Security Training & Certification Verification Scenario

This guide demonstrates how to build a security training and certification verification system using TrustWeave. You’ll learn how training providers can issue training and certification credentials, how individuals can store them in wallets, and how employers can verify security qualifications without manual checks.

What You’ll Build

By the end of this tutorial, you’ll have:

✅ Created DIDs for training providers (issuers) and professionals (holders)
✅ Issued Verifiable Credentials for security training and certifications
✅ Stored training and certification credentials in wallet
✅ Implemented certification expiration tracking
✅ Created privacy-preserving qualification presentations
✅ Verified certifications without revealing full identity
✅ Demonstrated multi-certification verification
✅ Implemented skill-based credential organization

Big Picture & Significance

The Security Training & Certification Challenge

Security professionals need verifiable proof of training and certifications (CISSP, CEH, Security+, etc.), but traditional methods require manual verification and compromise privacy. Verifiable credentials enable instant certification verification without revealing unnecessary personal information.

Industry Context:

Market Size: Global cybersecurity training market projected to reach $20 billion by 2027
Certification Demand: 3.5 million cybersecurity job openings globally
Verification Complexity: Manual certification verification is time-consuming
Privacy Concerns: Professionals don’t want to share full identity
Compliance: Employers need to verify certifications for compliance

Why This Matters:

Efficiency: Instant certification verification
Privacy: Verify certifications without revealing identity
Compliance: Automated compliance with certification requirements
User Experience: Simple, fast verification process
Selective Disclosure: Share only relevant certifications
Portability: Certifications work across employers

The Security Training & Certification Problem

Traditional certification verification faces critical issues:

Manual Verification: Time-consuming manual checks
Privacy Violation: Requires full identity disclosure
Fraud Vulnerability: Fake certifications are possible
Not Portable: Certification proof tied to specific systems
Compliance Risk: Difficult to verify certifications for compliance
User Friction: Complex verification processes

Value Proposition

Problems Solved

Instant Verification: Verify certifications instantly without manual checks
Privacy-Preserving: Verify certifications without revealing identity
Fraud Prevention: Cryptographic proof prevents fake certifications
Compliance: Automated compliance with certification requirements
Selective Disclosure: Share only relevant certifications
Portability: Certification credentials work across employers
Efficiency: Streamlined verification process

Business Benefits

For Employers:

Efficiency: Instant certification verification
Compliance: Automated compliance with certification requirements
Trust: Cryptographic proof of certifications
Cost Reduction: Reduced manual verification costs
User Experience: Improved hiring process

For Professionals:

Privacy: Control what information is shared
Security: Cryptographic protection of certification data
Convenience: Share certifications without full identity disclosure
Portability: Certification credentials work everywhere
Control: Own and control certification verification data

For Training Providers:

Efficiency: Automated credential issuance
Trust: Enhanced trust through verifiable credentials
Scalability: Handle more certifications
Compliance: Meet certification requirements

ROI Considerations

Verification Speed: 100x faster than manual verification
Cost Reduction: 80-90% reduction in verification costs
Compliance: Automated certification compliance
Fraud Prevention: Eliminates fake certification fraud
User Experience: Improved user satisfaction

Understanding the Problem

Traditional certification verification has several problems:

Manual verification: Time-consuming manual checks
Privacy violation: Requires full identity disclosure
Fraud is possible: Fake certifications can be created
Not portable: Certification proof tied to specific systems
Compliance risk: Difficult to verify certifications for compliance

TrustWeave solves this by enabling:

Instant verification: Verify certifications instantly
Privacy-preserving: Selective disclosure shows only certifications
Cryptographic proof: Tamper-proof certification credentials
Self-sovereign: Individuals control their certification data
Portable: Certification credentials work across systems

