See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/328919940

Blockchain Technology the Identity Management and Authentication Service

Disruptor: A Survey

Article in International Journal on Advanced Science Engineering and Information Technology · September 2018
DOI: 10.18517/ijaseit.8.4-2.6838

CITATIONS READS

151 16,240

7 authors, including:

Shu Yun Lim Pascal Tankam Fotsing

Unitar International University Université du Québec à Montréal
18 PUBLICATIONS 329 CITATIONS 4 PUBLICATIONS 161 CITATIONS

SEE PROFILE SEE PROFILE

Abdullah Almasri Omar Musa

Universiti Kebangsaan Malaysia Asia e University AeU
9 PUBLICATIONS 212 CITATIONS 10 PUBLICATIONS 249 CITATIONS

SEE PROFILE SEE PROFILE

All content following this page was uploaded by Reza Ismail on 10 December 2018.

The user has requested enhancement of the downloaded file.

 Vol.8 (2018) No. 4-2
ISSN: 2088-5334

Blockchain Technology the Identity Management and Authentication

Service Disruptor: A Survey
Shu Yun Lim1, Pascal Tankam Fotsing1, Abdullah Almasri1, Omar Musa1, Miss Laiha Mat Kiah2,
Tan Fong Ang2, Reza Ismail3
1
Faculty of Business and Technology, Unitar International University, 3-01A, Level 2, Tierra Crest, Jalan SS6/3, Kelana Jaya, 47301
Petaling Jaya, Selangor, Malaysia
E-mail: [email protected], [email protected], [email protected], [email protected]

2
Faculty of Computer Science & Information Technology, University of Malaya, 50603 Kuala Lumpur, Malaysia
Email: [email protected], [email protected]
3
SysCode Sdn Bhd, D-13A-02, Menara SuezCap 1, KL Gateway, No.2, Jln Kerinchi, Gerbang Kerinchi Lestari, 59200
Kuala Lumpur, Malaysia
E-mail: [email protected]

Abstract— The Internet today lacks an identity protocol for identifying people and organizations. As a result, service providers
needed to build and maintain their own databases of user information. This solution is costly to the service providers, inefficient as
much of the information is duplicated across different providers, difficult to secure as evidenced by recent large-scale personal data
breaches around the world, and cumbersome to the users who need to remember different sets of credentials for different services.
Furthermore, personal information could be collected for data mining, profiling and exploitation without users' knowledge or
consent. The ideal solution would be self-sovereign identity, a new form of identity management that is owned and controlled entirely
by each individual user. This solution would include the individual's consolidated digital identity as well as their set of verified
attributes that have been cryptographically signed by various trusted issuers. The individual provides proof of identity and
membership by sharing relevant parts of their identity with the service providers. Consent for access may also be revoked hence
giving the individual full control over its own data. This survey critically investigates different blockchain based identity management
and authentication frameworks. A summary of the state-of-the-art blockchain based identity management and authentication
solutions from year 2014 to 2018 is presented. The paper concludes with the open issues, main challenges and directions highlighted
for future work in this area. In a nutshell, the discovery of this new mechanism disrupted the existing identity management and
authentication solutions and by providing a more promising secure platform.

Keywords— blockchain; authentication; identity management; distributed ledger technology; ethereum; hyperledger.

Authentication as a process of determining whether

I. INTRODUCTION
someone or something is, in fact, who or what it is declaring
We all heard about Bitcoin [1], Ether [2] and other to be, is the key component of any trustworthy online system
cryptocurrencies, which enables people to anonymously which handles sensitive data or transactions. Whether these
perform secure and trustworthy payments and transactions. systems are Internet of Things (IoT), industrial Internet,
In the heart of those cryptocurrencies there is a blockchain social networking or payment gateway system, the main
[3]; a decentralized database which records all transactions aspect of those systems is the authentication process. The
since their beginning. The entire network as opposed to a process of authentication is very visible to users. It directly
central entity such as a bank or government is continuously influences their perception of trust. An ideal authentication
verifying the integrity of it. This way, users do not have to process should be efficient, reliable and able to verify data
trust a central entity, but security is guaranteed by the credentials while protecting user’s privacy.
strength and computing power of the entire network The identification ecosystem of the past decades is
participating in the blockchain. complex and full of middlemen. Service providers have
invested billions in system and infrastructure to be compliant

