Decoupling of Credentials from DDO Metadata (Off-Chain Secret Store)

[MBadea17]

This feature alters the current Ocean Node and Provider architecture to stop storing encryptedFiles (which contain dataset URLs and credentials) directly within the DDO (DID Document) on IPFS or the blockchain.

Instead, Ocean Nodes will store these credentials strictly in a local, non-public database or secure vault (e.g., HashiCorp Vault or local encrypted SQLite) accessible only to the Node operator. The public DDO will reference the service endpoint but will no longer contain the encrypted credential blob, preventing public replication of the secret material.

[MBadea17]

Proposal:

• no secrets in the DDO
• node automatically matches asset.service to endpoint URI
• node stores asset.service - endpoint URI in a secured, separate database.
• node exposes a new endpoint to store a URI for a specific asset.service
• node handles data download for this new file type/flow