familyName": "SMITH",
    "gender": "Female",
    "image": "data:image/png;base64,iVBORw0KGgoAA...kJggg==",
    "residentSince": "2015-01-01",
    "commuterClassification": "C1",
    "birthCountry": "Arcadia",
    "birthDate": "1978-07-17",
    "permanentResidentCard": {
      "type": "PermanentResidentCard",
      "identifier": "83627465",
      "lprCategory": "C09",
      "lprNumber": "999-999-999"
    }
  },
  "validFrom": "2025-01-04T00:00:00Z",
  "validUntil": "2026-01-04T23:59:59Z",
  "proof": {
    "type": "DataIntegrityProof",
    "created": "2025-01-04T15:02:36Z",
    "verificationMethod": "did:example:123#key-1",
    "cryptosuite": "ecdsa-jcs-2019",
    "proofPurpose": "assertionMethod",
    "proofValue": "z5m9akGtdL...6rqBspGQP"
  }
}
      

{  // external (all terms in this example)
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://w3id.org/citizenship/v4rc1"
  ],
  "type": [
    "VerifiableCredential",
    "PermanentResidentCardCredential"
  ],
  "issuer": {
    "id": "did:key:zUC7DojAAkoD8WpSS87KG6iuMSBd4wH1fZzmcwmakx4JfaXN7RLSES4wNCfWboHvULxGxRwiSsj6UYSgq1dWGusdwrrJsjUQQEb1oid3igF4hbSFzFjf9aWTJSphhu63vHGoAVE",
    "image": "data:image/png;base64,iVBORw0KGgoAA...CYII="
  },
  "name": "Permanent Resident Card",
  "description": "Government of Utopia Permanent Resident Card.",
  "credentialSubject": {
    "type": [
      "PermanentResident",
      "Person"
    ],
    "givenName": "JANE",
    "familyName": "SMITH",
    "gender": "Female",
    "image": "data:image/png;base64,iVBORw0KGgoAAA...3dgg==",
    "residentSince": "2015-01-01",
    "commuterClassification": "C1",
    "birthCountry": "Arcadia",
    "birthDate": "1978-07-17",
    "permanentResidentCard": {
      "type": "PermanentResidentCard",
      "identifier": "83627465",
      "lprCategory": "C09",
      "lprNumber": "999-999-999"
    }
  },
  "validFrom": "2025-01-04T00:00:00Z",
  "validUntil": "2026-01-04T23:59:59Z",
  "proof": {
    "type": "DataIntegrityProof",
    "verificationMethod": "did:key:zUC7DojAAkoD8WpSS87KG6iuMSBd4wH1fZzmcwmakx4JfaXN7RLSES4wNCfWboHvULxGxRwiSsj6UYSgq1dWGusdwrrJsjUQQEb1oid3igF4hbSFzFjf9aWTJSphhu63vHGoAVE#zUC7DojAAkoD8WpSS87KG6iuMSBd4wH1fZzmcwmakx4JfaXN7RLSES4wNCfWboHvULxGxRwiSsj6UYSgq1dWGusdwrrJsjUQQEb1oid3igF4hbSFzFjf9aWTJSphhu63vHGoAVE",
    "cryptosuite": "bbs-2023",
    "proofPurpose": "assertionMethod",
    "proofValue": "u2V0ChVhQik2d4...pc3N1ZXI"
  }
}
      

{
  // external (all terms in this example)
  "@context": "https://www.w3.org/ns/credentials/v2",
  "type": "VerifiablePresentation",
  // holder did:key is pairwise to the domain to avoid correlation
  "holder": "did:key:z6MkveKdpgkQ1pwNktQ5Lc19epBrzFjMUeNMUZGFvezFF2dX",
  "verifiableCredential": {
    "@context": [
      "https://www.w3.org/ns/credentials/v2",
      "https://w3id.org/citizenship/v4rc1"
    ],
    "type": [
      "VerifiableCredential",
      "PermanentResidentCardCredential"
    ],
    "issuer": {
      "id": "did:web:unlinkable.example",
      "image": "data:image/png;base64,iVBORw0KGgoAA...CYII="
    },
    "credentialSubject": {
      "type": ["PermanentResident", "Person"],
      // only country is selectively disclosed
      "birthCountry": "Arcadia"
    },
    "proof": {
      "type": "DataIntegrityProof",
      "verificationMethod": "did:web:vcplayground.org#zUC7EwMqo9vCjFmj7ArU2SivcbeccAY6hd4nw5fVD6xD4W2vm9eVy6VqVnciAZRmPLXnuxuka5JTJVmgz66CxDno6eqZmvUViCckCcKg8A4s1R4i2JjyzrdTQs5zrfY4jJCHFCp",
      "cryptosuite": "bbs-2023",
      "proofPurpose": "assertionMethod",
      "proofValue": "u2V0DhV...3JnIn0"
    }
  },
  "proof": {
    "type": "DataIntegrityProof",
    "created": "2025-01-04T15:10:39Z",
    "verificationMethod": "did:key:z6MkveKdpgkQ1pwNktQ5Lc19epBrzFjMUeNMUZGFvezFF2dX#z6MkveKdpgkQ1pwNktQ5Lc19epBrzFjMUeNMUZGFvezFF2dX",
    "proofPurpose": "authentication",
    "challenge": "QZVVFcXlMPStFmpXTSktv",
    "domain": "https://unlinkable.example",
    "proofValue": "z5tXmHk...x2GvTt3bF"
  }
}
      

