Virtual Private Networks are the primary tool for private remote access, yet they harbor a critical but often overlooked trust assumption; the gateway must see both who the user is and what they access. This coupling of identity and activity enables behavioral profiling and surveillance, whether by malicious insiders, compromised infrastructure, or compelled disclosure. Even modern zero-trust architectures leave this fundamental linkage intact. We present SSAI, an edge-based VPN architecture that cryptographically reduces linkage identity verification from traffic forwarding. Users present verifiable credentials from a Self-Sovereign Identity (SSI) wallet to an untrusted edge node, which applies proof re-randomization and temporal mixing to achieve unlinkable access. Critically, even a compromised edge node cannot cryptographically link a verified presentation to subsequent traffic patterns after the mapping state expires. We formalize a privacy model for unlinkable VPN access grounded in selective disclosure and temporal dissociation, providing security proofs under standard assumptions (DDH, q-SDH). We implement a proof-of-concept and evaluate it in a controlled testbed environment with 500 concurrent client identities generating over 81,000 presentations. The system processes an offered load of 3,446 requests per hour, with presentations averaging 35.1 KB and a mean verification time of 35.3 milliseconds. Unlike prior work that merely uses Self-Sovereign Identity for authorization, we employ it to architecturally decouple identity verification from the network forwarding path. The architecture deploys on existing infrastructure and untrusted cloud providers can offer a practical path toward more robust private remote access.
Djam-Doudou et al. (Fri,) studied this question.