How It Works: The Security Training & Certification Flow

flowchart TD
    A["Training Provider<br/>Issues Training/Certification<br/>Credential"] -->|issues| B["Training/Certification Credential<br/>Professional DID<br/>Certification Details<br/>Cryptographic Proof"]
    B -->|stored in| C["Professional Wallet<br/>Stores certifications<br/>Organizes by skill<br/>Maintains privacy"]
    C -->|presents| D["Employer<br/>Verifies certifications<br/>Checks expiration<br/>Validates qualifications"]

    style A fill:#1976d2,stroke:#0d47a1,stroke-width:2px,color:#fff
    style B fill:#f57c00,stroke:#e65100,stroke-width:2px,color:#fff
    style C fill:#388e3c,stroke:#1b5e20,stroke-width:2px,color:#fff
    style D fill:#c2185b,stroke:#880e4f,stroke-width:2px,color:#fff

Prerequisites

Java 21+
Kotlin 2.2.0+
Gradle 8.5+
Basic understanding of Kotlin and coroutines

Step 1: Add Dependencies

Add TrustWeave dependencies to your build.gradle.kts:

dependencies {
    // Core TrustWeave modules
    implementation("com.trustweave:trustweave-all:1.0.0-SNAPSHOT")

    // Kotlinx Serialization
    implementation("org.jetbrains.kotlinx:kotlinx-serialization-json:1.6.0")

    // Coroutines
    implementation("org.jetbrains.kotlinx:kotlinx-coroutines-core:1.7.3")
}

Step 2: Complete Runnable Example

Here’s the full security training and certification verification flow using the TrustWeave facade API:

package com.example.security.training

import com.trustweave.TrustWeave
import com.trustweave.core.*
import com.trustweave.credential.PresentationOptions
import com.trustweave.credential.wallet.Wallet
import com.trustweave.spi.services.WalletCreationOptionsBuilder
import kotlinx.coroutines.runBlocking
import kotlinx.serialization.json.buildJsonObject
import kotlinx.serialization.json.put
import java.time.Instant
import java.time.temporal.ChronoUnit

fun main() = runBlocking {
    println("=".repeat(70))
    println("Security Training & Certification Verification Scenario - Complete End-to-End Example")
    println("=".repeat(70))

    // Step 1: Create TrustWeave instance
    val TrustWeave = TrustWeave.create()
    println("\n✅ TrustWeave initialized")

    // Step 2: Create DIDs for training providers, professionals, and employers
    import com.trustweave.trust.types.DidCreationResult
    import com.trustweave.trust.types.WalletCreationResult
    
    val isc2DidResult = trustWeave.createDid { method("key") }
    val isc2Did = when (isc2DidResult) {
        is DidCreationResult.Success -> isc2DidResult.did
        else -> throw IllegalStateException("Failed to create ISC2 DID: ${isc2DidResult.reason}")
    }
    
    val isc2Resolution = trustWeave.resolveDid(isc2Did)
    val isc2Doc = when (isc2Resolution) {
        is DidResolutionResult.Success -> isc2Resolution.document
        else -> throw IllegalStateException("Failed to resolve ISC2 DID")
    }
    val isc2KeyId = isc2Doc.verificationMethod.firstOrNull()?.id?.substringAfter("#")
        ?: throw IllegalStateException("No verification method found")

    val ecCouncilDidResult = trustWeave.createDid { method("key") }
    val ecCouncilDid = when (ecCouncilDidResult) {
        is DidCreationResult.Success -> ecCouncilDidResult.did
        else -> throw IllegalStateException("Failed to create EC-Council DID: ${ecCouncilDidResult.reason}")
    }
    
    val ecCouncilResolution = trustWeave.resolveDid(ecCouncilDid)
    val ecCouncilDoc = when (ecCouncilResolution) {
        is DidResolutionResult.Success -> ecCouncilResolution.document
        else -> throw IllegalStateException("Failed to resolve EC-Council DID")
    }
    val ecCouncilKeyId = ecCouncilDoc.verificationMethod.firstOrNull()?.id?.substringAfter("#")
        ?: throw IllegalStateException("No verification method found")