1735
with data security regulations. As of today, they are still underestimated technologies of the time. In section II, the
facing challenges in managing user’s identity, authenticating background of identity management and authentication
and authorizing users. Every day online users are tasked with mechanism is explained. Blockchain technology and a
providing identity, entering credentials for online and cloud comparative review between Ethereum and Hyperledger
services that they access. These has generated huge volumes blockchain is discussed in section III. An overview of related
of user data with service providers and user private data is research works is presented in section IV. Section V and VI
stored and left to the discretion of service providers [4] [5]. concluded the paper with open issues, main challenges and
Last year in Malaysia, there was a massive data leak directions of the future blockchain and distributed ledger
involving 46.2 million mobile users [6]. Early this year, technology.
personal details of over 220,000 organ donors and their next-
of-kin had been leaked through government official A. Overview of Identity Management
databases in Malaysia. Their personal details, identity card Identity management refers to broad administrative area
numbers, addresses and mobile phone numbers may have and standards that create, maintain and the de-provision of
fallen into the wrong hands [7]. user account. Sound identity management and governance
Users who subscribed to multiple online services will are needed to manage identities for online services. Identity
have to store passwords in all the servers for authentication management is required to simplify the user provisioning
and hence authentication data are replicated and withheld in process. Enabling new users to get access to online services
multiple servers. These redundant actions of exchanging and de-provisioning users to ensure that only the rightful
authenticating data may lead to an exploit of the users have access to services and data.
authentication mechanism. These vulnerabilities have caused
1) Independent IDM
user to suffer from identify theft and data breaches. This
server-centric identity management model has deficiencies. Majority of Internet identities are centralised [12]. The
From the service providers standpoint, managing and user credentials are owned and managed by a single entity.
authenticating users is becoming inevitably complicated. But these independent identity repository model has
Passwords and personal identity information is traditionally deficiencies. Users do not own their identity record and it
stored in a centralized server which makes it possible for can be revoked or misused by the identity provider.
hackers to achieve their malicious goals by stealing, 2) Federated IDM
misusing or manipulating these data. Therefore, service
Federated identity management systems [9] [13] can
providers are required to create stronger mechanisms, by
provide authentication and authorization capabilities across
adding multiple factors authentication for access and
organizational and system boundaries. It requires agreements
stronger encryption, which further complicates the system
that an identity at one provider is recognized by other
[8].
providers and contractual agreements on data ownership.
Besides server-centric identity management, federated
User account is managed independently by identity provider
identity management [9] is adopted currently where
and no enterprise directory integration is required. This
organizations allow users to use the same single identity on
lower the security risk as credential are not replicated but
different online services. This comes in the form of single
propagated on demand. This approach is relatively more
sign on or Facebook Login, Google ID etc. Although
complex to implement and requires proper agreement and
identity federation gives a degree of portability to a
trust relationship between online services.
centralised identity, but the power remains with the identity
provider. The impact of federated identity on user privacy is 3) Self-sovereign IDM
more profound. Identity providers have access to the Self-sovereign identity is the concept that users should be
information stored by subscribers for authentication purpose able to control their own digital identity. People and
and this presents a privacy issue. It is difficult for users to businesses can store their own identity data on their own
make sure the proper Service Level Agreement (SLA) rules devices and provide their identity to those who need to
are enforced since there is a lack of transparency that allows validate it, without relying on a central repository of identity
the users to monitor their own information. This can be seen data. Since it is independent from any individual silo, it
in recent Facebook and Cambridge Data Analytica dispute gives user full control, security and full portability of their
over alleged harvesting and use of personal data [10]. data. Sovrin foundation [14] describes self-sovereign
Know-Your-Customer (KYC) compliance obligations for identity as an Internet for identity where no one owns it,
financial institutions are costly and time-consuming. Global everyone can use it, anyone can improve it.
financial institutions are burdened by the need to both collect
and protect data at the same time. The current personal data B. Overview of authentication process
ecosystem is archaic, fragmented and inefficient hence a The establishment of a secure channel permits to
new authentication and identity management framework is exchange sensitive data providing trustworthy,
needed. Self-sovereign identity management [11] and a confidentiality and integrity service on the exchanged data.
decentralized solution with Distributed Ledger Technology To provide these services, companies will setup an
(DLT) is required to address these challenges. The authentication process based on user registration data. Those
blockchain and DLT is undeniably an ingenious invention data will be stored in a server either locally or remotely and
for nowadays Internet systems, since many people including to be used whenever they need to identify user. To overcome
developers do not understand what the technology is about, the issue of identification, companies developed many types
the blockchain technology remains one of the most of authentication mechanism based on either something you

