Application of Public Ledgers to Revocation in Distributed Access Control

Abstract

There has recently been a flood of interest in potential new applications of blockchains, as well as proposals for more generic designs called public ledgers. Most of the novel proposals have been in the financial sector. However, the public ledger is an abstraction that solves several of the fundamental problems in the design of secure distributed systems: global time in the form of a strict linear order of past events, globally consistent and immutable view of the history, and enforcement of some application-specific safety properties. This paper investigates the applications of public ledgers to access control and, more specifically, to group management in distributed systems where entities are represented by their public keys and authorization is encoded into signed certificates. It is particularly difficult to handle negative information, such as revocation of certificates or group membership, in the distributed setting. The linear order of events and global consistency simplify these problems, but the enforcement of internal constraints in the ledger implementation often presents problems. We show that different types of revocation require slightly different properties from the ledger. We compare the requirements with Bitcoin, the best known blockchain, and describe an efficient ledger design for membership revocation that combines ideas from blockchains and from web-PKI monitoring. While we use certificate-based groupmembership management as the case study, the same ideas can be applied more widely to rights revocation in distributed systems.

Key Exchange with the Help of a Public Ledger

“…The recent widely known compromises of popular service providers [2, 3,4] and government surveillances [16,18,28] have motivated quite a few proposals for public ledgers that have no centralized management. These public ledgers are basically public logs of events with the following properties [12]: immutability and global consistency of the event history, inclusiveness in the sense that all valid data is included. The ledgers might also define a linear order or have some built-in concept of time on all data entries.…”

“…Enhanced Certificate Transparency [33] extends CT to handle certificate revocation and shows how this extension can be used in end-to-end email or messaging systems. Bui et al [12] apply public ledgers to group management in distributed systems where entities are represented by their public keys and authorization is in the form of signed certificates.…”

Algorithmic Analysis of Blockchain Efficiency with Communication Delay

“…It was invented to serve as the public transaction ledger of the cryptocurrency Bitcoin in 2008 [13], in which the need for a trusted third party is avoided: instead, this digital currency is based on the concept of 'proof of work' allowing users to execute payments by digitally signing their transactions using hashes through a distributed time-stamping service [15]. Because of its resistance to modifications, decentralized consensus, and proved robustness for supporting cryptocurrency transactions, this technology is seen to have great potential for new uses in other domains, including financial services [7,17], distributed data models [3], markets [16], government systems [9,14], healthcare [8,1,11], IoT [10], and video games [12]. As the blockchain technology matures, it is expected to change economics, business, and society [2] in the years to come.…”