Secure Identity Management on the Blockchain
Total Page:16
File Type:pdf, Size:1020Kb
Eötvös Loránd University Faculty of Informatics SECURE IDENTITY MANAGEMENT ON THE BLOCKCHAIN Adám Nágy Kwadjo Anobaah Nyante Assistant Professor at ELTE Msc. Security & Privacy Advanced Cryptography Andreas Peter Assistant Professor / Study Coordi- nator – Cyber Security & Safety at University Of Twente Zoltán Hattyasy Senior PM & Architect Mission Critical Systems at E-GROUP Budapest, 2018. Summary One major topical issue that has generated a lot of controversy in the cyber security land- scape is Secure Identity Management. So serious is this issue that many educationists and academicians have expressed varying concerns, proposals, and solutions about the subject. Traditional Identity Management solutions delegate trusted centralized organizations / multiple centralized agencies (service providers) and task them with securely storing the private data of users and providing these users with identity tokens such as ID cards, cer- tificates, login credentials, hardware, and passports. With these identity tokens, users can uniquely access resources and services from the respective service providers. This approach has resulted in four main classes of problems namely: Individual user problems, Infor- mation Sharing problems, Governmental information coordination problems, and Privacy problems. These problems are particular conspicuous in the banking sector when it comes to Know- Your-Customer Processes (KYC). It is expensive and time consuming to do the necessary background checks on customers and their transactions for compliance agencies. At the same time, these background checks have create severe privacy issues that need to be ad- dressed. In this research, Distributed Ledger Technologies (blockchain) are used to solve these major problems. A hybrid solution is proposed, which is a combination of: 1. A blockchain Gateway Solution, which supports legal compliance and traditional Identity Management features that require strong authentication. This solution serves as a trust anchor that securely links Identity Data to the blockchain and is based on research of the EU’s Identity Network eIDAS.1 2. A general blockchain Identity Framework, which serves as the fabric for maintaining, verifying and performing transactions using decentralized identities. Together these two solutions provide a regulatable pseudonymous identity framework that can be used to solve various real world problems. Generalized formal definitions for an 1eIDAS is responsible for providing electronic Identification assurance for digital services provided within the EU and its member states i Identity Management Scheme, Self-Sovereign Identity Management Scheme, Claims,Trust, as well as the necessary supporting cryptographic proofs have also been proposed to serve as the foundation for both solutions. In the same light, 3 broad configurations have been proposed to govern and generalize how identity and trust are conceptualized. Identity Management Systems in general come with trade-offs between legal compliance (usability) and security and user privacy (anonymity). Conventional digital applications provide high legal compliance due to the control by service providers. These come at the cost of lower user privacy and security. Conversely, Distributed Ledger Technologies (blockchain) provide high anonymity / privacy and security at the cost of legal compliance and usability. Consequently, it is crystal clear that, on one end of the spectrum, conventional Iden- tity Management Systems could greatly benefit from extending their use cases to the blockchain. On the other end of the spectrum, blockchain provides high security and pri- vacy/anonymity, however, in some cases where strong authentication is required, it is also beneficial to extend the blockchain to the real world. Therefore, this research explores the thin line between the blockchain (Decentralized) and conventional (Centralized) Identity Management Systems and attempts to establish a mid- dle ground between these two fields, thus generating trust on the blockchain with decentral- ized identities. This middle ground constitutes a technological advancement in both fields (blockchain and Identity Management Systems), and provides the foundation for achieving the delicate balance between security, privacy, and legal compliance (example GDPR). ii Acknowledgement The dream to change the world, especially cyber space, by making it a better and safer place is one that has been shared by most if not all people in the Information Technology discipline. It gives me great joy to say that my master thesis has brought me one step closer to achieving this dream. With my deepest and sincerest gratitude to God for blessing me with vision and strength to see this through, I also say a very big “thank you” to my supervisors: Ádám Nagy, Assistant Professor