1736
know (such as password) or something you have (such as rather effective for closed communities such as enterprise
smart card) or something you are (such as a user profiling, cloud, these methods are too costly, inconvenient, and
fingerprint or other biometric method). logistically difficult especially for the distribution,
administration, management and support in the cloud.
1) Password authentication
Password authentication is simple and easy to use, but it 5) Implicit authentication
must have a certain level of complication and regular This approach uses observations of user behaviour for
renewal to keep the security. It is an authentication authentication and it is well suited for mobile devices since
technology with well-known weaknesses in the sense that they can collect a rich set of users’ information, such as
even if the correct username and password combination is location, motion, communication, and their usage of
provided; it is still difficult to prove that the request is from applications. A number of profiling techniques have been
the rightful owner and subjected to shoulder surfing attack studied to provide a suitable service for user and personal
[15]. Users frequently reuse their passwords when profile information in mobile cloud environment [25] [26]
authenticating to various online services. In view of the [27]. But to date, a formal model of this approach has yet to
weak password practices, this brings high security risks to be provided and limited device resources are the technical
the user account information. Nonetheless password constraints to overcome. Studies on intelligent mobile
authentication is still the most frequently used authentication authentication service are still inadequate.
technology with more than 90% of transactions [16].
6) Blockchain authentication
2) Trusted Platform Module based authentication The immutable blockchain ledger verifies and ensures that
Trusted Platform Module (TPM) is a hardware-based the users, transactions, messages are legitimate. Blockchain
security module that uses secure crypto processor that can authentication [28] is done by smart contracts which are
store cryptographic keys that protect information. A variant written and deployed to blockchain. A smart contract
of it is, Mobile Trusted Module (MTM) [17] is a proposed generator can be programmed through a Smart Contract
standard by Trusted Computing Group a consortium (TCG) Authentication (SCA) layer to activate and execute every
founded by AMD, Hewlett-Packard, IBM, Intel, Microsoft. time an authentication is required by either party and self-
It is mainly applied to authenticate terminals from govern itself within a predefined scope of actions. The need
telecommunications. However, it is being considered as a for a third party to authenticate transactions is eliminated.
online authentication method with Subscriber Identity Costs can be reduced while security and privacy are greatly
Module (SIM) due to the generalization of smartphones. enhanced. Effort of hijacking the authentication process
User devices can utilise unique hardcoded keys to perform would be much greater in the distributed environment.
software authentication, encryption, and decryption.
II. MATERIAL AND METHOD
3) Trusted Third Party authentication
Employing Trusted Third Party (TTP) services within the This section highlights some basic concept of what a
cloud leads to the establishment of the necessary trust level blockchain is and why it can be the best alternative to
and provides ideal solutions to preserve the confidentiality, manage our data credentials and authentication process.
integrity and authenticity of data and communication. PKI A. The Block
(Public key infrastructure) team up with TTP provides
A block is referring to files where data pertaining to
technically sound and legally acceptable means to
blockchain network is permanently stored. A block is like
implement strong authentication and authorization. PKI is an
pages of a ledger or an account book. Each time a block is
authentication means using public-key cryptography. It
completed, it gives way to other block. Data stored in blocks
enables users to authenticate the other party based on the
cannot be altered. The genesis block, genesis.Json, is the
certificate without shared secret information. One example
first block of a blockchain.
of TTP authentication in cloud is Single-Sign-On (SSO) [18].
When a user gets authentication from a site, it can go
through to other sites with assertion and no authentication
process is required. However, the existence of a trusted third
party as an authentication server or certification authority is
becoming security and fault intolerance bottlenecks for the
system.
4) Multifactor authentication Fig. 1 Structured connections of Blockchain’s blocks [1]
Multi-factor authentication [8] [19] [20] [21] ensures that
a user is who they claim to be by combining a few means of
authentication. The more factors used to determine a B. Hashing
person’s identity, the greater the trust of authenticity. ID, Each block contains a record of transaction and is
password, biometrics [22] [23] [24], certificate are used cryptographically hashed. A hash function takes in input
traditionally for single factor authentication. With the value and creates an output value deterministic of the input
emerging of mobile network, second factor authentication value. Every input has a determined output. The process of
takes the form of SMS, e-mail, and telephony OTPs, PUSH applying the hash function to any data is called hashing and
Notifications, and mobile OATH Tokens. Even though it is the output is called the hash value or simply the hash. One