{ // external (all terms in this example)
  "protected": {
    "kid": "did:example:123#_Qq0UL2Fq651Q0Fjd6TvnYE-faHiOpRlPVQcY_-tA4A",
    "alg": "EdDSA"
  },
  "payload": {
    "@context": [
      "https://www.w3.org/ns/credentials/v2",
      "https://w3id.org/citizenship/v4rc1"
    ],
    "type": [
      "VerifiableCredential",
      "PermanentResidentCardCredential"
    ],
    "issuer": {
      "id": "did:key:zUC7Do...oAVE",
      "image": "data:image/png;base64,iVBORw0KGgoAA...CYII="
    },
    "name": "Permanent Resident Card",
    "description": "Government of Utopia Permanent Resident Card.",
    "credentialSubject": {
      "type": [
        "PermanentResident",
        "Person"
      ],
      "givenName": "JANE",
      "familyName": "SMITH",
      "gender": "Female",
      "image": "data:image/png;base64,iVBORw0KGgoAAA...3dgg==",
      "residentSince": "2015-01-01",
      "commuterClassification": "C1",
      "birthCountry": "Arcadia",
      "birthDate": "1978-07-17",
      "permanentResidentCard": {
        "type": "PermanentResidentCard",
        "identifier": "83627465",
        "lprCategory": "C09",
        "lprNumber": "999-999-999"
      }
    },
    "validFrom": "2025-01-04T00:00:00Z",
    "validUntil": "2026-01-04T23:59:59Z",
  },
  "signature": "qSv6d...bJRAw"
}
      

加密

这些示例仅供参考，最佳实践是避免在JWE头中披露不必要的信息。

{ // external (all terms in this example)
  "ciphertext": "3SHQQJajNH6q0fyAHmw...",
  "iv": "QldSPLVnFf2-VXcNLza6mbylYwphW57Q",
  "protected": "eyJlbmMiOiJYQzIwUCJ9",
  "recipients": [
    {
      "encrypted_key": "BMJ19zK12YHftJ4sr6Pz1rX1HtYni_L9DZvO1cEZfRWDN2vXeOYlwA",
      "header": {
        "alg": "ECDH-ES+A256KW",
        "apu": "Tx9qG69ZfodhRos-8qfhTPc6ZFnNUcgNDVdHqX1UR3s",
        "apv": "ZGlkOmVsZW06cm9wc3RlbjpFa...",
        "epk": {
          "crv": "X25519",
          "kty": "OKP",
          "x": "Tx9qG69ZfodhRos-8qfhTPc6ZFnNUcgNDVdHqX1UR3s"
        },
        "kid": "did:example:123#zC1Rnuvw9rVa6E5TKF4uQVRuQuaCpVgB81Um2u17Fu7UK"
      }
    }
  ],
  "tag": "xbfwwDkzOAJfSVem0jr1bA"
}
      

详细架构图

以下是显示[[[#data-model]]]、[[[#core-properties]]]和[[[#methods]]]以及[[?DID-RESOLUTION]]之间关系的图表。

DID的创建

[=DID=]的创建是由每个[=DID Method=]定义的过程。一些[=DID Methods=]，例如`did:key`，是纯生成性的，即通过将单个加密材料转换为合规的[=representation=]来生成[=DID=]和[=DID document=]。其他[=DID methods=]可能需要使用[=verifiable data registry=]，其中[=DID=]和[=DID document=]仅在注册完成后才被第三方认可为存在（如相应的[=DID method=]所定义）。相应的[=DID method=]可能定义其他过程。