    val comptiaDidResult = trustWeave.createDid { method("key") }
    val comptiaDid = when (comptiaDidResult) {
        is DidCreationResult.Success -> comptiaDidResult.did
        else -> throw IllegalStateException("Failed to create CompTIA DID: ${comptiaDidResult.reason}")
    }
    
    val comptiaResolution = trustWeave.resolveDid(comptiaDid)
    val comptiaDoc = when (comptiaResolution) {
        is DidResolutionResult.Success -> comptiaResolution.document
        else -> throw IllegalStateException("Failed to resolve CompTIA DID")
    }
    val comptiaKeyId = comptiaDoc.verificationMethod.firstOrNull()?.id?.substringAfter("#")
        ?: throw IllegalStateException("No verification method found")

    val professionalDidResult = trustWeave.createDid { method("key") }
    val professionalDid = when (professionalDidResult) {
        is DidCreationResult.Success -> professionalDidResult.did
        else -> throw IllegalStateException("Failed to create professional DID: ${professionalDidResult.reason}")
    }
    
    val employerDidResult = trustWeave.createDid { method("key") }
    val employerDid = when (employerDidResult) {
        is DidCreationResult.Success -> employerDidResult.did
        else -> throw IllegalStateException("Failed to create employer DID: ${employerDidResult.reason}")
    }

    println("✅ (ISC)² DID: ${isc2Did.value}")
    println("✅ EC-Council DID: ${ecCouncilDid.value}")
    println("✅ CompTIA DID: ${comptiaDid.value}")
    println("✅ Professional DID: ${professionalDid.value}")
    println("✅ Employer DID: ${employerDid.value}")

    // Step 3: Issue CISSP certification credential
    val cisspCredential = TrustWeave.issueCredential(
        issuerDid = isc2Did.value,
        issuerKeyId = isc2KeyId,
        credentialSubject = buildJsonObject {
            put("id", professionalDid.value)
            put("certification", buildJsonObject {
                put("certificationName", "CISSP")
                put("certificationFullName", "Certified Information Systems Security Professional")
                put("certificationBody", "(ISC)²")
                put("certificationNumber", "CISSP-123456")
                put("issueDate", Instant.now().minus(365, ChronoUnit.DAYS).toString())
                put("expirationDate", Instant.now().plus(2, ChronoUnit.YEARS).toString())
                put("validUntil", Instant.now().plus(2, ChronoUnit.YEARS).toString())
                put("status", "Active")
                put("domains", listOf(
                    "Security and Risk Management",
                    "Asset Security",
                    "Security Architecture and Engineering",
                    "Communication and Network Security",
                    "Identity and Access Management",
                    "Security Assessment and Testing",
                    "Security Operations",
                    "Software Development Security"
                ))
                put("continuingEducation", buildJsonObject {
                    put("required", true)
                    put("creditsRequired", 40)
                    put("creditsEarned", 15)
                    put("renewalPeriod", "3 years")
                })
            })
        },
        types = listOf("VerifiableCredential", "CertificationCredential", "SecurityCertification"),
        expirationDate = Instant.now().plus(2, ChronoUnit.YEARS).toString()
    ).getOrThrow()

    println("\n✅ CISSP certification credential issued: ${cisspCredential.id}")

    // Step 4: Issue CEH certification credential
    val cehCredential = TrustWeave.issueCredential(
        issuerDid = ecCouncilDid.value,
        issuerKeyId = ecCouncilKeyId,
        credentialSubject = buildJsonObject {
            put("id", professionalDid.value)
            put("certification", buildJsonObject {
                put("certificationName", "CEH")
                put("certificationFullName", "Certified Ethical Hacker")
                put("certificationBody", "EC-Council")
                put("certificationNumber", "CEH-789012")
                put("issueDate", Instant.now().minus(180, ChronoUnit.DAYS).toString())
                put("expirationDate", Instant.now().plus(3, ChronoUnit.YEARS).toString())
                put("validUntil", Instant.now().plus(3, ChronoUnit.YEARS).toString())
                put("status", "Active")
                put("domains", listOf(
                    "Introduction to Ethical Hacking",
                    "Footprinting and Reconnaissance",
                    "Scanning Networks",
                    "Enumeration",
                    "Vulnerability Analysis",
                    "System Hacking",
                    "Malware Threats",
                    "Sniffing",
                    "Social Engineering",
                    "Denial of Service",
                    "Session Hijacking",
                    "Evading IDS, Firewalls, and Honeypots",
                    "Hacking Web Servers",
                    "Hacking Web Applications",
                    "SQL Injection",
                    "Hacking Wireless Networks",
                    "Hacking Mobile Platforms",
                    "IoT Hacking",
                    "Cloud Computing",
                    "Cryptography"
                ))
            })
        },
        types = listOf("VerifiableCredential", "CertificationCredential", "SecurityCertification"),
        expirationDate = Instant.now().plus(3, ChronoUnit.YEARS).toString()
    ).getOrThrow()