1737
critical characteristic of a secure hash function is that it is With reference to Figure 2, there are six transactions (txA,
only one way. This means that given the hash, it is txB, txC, txD, txE, txF, ) with their hashes (HA, HB, HC,
impossible to determine what the input was. Hashing is HD, HE, and HF) at the base/bottom of the tree.
extensively used with Blockchains. For example, a process Concatenating any two hashes of the transactions together
of hashing public keys derives addresses on a Blockchain. (HA + HB), (HC + HD) and (HE + HF) will give the first
An Ethereum account is computed by hashing a public key leaves of the tree. The next steps will be the hashing of the
with keccak-256. leaves H(HA + HB), H(HC + HD) and H(HE + HF) with the
results HAB, HCD and HEF which will result in new leaves.
C. Blockchain The leaves will continue to concatenate. At the end of the
A blockchain [29] is a chain of blocks of valid process, hashes HABCD and HEFEF will be created. The
transactions. Each block includes the hash to the prior block process will result to a final and unique hash, the root hash
in the blockchain. It uses a peer-to-peer network, which which for this example is hash (HABCD + HEFEF) =
means every node in the network is connected to every other HABCDEFEF called the Merkle root. Merkle root is placed
in the network. After the transaction is verified, it is in the block header mentioned as “hashed list of all
broadcasted to the network and is added to everyone copy of transactions that took place since the last created block”.
the blockchain. “Merkling” the hashes of child nodes in the tree help verify
Advantages of the blockchain technology includes: contents for parents and generally large data structures.
• Immutability: nothing on the blockchain can change. The advantage of utilizing merkle tree data structures is
Any confirmed transaction cannot be altered. that any node in the network can check the historical
• Permanence: A public blockchain will act as a backdrop of many transactions easily, and hence any
public ledger, data will be accessible if the individual is guaranteed that their duplicate of the
blockchain remains active. blockchain is finished and alter-free. Confirmations are
• Removal of intermediaries: The peer-to-peer nature given as a feature of the centre blockchain code and
of the blockchain does away with the need of guarantee that open private keys are substantial, transactions
intermediaries. are being marked effectively and exchanges are legitimate
• Speed: Transactions are much faster than a the distance back to the root.
centrally controlled ledger. 2) Consensus Algorithm
• Security: Neither the node nor anyone else except
For a block to be accepted by the network peers, miners
the sender and the receiver can access the data sent
must complete the proof of work [30], which covers all the
across the blockchain.
data in the block. The difficulty of this work is adjusted as to
1) The Merkle tree limit the rate of new block generation to one every 10
The block is divided into two main categories which are minutes (in Bitcoin blockchain) and can vary for other
the header and the body. The header has four components, a blockchain.
timestamp, a nonce, a hash reference to a previous block and • Proof of Work
a hashed list of all transactions that took place since the last PoW is the calculation of hash functions to solve
created block. The blocks are stored in a multi-level data ‘mathematical puzzle’ in blockchain. Producing a proof of
structure, a tree structure called the merkle tree. This work is a random process and hence it requires a lot of trial
structure is the key factor of the mining. The merkle tree or and error. PoW algorithm is based on computation power.
binary hash tree is a type of a binary tree, where the bottom Miners are as powerful as the number and power of CPUs
of the tree contains the transactions (hashed), the they own. This algorithm is the oldest and the most common
intermediate tree nodes (leaves) contain the hash of the two one in the Blockchain technology, one of the problems that
nodes that made it, all the way till the top where it is a single PoW has, is that it spends a great amount of electricity and
hashed tree-node called the Merkle root (root hash). bandwidth over the process of mining.
• Proof of stake
Driving the weaknesses of PoW algorithm, PoS algorithm
was developed to make blockchain nodes as powerful as
their stake. The earning reward for a miner is the function of
the amount of stakes the miner holds. For example, if a node
has 10% coins in account, it will earn 10% of any new coins
created in the future because the probability of signing next
block would be related to the amount of stake. In this case
there is no need to solve a very hard mathematical
challenges as in PoW, which prevents wasting resources like
electricity. All seems good here but there is also a new issue
that the owner of the oldest set of coins or the one has more
coins get more rewards (rich get richer), the only thing that
need to be done is to prove the ownership of its stake.
Fig. 2 Overview of a Merkle tree