确定DID主体

[=DID=]是URI（统一资源标识符）的一种特定类型，因此[=DID=]可以引用任何资源。根据[[RFC3986]]：

术语"资源"以通用意义使用，指代URI可能标识的任何事物。[...] 资源不一定可以通过互联网访问。

资源可以是数字的或物理的，抽象的或具体的。任何可以分配URI的资源都可以分配[=DID=]。[=DID=]引用的资源就是[=DID subject=]。

[=DID controller=]确定[=DID subject=]。通常无法从查看[=DID=]本身来确定[=DID subject=]，因为[=DIDs=]通常只对机器有意义，对人类没有意义。[=DID=]不太可能包含有关[=DID subject=]的任何信息，因此有关[=DID subject=]的更多信息只能通过将[=DID=]解析为[=DID document=]、获取有关[=DID=]的可验证凭证或通过[=DID=]的其他描述来发现。

虽然检索到的[=DID document=]中`id`属性的值必须始终与正在解析的[=DID=]匹配，但[=DID=]引用的实际资源是否可以随时间变化取决于[=DID method=]。例如，允许[=DID subject=]更改的[=DID method=]可以用来为特定角色的当前占据者生成[=DID=]—例如公司的CEO—其中占据该角色的实际人员可能因解析[=DID=]的时间不同而不同。

引用DID文档

[=DID=]引用[=DID subject=]并解析为[=DID document=]（通过遵循[=DID method=]指定的协议）。[=DID document=]不是与[=DID subject=]分离的资源，也没有与[=DID=]分离的[=URI=]。相反，[=DID document=]是[=DID resolution=]的产物，由[=DID controller=]控制，目的是启用与[=DID subject=]的加密可验证交互。

下图说明了这一区别。

DID文档中的声明

[=DID document=]中的每个属性都是[=DID controller=]做出的声明，描述了：

• 定义[=DID subject=]标识符的字符串（例如，`id`和`alsoKnownAs`属性）
• 如何与[=DID subject=]交互（例如，`verificationMethod`和`service`属性）。
• 如何解释[=DID document=]的特定表示（例如，JSON-LD表示的`@context`属性）。

[=DID document=]中唯一必需的属性是`id`，因此这是[=DID document=]中唯一保证存在的声明。该声明在[[[#did-and-did-document-graph]]]中通过[=DID=]和[=DID subject=]之间的直接链接进行了说明。

发现有关DID主体的更多信息

发现有关[=DID subject=]的更多信息的选项取决于[=DID document=]中存在的属性。如果存在`service`属性，可以从[=service endpoint=]请求更多信息。例如，通过查询支持可验证凭证的[=service endpoint=]以获取描述[=DID subject=]的一个或多个声明（属性）。

另一个选项是使用`alsoKnownAs`属性（如果它存在于[=DID document=]中）。[=DID controller=]可以使用它来提供引用同一[=DID subject=]的其他URI列表（包括其他[=DIDs=]）。解析或解引用这些URI可能会产生[=DID subject=]的其他描述或表示，如下图所示。

提供DID主体的表示

如果[=DID subject=]是可以从互联网检索的数字资源，[=DID method=]可以选择构造一个返回[=DID subject=]本身表示的[=DID URL=]。例如，需要持久的、加密可验证标识符的数据模式可以被分配一个[=DID=]，并且传递指定的[[[#path]]]或[[[#query]]]可以用作检索该模式表示的标准方式。

类似地，[=DID=]可以用于引用数字资源（如图像），如果适用的[=DID method=]支持该功能，则可以直接从[=verifiable data registry=]返回该资源。

为现有Web资源分配DID

如果网页或任何其他Web资源的控制者想要为其分配一个持久的、加密可验证的标识符，控制者可以给它一个[=DID=]。例如，由博客托管公司托管的博客（在该托管公司的域名下）的作者可以为博客创建一个[=DID=]。在[=DID document=]中，作者可以包含指向博客当前URL的`alsoKnownAs`属性，例如：

如果作者随后将博客迁移到不同的托管公司（或作者自己的域名），作者可以更新[=DID document=]以指向博客的新URL，例如：

[=DID=]有效地为博客URL添加了一层间接引用。这层间接引用在作者的控制之下，而不是在外部管理机构（如博客托管公司）的控制之下。这就是[=DID=]如何有效地充当增强型URN（统一资源名称）的方式—一种网络位置可能随时间变化的信息资源的持久标识符。

DID控制者与DID主体之间的关系

为避免混淆，根据[=DID subject=]与[=DID controller=]的关系，将[=DID subject=]分为两个不相交的集合是有帮助的。

集合#1：DID主体就是DID控制者

第一种情况如[[[#controller-subject-equivalence]]]所示，是[=DID subject=]也是[=DID controller=]的常见场景。这是个人或组织创建[=DID=]进行自我标识的情况。