at Eötvös Loránd University (ELTE – IK), Andreas Peter, Professor at the University of Twente(SCS) and Zoltán Hattyasy, Senior PM & Architect (Mission Critical Systems) at E-GROUP, Budapest(Hungary). Without their clear and continuous guidance, this research would have been a far cry from a complete success. My appreciation also goes to the various coordinators of this program, EIT Digital, and all the hardworking men and women there who toil day by day to make things like this possi- ble, the warm staff at E-GROUP and the Center for Cyber Safety and Education in Florida. Last but definitely not least, I say ”I appreciate it” to my family, friends and especially to my amazing and supportive partner Masha Bekjkovikj, who have all kept me grounded and focused during this period. To all of you and everyone that supported directly or indirectly, it should be known that I couldn’t have done it without you. It is my sincere hope that this research and its results go a long way to make the entire cyber space safer and more secure while simultaneously guarding the privacy of individual users and organizations. iii TABLE OF CONTENTS Table of Contents 1 Introduction 1 1.1 Target Group . .2 1.2 Personal motivation . .3 1.3 Research method . .3 1.4 Structure of this report . .4 2 Related literature and theoretical focus 6 2.1 Stakeholders in Digital Identity Management . .6 2.1.1 Ideal world vs Real world . .8 2.1.2 Collusion amongst Stakeholders . .9 2.1.3 General Problems in Digital Identity Management . 10 2.2 Evolution of Digital Identity Management . 14 2.2.1 What is a digital Identity? . 14 2.2.2 The many Clones problem . 15 2.2.3 Centralized Identity . 19 2.2.4 Federated Identity . 20 2.2.5 User-Centric Identity . 20 2.2.6 Self Sovereign Identity . 21 2.2.7 Principles of Self-Sovereign Identity . 23 2.3 The BlockChain . 23 2.3.1 Timeline of BlockChain . 24 2.3.2 State and History . 26 2.3.3 Layered View of the BlockChain . 26 2.3.4 Consensus (POW vs POS) . 29 2.3.5 BlockChain Generations . 31 2.4 Why Identity Management Matches Blockchain . 33 2.5 GDPR vs Blockchain . 33 2.6 What makes this research new? . 34 3 The problem 35 3.1 What is the need? . 35 3.2 Who feels this problem the most? . 35 3.3 How will a solution be used? . 36 iv TABLE OF CONTENTS 4 Methodology 38 4.1 Available methods . 38 4.2 Chosen method and Process Report . 39 4.2.1 Preparation phase . 39 4.2.2 Design phase . 40 4.2.3 Expert verification phase . 40 4.2.4 Cryptographic verification phase . 40 4.3 Actors, Activities and Activity Diagram . 40 4.3.1 Actors . 40 4.3.2 Activities . 41 4.3.3 Activity Diagram . 41 5 Results 43 5.1 Formal Definitions of Identity Management . 43 5.1.1 Subject Data . 43 5.1.2 Claim . 44 5.1.3 Strong Claim vs Weak Claim . 45 5.1.4 Trust and Digital Identity . 46 5.1.5 Transforming weak claim into strong claim . 47 5.1.6 Identity Management System . 48 5.2 Configurations of Identity Management Systems . 49 5.2.1 Claim Generation . 50 5.2.2 Claim Storage . 50 5.2.3 Claim Verification and Signature Verification Paradox . 50 5.2.4 Comparison of different Identity Management Systems . 52 5.2.5 Self-Sovereign Identity Management System . 53 5.3 Formal Security Requirements of a Self-Sovereign Identity Management Sys- tem ........................................ 54 5.3.1 Transformation Oracle Security . 54 5.3.2 Verification Oracle Security . 55 5.4 Blockchain Gateway . 56 5.4.1 Off-chain presence . 57 5.4.2 On-chain presence . 58 5.5 BlockChain Identity Framework . 60 5.6 Discussion . 62 5.6.1 Advantages of the design . 63 5.6.2 Potential Disadvantages . 63 5.7 Answering Research Questions . 64 5.7.1 How do we securely store, update and retrieve trusted identity data from the blockchain? . 64 5.7.2 What are the minimum security requirements needed to enforce se- cure granular data management on the blockchain? . 65 5.7.3 To what extent is the chosen method in 1 above scalable? . 66 v TABLE OF CONTENTS 5.7.4 Are there any other use cases for such a solution in 1 above? . 67 5.7.5 How do we achieve compliance in use cases that require strong au- thentication (Example Governmental level, Banking)? . 67 6 Conclusion 69 6.1 Comparison with literature . 70 6.2 Future Development . 72 vi TABLE OF FIGURES Table of Figures 2.1 Stakeholders of identity management and their goals . .8 2.2 Incentive alignment diagram . .8 2.3 Physical vs Virtual Identities . 11 2.4 The many clones problem . 15 2.5 Blockchain . 26 4.1 Activity diagram showing a single phase of the research . 42 5.1 Unclaimed pool . 44 5.2 Claimed pool . 45 5.3 Transforming weak claims into strong claims . 47 5.4 Chained claims . 48 5.5 Blockchain gateway . 57 5.6 Blockchain framework . 60 vii LIST OF TABLES List of Tables 2.1 Heat map showing probability of collusion between Stakeholders . .9 2.2 Advantages and disadvantages of each solution . 18 2.3 Differences between Bitcoin POW and EthHash .