1738
 • Proof of Importance 4) Permission Restrictions
Due to the problem with PoW and PoS, there was a new Permission restrictions will determine which nodes are
consensus algorithm call the Proof of Importance (PoI). The eligible to create blocks of records. A permissioned
idea behind this algorithm is that the nodes are important as blockchains predefine the users to carry out transaction
their activities on the network. Nodes that are active on the processing, as in Hyperledger fabric blockchain. Meanwhile
network will be rewarded. Each address is given a trust score, for permission-less blockchains, there is no restriction on
and activities on network gets higher, the more chance a the identities of processors, therefore anyone can be a part of
node will be rewarded based on loyalty and effort. the network. This is the case in Bitcoin and Ethereum.
• Practical Byzantine Fault Tolerance (PBFT) 5) Scalability of blockchain structure
This consensus mechanism is certainly one of many that The scalability of blockchain structure is composed of
can be utilized in permissioned blockchains, in which a new the factor of node scalability and performance scalability.
block is generated if more than 2/3 of all validating peers Node scalability in blockchain networks refers to the extent
post the same reaction. Hyperledger fabric out of the box to which the network can upload more node without a loss in
does not provide PBFT, however gives its users the feature performance. Performance scalability on the other hand
of adding this consensus mechanism modularly. refers to the number of transactions processed per second. It
3) Access to Data is impacted by the latency among transactions and the block
length.
Depending on the consensus, there are three types of
A blockchain is considered scalable if it can add
blockchain which are: public, private and consortium
thousands of globally distributed nodes whilst still
Blockchain
processing thousands of transactions per second. Currently,
• Public Blockchains none of the prevailing blockchains are scalable. Public
Public blockchains or permission-less blockchains are blockchains such as Bitcoin and Ethereum make this trade-
accessible for everyone and anyone can participate as a node off in favor of node scalability by using proof-of-work
in the decision-making process. Public blockchain achieve (PoW) consensus mechanisms. On the other hand, a
consensus without central authority and thus can be Hyperledger fabric instance that modularly adds PBFT
considered as decentralized. All users maintain a copy of the makes this trade-off in favor of performance scalability. For
ledger on their local nodes and use a distributed consensus business structures of less than 20 nodes this might be a
mechanism to reach decision or eventual state of the ledger. viable solution. However, if there are more nodes that takes
Bitcoin is the best example of a public blockchain -whenever place in PBFT, transaction throughput can be reduced
a user does a transaction, it is reflected on every copy of the significantly.
block.
6) Governance
• Private Blockchains
Governance [34] refers to the degree to which decision-
Private Blockchains are private and open only to a making power is distributed within the blockchain network.
consortium or group of individuals or organizations that has It attempts to answer the question of who could make what
decided to share the ledger among themselves. Only the decisions on a blockchain platform. Each blockchain
owner of the Blockchain has the right to make any changes platform needs to be developed and maintained. Usually, a
to it. For example, Blockstack [31] [32] [33] aims to provide core developer crew performs this task. As there are many
the financial institutions with back office operations, stakeholders in a blockchain network, such as core
including clearing and settlement on private Blockchain. developers, miners, currency-exchanges, decentralized
However, the use cases of a private Blockchain are relatively applications (Dapps) developers, decisions making for new
small as compared to the public Blockchain. Some people changes to the blockchain center protocol are very important
may argue that private Blockchain is not of much used as the and frequently controversial. This is a strong factor where
implementation concept does not differ much from that of blockchain systems differ from each other.
the current systems. Nonetheless private blockchain can
provide solutions to some of the problems which Bitcoin 7) Anonymity on blockchain
cannot, such as know-your-customer (KYC) or anti-money Anonymity on the blockchain refers to whether the
laundering (AML). identity of a node is openly transparent. In public
• Consortium Blockchains permission-less blockchains, such as Bitcoin and Ethereum,
users are pseudonymous since they cover their identity
This blockchain is basically a hybrid of public and private
behind a pseudonym, their public wallet address. In private
blockchains. The consensus process is controlled by a
permissioned blockchains, such as Hyperledger fabric, users
preselected set of nodes. Rather than allowing any node to
usually know each other.
participate in reviewing the transactional process, a
consortium blockchain provides multiple defaults and 8) Native currency
distributed nodes for the process. A consortium platform Native currency refers to whether the blockchain has an
offers many of the benefits associated with private inherent currency [3]. For example, Bitcoin uses its currency
blockchains, such as the efficiency and privacy of “Bitcoin” as a medium for exchange. Ethereum uses “Ether”.
transactions. Besides, a consortium blockchain is generally while Hyperledger fabric does not use an own currency.
faster, with higher scalability and provide more transaction
privacy.