图表中出现两个小黑色圆圈，一个在左上方标有"DID Controller"，一个在右上方标有"DID Subject"。一条实心红色箭头从DID Controller圆圈延伸到DID Subject圆圈，箭头上方以大粗体标注"DID"，下方以小斜体标注"Identifies"。一条虚线红色双向箭头标有"Equivalence"，在两个圆圈之间延伸，在它们之间和上方的空间形成弧线。图表下部是一个黑色轮廓的带弯角矩形，包含标签"DID Document"。此DID Document矩形与DID Controller和DID Subject的小黑色圆圈之间有箭头指向，带有斜体标签，如下所示。一条蓝色箭头从DID Document指向DID Subject，标有"Describes"。一条绿色箭头从DID Controller指向DID Document，标有"Controls"。一条绿色箭头从DID Document指向DID Controller，向外弯曲成弧线，标有"Controller"。一条虚线红色箭头标有"Resolves to"，从DID Controller开始向右延伸，从指向DID Subject的箭头分支出来，然后向下弯曲指向DID Document。

从图形模型的角度来看，即使[[[#controller-subject-equivalence]]]中标识为[=DID controller=]和[=DID subject=]的节点是不同的，它们之间存在一条逻辑弧来表达语义等价关系。

多个DID控制者

[=DID document=]可能有多个[=DID controller=]。这可以通过以下两种方式之一发生。

独立控制

在这种情况下，每个[=DID controllers=]可以独立行事，即每个都有完全的权力独立更新[=DID document=]。从图形模型的角度来看，在此配置中：

• 每个额外的[=DID controller=]是另一个不同的图节点（可能由其自身的[=DID=]标识）。
• 每个[=DID controller=]和[=DID document=]之间存在相同的弧线（"controls"和"controller"）。

左侧垂直排列三个黑色圆圈，每个标有"DID Controller"。从每个圆圈延伸出一对绿色箭头指向图表中央的单个矩形，标有"DID Document"。该矩形右下角被切割并向内弯折形成一个小三角形，仿佛代表一张带卷角的纸张。每对绿色箭头由一条从黑色圆圈指向矩形的箭头（标有"Controls"）和一条指向相反方向（从矩形到黑色圆圈）的箭头（标有"Controller"）组成。从矩形右侧延伸出一条蓝色箭头，标有"Describes"，指向一个标有"DID Subject"的黑色圆圈。

群组控制

在群组控制的情况下，[=DID controllers=]预期以某种方式共同行事，例如使用需要多个数字签名（"多重签名"）或阈值数量数字签名（"m-of-n"）的加密算法。这些用于验证证明的额外阈值可以在[=verification method=]中表达（如[[[#verification-methods]]]节所述），也可以是[=verification method=]验证材料的内在部分，其中参与生成特定数字签名的[=DID controllers=]数量出于隐私原因而被隐藏。需要由群组成员执行的加密操作组合产生证明的验证方法可用于控制DID文档的内容；具体如何实现取决于各个DID方法规范。

从功能角度来看，此选项类似于单个[=DID controller=]，因为虽然[=DID controller=]组中的每个[=DID controllers=]都有其自己的图节点，但实际控制归结为表示[=DID controller=]组的单个逻辑图节点，如[[[#group-did-controllers]]]所示。

左侧是三个黑色实心圆圈，由左侧的花括号标注为"DID Controller Group"。从这三个圆圈中的每一个都延伸出一条绿色箭头指向中右方。这三条箭头汇聚向一个单独的白色实心圆圈。一对水平绿色箭头将此白色圆圈右侧连接到一个形状像带卷角页面的矩形，标有"DID Document"。上方箭头向右指（从白色圆圈到矩形），标有"Controls"。下方箭头向左指（从矩形到白色圆圈），标有"Controller"。从矩形右侧延伸出一条蓝色箭头，标有"Describes"，指向一个标有"DID Subject"的黑色圆圈。

此配置通常适用于[=DID subject=]是组织、公司、政府机构、社区或其他不受单个个人控制的团体的情况。

更改DID主体

[=DID document=]恰好有一个引用[=DID subject=]的[=DID=]。[=DID=]表示为`id`属性的值。此属性值在[=DID document=]的生命周期内是不可变的。

但是，[=DID=]标识的资源，即[=DID subject=]，可能会随时间变化。这完全由[=DID controller=]决定。有关更多详细信息，请参见[[[#persistence]]]节。

更改DID控制者

[=DID document=]的[=DID controller=]可能会随时间变化。但是，根据实现方式的不同，[=DID controller=]的更改可能不会通过[=DID document=]本身的更改来体现。例如，如果更改是通过转移用于[=DID document=]中一个或多个[=verification methods=]的底层加密密钥或其他控制的所有权来实现的，则可能与标准密钥轮换无法区分。

另一方面，如果更改是通过更改[=`controller`=]属性的值来实现的，则是透明的。

如果验证[=DID controller=]的更改很重要，建议实现者根据修改后的[=DID document=]中的[=verification methods=]对新的[=DID controller=]进行[=authentication|身份验证=]。