    println("✅ CEH certification credential issued: ${cehCredential.id}")

    // Step 5: Issue Security+ training credential
    val securityPlusTrainingCredential = TrustWeave.issueCredential(
        issuerDid = comptiaDid.value,
        issuerKeyId = comptiaKeyId,
        credentialSubject = buildJsonObject {
            put("id", professionalDid.value)
            put("training", buildJsonObject {
                put("trainingName", "Security+ Training")
                put("trainingProvider", "CompTIA")
                put("completionDate", Instant.now().minus(30, ChronoUnit.DAYS).toString())
                put("hours", 40)
                put("status", "Completed")
                put("domains", listOf(
                    "Threats, Attacks, and Vulnerabilities",
                    "Technologies and Tools",
                    "Architecture and Design",
                    "Identity and Access Management",
                    "Risk Management",
                    "Cryptography and PKI"
                ))
            })
        },
        types = listOf("VerifiableCredential", "TrainingCredential", "SecurityTraining"),
        expirationDate = null // Training credentials don't expire
    ).getOrThrow()

    println("✅ Security+ training credential issued: ${securityPlusTrainingCredential.id}")

    // Step 6: Create professional wallet and store all credentials
    val walletResult = trustWeave.wallet {
        holder(professionalDid.value)
        enableOrganization()
        enablePresentation()
    }
    
    val professionalWallet = when (walletResult) {
        is WalletCreationResult.Success -> walletResult.wallet
        else -> throw IllegalStateException("Failed to create wallet: ${walletResult.reason}")
    }

    val cisspCredentialId = professionalWallet.store(cisspCredential)
    val cehCredentialId = professionalWallet.store(cehCredential)
    val trainingCredentialId = professionalWallet.store(securityPlusTrainingCredential)

    println("\n✅ All credentials stored in wallet")

    // Step 7: Organize credentials by skill and type
    professionalWallet.withOrganization { org ->
        val certificationsCollectionId = org.createCollection("Certifications", "Professional certifications")
        val trainingCollectionId = org.createCollection("Training", "Training completion records")

        org.addToCollection(cisspCredentialId, certificationsCollectionId)
        org.addToCollection(cehCredentialId, certificationsCollectionId)
        org.addToCollection(trainingCredentialId, trainingCollectionId)

        org.tagCredential(cisspCredentialId, setOf("certification", "cissp", "security", "management", "leadership"))
        org.tagCredential(cehCredentialId, setOf("certification", "ceh", "security", "penetration-testing", "ethical-hacking"))
        org.tagCredential(trainingCredentialId, setOf("training", "security-plus", "security", "foundational"))

        println("✅ Credentials organized by type and skill")
    }

    // Step 8: Employer verification - CISSP required
    println("\n🏢 Employer Verification - CISSP Required:")

    val cisspVerification = TrustWeave.verifyCredential(cisspCredential).getOrThrow()

    if (cisspVerification.valid) {
        val credentialSubject = cisspCredential.credentialSubject
        val certification = credentialSubject.jsonObject["certification"]?.jsonObject
        val certificationName = certification?.get("certificationName")?.jsonPrimitive?.content
        val status = certification?.get("status")?.jsonPrimitive?.content
        val expirationDate = certification?.get("expirationDate")?.jsonPrimitive?.content

