VaultPoint: A Blockchain-Based SSI Model that Complies with OAuth 2.0

Abstract

An identity management including authentication and authorization in a network environment is a critical security factor. Various models for identity management have been developed continually, from the silo model to the federated model and to the recently introduced self-sovereign identity (SSI) model. In particular, SSI makes users manage their own information by themselves independently of any organizations. SSI utilizes the newly emerged blockchain technology and many studies of it are in progress. However, SSI has not had wide public use because of its low compatibility and inconvenience. This is because it involves an unfamiliar user experience and an immature process. To solve this problem, this paper proposes a new blockchain-based SSI model that complies with the popular and mature standard of OAuth 2.0. Using blockchain, the proposed model secures users’ data sovereignty where users can use and control their own information in a decentralized manner, instead of depending on a specific monopolistic service-providers. Users and clients who are familiar with the existing OAuth can easily accept the proposed model and apply it, which makes both usability and scalability of the model excellent. This paper confirmed the feasibility of the proposed model by implementing it and a security analysis was performed. The proposed model is expected to contribute to the expansion of both blockchain technology and SSI.

Self-Sovereign Identity: A Systematic Review, Mapping and Taxonomy

“…Another trend of research in SSI is to provide protocol integration with production-level standards. This was presented as the driving problem of [53,58,93], but it was also developed in the aforementioned work of Schanzenbach et al [116]. Both [53] and [93] aim to integrate SSI with the OpenID Connect protocol [111], an identity layer that provides authentication on top of OAuth 2.0, the de facto industry-standard protocol for authorization [57].…”

“…Application-level authorization is implemented in [93] with claims, which the user must present. Differently, the authors of [58] implemented authorization through OAuth 2.0, which facilitates integration with existing web services. However, unlike [53,93], authentication in [58] uses a custom mechanism instead of OpenID Connect.…”

Self-Sovereign Identity: A Systematic Review, Mapping and Taxonomy

“…Failure to successfully address this challenge may jeopardize the adoption of SSI, as billions of users have electronic identities in IdPs that can only communicate using the aforementioned protocols. This challenge was presented as the driving problem in seven research papers [ 99 , 100 , 101 , 102 , 103 , 104 , 106 ] and was also mentioned in four other works [ 105 , 107 , 108 , 109 ]. Three articles aim to integrate SSI with OpenID Connect [ 99 , 101 , 102 ], two works focus on OAuth 2.0 [ 103 , 106 ], one focuses on SAML [ 104 ], and one paper focuses on these three protocols [ 100 ].…”

“…This challenge was presented as the driving problem in seven research papers [ 99 , 100 , 101 , 102 , 103 , 104 , 106 ] and was also mentioned in four other works [ 105 , 107 , 108 , 109 ]. Three articles aim to integrate SSI with OpenID Connect [ 99 , 101 , 102 ], two works focus on OAuth 2.0 [ 103 , 106 ], one focuses on SAML [ 104 ], and one paper focuses on these three protocols [ 100 ].…”

“…Hong et al [ 106 ] used OAuth 2.0 for authorization, making it easier to integrate their solution with existing web services. In contrast to [ 99 , 102 ] authentication in [ 106 ] uses a custom mechanism rather than OpenID Connect.…”