1739
 9) Turing Completeness TABLE I
COMPARISON OF ETHEREUM, HYPERLEDGER AND BITCOIN
Scripting refers to the degree to which a blockchain’s
programming features to support the development of Dapps. Characteristics Ethereum Hyperledger Bitcoin
This function will allow the developer to check the Turing
January 2009
completeness of the blockchain. Turing completeness refers Founded July 2015 July 2017
to any tool or device that in theory can calculate everything
Permission
assuming sufficient resources (memories) is available. Permission-less Permissioned Permission-less
restrictions
Ethereum and Hyperledger fabric are Turing complete so
they provide developers with a Turing-complete scripting Access to data Public or private Private Public
language (Solidity for Ethereum and Chaincode for
Consensus PoW PBFT PoW
Hyperledger Fabric), which allows developers to create
smart-contracts that can interact with each other and form High node- Low node- High node-
decentralized applications. While other blockchains, such as Scalability
scalability, low scalability, high scalability, low
Bitcoin, only provide a very limited stack-based performance- performance- performance-
scalability scalability scalability
programming. This makes application development very
tough and sometimes not possible. Low, open-
Low,
Centralized Medium, core governance
descentralized
10) Ethereum VS Hyperledger regulation developer group, model base on
decision making
(governance) but EIP process Linux model
• Ethereum by community

Ethereum [2], an open source project, provides a Pseudonmity, no Pseudonymity, Pseudonymity,