        println("✅ Certification Credential: VALID")
        println("   Certification: $certificationName")
        println("   Status: $status")
        println("   Expiration: $expirationDate")

        if (certificationName == "CISSP" && status == "Active") {
            println("✅ CISSP requirement MET")
            println("✅ Certification is active")
            println("✅ Qualification VERIFIED")
        } else {
            println("❌ CISSP requirement NOT MET")
            println("❌ Qualification NOT VERIFIED")
        }
    } else {
        println("❌ Certification Credential: INVALID")
        println("❌ Qualification NOT VERIFIED")
    }

    // Step 9: Employer verification - Multiple certifications
    println("\n🏢 Employer Verification - Multiple Certifications Required:")

    val cisspValid = TrustWeave.verifyCredential(cisspCredential).getOrThrow().valid
    val cehValid = TrustWeave.verifyCredential(cehCredential).getOrThrow().valid

    if (cisspValid && cehValid) {
        println("✅ CISSP Certification: VALID")
        println("✅ CEH Certification: VALID")
        println("✅ Multiple certification requirement MET")
        println("✅ Professional has both CISSP and CEH")
        println("✅ Qualification VERIFIED")
    } else {
        println("❌ One or more certifications invalid")
        println("❌ Qualification NOT VERIFIED")
    }

    // Step 10: Expired certification check
    println("\n🏢 Expired Certification Check:")

    // Create an expired certification
    val expiredCertCredential = TrustWeave.issueCredential(
        issuerDid = isc2Did.value,
        issuerKeyId = isc2KeyId,
        credentialSubject = buildJsonObject {
            put("id", professionalDid.value)
            put("certification", buildJsonObject {
                put("certificationName", "CISSP")
                put("status", "Expired")
                put("expirationDate", Instant.now().minus(30, ChronoUnit.DAYS).toString())
            })
        },
        types = listOf("VerifiableCredential", "CertificationCredential", "SecurityCertification"),
        expirationDate = Instant.now().minus(30, ChronoUnit.DAYS).toString() // Already expired
    ).getOrThrow()

    val expiredVerification = TrustWeave.verifyCredential(
        expiredCertCredential,
        options = CredentialVerificationOptions(checkExpiration = true)
    ).getOrThrow()

    if (!expiredVerification.valid) {
        println("❌ Expired Certification: INVALID")
        println("   Certification expired: YES")
        println("   Status: Expired")
        println("❌ Qualification NOT VERIFIED")
        println("   Note: Professional must renew certification")
    }

    // Step 11: Create privacy-preserving certification presentation
    val certificationPresentation = professionalWallet.withPresentation { pres ->
        pres.createPresentation(
            credentialIds = listOf(cisspCredentialId, cehCredentialId), // Only share certifications
            holderDid = professionalDid,
            options = PresentationOptions(
                holderDid = professionalDid,
                challenge = "certification-verification-${System.currentTimeMillis()}"
            )
        )
    } ?: error("Presentation capability not available")

    println("\n✅ Privacy-preserving certification presentation created")
    println("   Holder: ${certificationPresentation.holder}")
    println("   Credentials: ${certificationPresentation.verifiableCredential.size}")
    println("   Note: Only certifications shared, no personal details")

    // Step 12: Demonstrate privacy - verify no personal information is exposed
    println("\n🔒 Privacy Verification:")
    val presentationCredential = certificationPresentation.verifiableCredential.firstOrNull()
    if (presentationCredential != null) {
        val subject = presentationCredential.credentialSubject
        val hasFullName = subject.jsonObject.containsKey("fullName")
        val hasEmail = subject.jsonObject.containsKey("email")
        val hasSSN = subject.jsonObject.containsKey("ssn")
        val hasCertification = subject.jsonObject.containsKey("certification")

        println("   Full Name exposed: $hasFullName ❌")
        println("   Email exposed: $hasEmail ❌")
        println("   SSN exposed: $hasSSN ❌")
        println("   Certification details: $hasCertification ✅")
        println("✅ Privacy preserved - only certification information shared")
    }

