Who Am I? Secure Identity Registration on Distributed Ledgers

Abstract

Bitcoin is a decentralized cryptocurrency that uses a ledger (or "blockchain") to keep track of the transactions made between its users. Because it is a fully decentralized system and anyone can join, every transaction is by necessity public. Thus, to preserve some semblance of privacy, users in the system are represented not by their real-world identities but by pseudonyms. While pseudonyms are acceptable for a standalone cryptocurrency, the emergence of other potential blockchainbased applications -e.g., using them to administer benefits and pensions -poses a need to associate certain attributes with the users of the system. In this paper, we address the question of how to register identities and attributes in a system built on globally visible ledgers. We propose a variety of possible solutions and in each case, we analyze the tradeoff our solution provides between privacy (ensuring that no one can associate the user's real-world identity with the pseudonym or other attributes they use on the ledger), usability (ensuring that verification of their attributes poses the lowest possible burden to users), and integrity (ensuring that no one can impersonate a user). We also present an implementation of one of our solution using Ethereum.

A Taxonomic Approach to Understanding Emerging Blockchain Identity Management Systems

“…Another example of this approach is smart contract-based PKI (SCPKI) [51], which stores all identifiers and credentials on a single smart contract and allows relying parties to use a web-of-trust to decide whether or not an identifier is authorized to perform some action. SCPKI can also be extended with blind signatures in order to provide privacy [52].…”

Identity Management Systems for the Internet of Things: A Survey Towards Blockchain Solutions

“…Moreover, they used authentication services provided by their identity solution to build a more secure messaging application. Azouvi et al [57] also proposed a privacy preserving identity solution using blind signatures. They set up a threat model, performed a security analysis and implemented their solution in Ethereum.…”

Access Control for Binary Integrity Protection using Ethereum

“…Meanwhile, IDM Contracts are only deployed once per authorised party, unless preexisting contracts can be used, and they can be reused for more than one SW or BHS Contract. 3 https://etherscan.io Let us take for example an individual assuming both the roles of Maintainer and Developer of three distinct software projects, each with monthly updates released to two different SDPs. The one-time setup costs in this scenario would consist of deploying one IDM Contract, three SW Contracts, and six BHS Contracts, so $ 13.335 in total.…”

“…Both Software Developers and Maintainers create Identity Management Contracts and store references to them in their respective other contracts. It is important to point out that identity management on Blockchains is an area of research in itself with many different approaches[1,3,6] that could serve as replacements for IDM Contracts.…”