Functional Requirements Engineering for Decentralized Identity Applications

Self-sovereign identity (SSI) is a user-centric and decentralized paradigm for digital identity, empowering individuals with full control over their personal data. This concept is guided by high-level principles such as privacy, security, and user autonomy, which function as Non-Functional Requirements (NFRs) for system design. However, while NFRs are sometimes complicated for system evaluation and verification, a significant gap exists between these abstract principles and the concrete, verifiable Functional Requirements (FRs) due to the lack of a systematic derivation methodology. This thesis addresses this challenge by developing a systematic framework to translate the abstract NFRs of SSI into a concrete catalog of verifiable FRs. Combining simplified Softgoal interdependency graph(SIG), SSI use case analysis, and a comprehensive analysis of SSI literature, a structured, traceable process was designed to decompose NFRs and map them to the core architectural components of the SSI model (Issuer, Holder, and Verifier). The framework’s practical utility was validated through in-depth case studies on two prominent SSI systems, Sovrin and uPort, demonstrating its e!ectiveness in providing a structured, evidence-based assessment of system compliance and enabling objective comparisons.