    // Step 13: Display wallet statistics
    val stats = professionalWallet.getStatistics()
    println("\n📊 Professional Wallet Statistics:")
    println("   Total credentials: ${stats.totalCredentials}")
    println("   Valid credentials: ${stats.validCredentials}")
    println("   Collections: ${stats.collectionsCount}")
    println("   Tags: ${stats.tagsCount}")

    // Step 14: Summary
    println("\n" + "=".repeat(70))
    println("✅ SECURITY TRAINING & CERTIFICATION VERIFICATION SYSTEM COMPLETE")
    println("   Training and certification credentials issued and stored")
    println("   Instant verification implemented")
    println("   Privacy-preserving verification implemented")
    println("   Expiration tracking enabled")
    println("   No personal information exposed")
    println("=".repeat(70))
}

Expected Output:

======================================================================
Security Training & Certification Verification Scenario - Complete End-to-End Example
======================================================================

✅ TrustWeave initialized
✅ (ISC)² DID: did:key:z6Mk...
✅ EC-Council DID: did:key:z6Mk...
✅ CompTIA DID: did:key:z6Mk...
✅ Professional DID: did:key:z6Mk...
✅ Employer DID: did:key:z6Mk...

✅ CISSP certification credential issued: urn:uuid:...
✅ CEH certification credential issued: urn:uuid:...
✅ Security+ training credential issued: urn:uuid:...

✅ All credentials stored in wallet
✅ Credentials organized by type and skill

🏢 Employer Verification - CISSP Required:
✅ Certification Credential: VALID
   Certification: CISSP
   Status: Active
   Expiration: 2026-11-18T...
✅ CISSP requirement MET
✅ Certification is active
✅ Qualification VERIFIED

🏢 Employer Verification - Multiple Certifications Required:
✅ CISSP Certification: VALID
✅ CEH Certification: VALID
✅ Multiple certification requirement MET
✅ Professional has both CISSP and CEH
✅ Qualification VERIFIED

🏢 Expired Certification Check:
❌ Expired Certification: INVALID
   Certification expired: YES
   Status: Expired
❌ Qualification NOT VERIFIED
   Note: Professional must renew certification

✅ Privacy-preserving certification presentation created
   Holder: did:key:z6Mk...
   Credentials: 2

🔒 Privacy Verification:
   Full Name exposed: false ❌
   Email exposed: false ❌
   SSN exposed: false ❌
   Certification details: true ✅
✅ Privacy preserved - only certification information shared

📊 Professional Wallet Statistics:
   Total credentials: 3
   Valid credentials: 3
   Collections: 2
   Tags: 9

======================================================================
✅ SECURITY TRAINING & CERTIFICATION VERIFICATION SYSTEM COMPLETE
   Training and certification credentials issued and stored
   Instant verification implemented
   Privacy-preserving verification implemented
   Expiration tracking enabled
   No personal information exposed
======================================================================

Key Features Demonstrated

Multi-Certification Support: Support multiple certifications (CISSP, CEH, Security+)
Training Credentials: Support training completion records
Expiration Tracking: Track certification expiration
Privacy-Preserving: Only certification details shared, not personal information
Selective Disclosure: Share only relevant certifications
Instant Verification: Verify certifications instantly without manual checks

Real-World Extensions

Continuing Education: Track continuing education credits
Certification Renewal: Automated certification renewal workflows
Skill-Based Matching: Match certifications to job requirements
Certification Chains: Support certification prerequisites
Revocation: Revoke compromised certifications
Blockchain Anchoring: Anchor certifications for permanent records
Multi-Provider: Support certifications from multiple providers

Quick Start - Get started with TrustWeave
Employee Onboarding Scenario - Related onboarding scenario
Common Patterns - Reusable code patterns
API Reference - Complete API documentation
Troubleshooting - Common issues and solutions