blockchain solution that allows distributed application to be Anonymity encryption of encryption of no encryption of
deployed. Ethereum links smart contracts and blockchains. transaction data transaction data transaction data
A smart contract is a credible contract that is completely
Native Yes- Ether No Yes-
controlled by computer program and does not depend on any currency (ETH) Bitcoin(BTC)
agency. The contract is automatically executed once
execution conditions are satisfied and no individual node can High possibility,
High possibility,
Turing
modify it. Ethereum can be seen as Bitcoin 2.0, a crypto Turing complete
complete,
Limited
currency with support for smart contracts. Ethereum is virtual machine, possibility,
Scripting scripting of
high-level stark-based
known for its high cost for performance scalability and language support
chaincode, high-
scripting
privacy. Its built-in cryptocurrency is known as Ether (ETH). level Go-
(Solidity)
language
• Hyperledger
Programing Golang, C++,
Hyperledger [35] on the other hand, is a Linux language Python
Golang, Java C++
Foundation banner project which covers frameworks like
Hyperledger Fabric, Sawtooth, Iroha, Indy and Burrow.
Hyperledger provides core modules and API to facilitate As a new technology with infinite opportunities, there are
development and interoperability. Hyperledger satisfies many individuals, companies as well as governments, which
major purposes of blockchain for business. In permissioned have started some researches and development on
network, proof-of-work does not involve solving difficult blockchain technology. While it may take years for
cryptographic problems, also known as mining. Transaction blockchain technology to mature fully, many blockchain
can be confirmed within a short time which is a major solutions and applications are already perfectly feasible in
business requirement. Besides, when mining is not required, the near term, and new opportunities will continue to present
there is no reliance on cryptocurrencies which is used to themselves as the underlying technology evolves. In this
incentivise miner. It supports selective disclosure which section, blockchain solutions in the field of identity
gives businesses the flexibility to make transactions visible management and authentication from year 2014 to 2018 are
to selected parties. This can be achieved through the key presented. A summary of the related works is exhibited in
management of encryption or signature operations. Above Table II.
and beyond, Hyperledger leverages on smart contract to A. Sovrin
automate business processes, Byzantine fault tolerance (BFT)
algorithm and fine-grained access control for its Sovrin [14] is a trust framework for decentralized, global
permissioned mode of operation. public utility for self-sovereign identity. It is also the first
There are fundamental differences among the blockchain global public utility exclusively for self-sovereign identity
technologies. For instance, participation of nodes in the and verifiable claims. Self-sovereign aims to provide
decentralised network, consensus mechanism, scalability and portable identity for any person or organization. Having a
native cryptocurrency. A detail comparison between self-sovereign identity allows the holder to present verifiable
Ethereum, Hyperledger and Bitcoin is presented in Table I. credentials in a private way. These credentials can be gender,
age, education background or employment information.
The Sovrin protocol is based entirely on open standards
and open source Hyperledger Indy Project. All Sovrin
identifiers and public keys are pseudonymous by default.
The solution is pairwise-pseudonymous identifiers, a
separate Distributed Identifier (DID) for every relationship.

1740
As of time of writing over 20 stewards have signed on to F. ShoCard
operate under the Sovrin Trust Framework. ShoCard [39] is a commercial mobile identity solutions
B. MyData that protects consumer privacy. It is basically a tiny file that
only user can manipulate. When users create a ShoCard ID,
MyData [36] is a research commissioned by Finnish through the App or via SDK, their identity document is
government for personal data management. This Nordic self- scanned and signed. Then, the app will generate a private
sovereign identity model is driven by the concept of human and public key to seal that record. The record is then
centric control, usability, accessibility and openness. encrypted, hashed and sent to the Blockchain where it cannot
MyData can be used to secure flow of data between sectors be tampered with or altered. Shocard Identity Platform is
likes governments, healthcare and finances. The core of built on a public BlockCypher’s blockchain infrastructure,
MyData authentication are user managed access, OpenID data or keys that could be compromised are stored off-ledger.
single sign-on and Oauth 2.0 which control access to Web
APIs. Blockchain is used to distributed control of fraudulent G. Uport
activities to the entire network of stakeholders, as any Uport [40] is a secure system for self-sovereign identity.
attempt to tamper with the blockchain is easily detectable. It aims to be an open identity system for a decentralized web.
The research, which joint forces with Sovrin, aims at It operates on the Ethereum blockchain and enables users to
strengthening digital human rights while opening new send and request credentials, digitally sign transactions, as
opportunities for business to develop innovative personal well as manage their keys and data in a secure manner. It
data services. It is also aiming at addressing EU General allows the publication of identity data to other Blockchain
Data Protection Regulation (GDPR) [37], new rules on such as Bitcoin and Ethereum.
controlling and processing personally information enforced Uport identities can be either individuals, devices, entities,
since May 2018. or institutions. Examples of interactions powered by uPort
C. Waypoint include blockchain transactions such as buying shares on the
Gnosis predication market, as well as making private
Waypoint [28] is a decentralized multi-factor statements to other uPort users or applications. uPort utilizes
authentication system that is deployed on the Ethereum two protocols, namely the Identity and Claims Protocol. The
Virtual Machine. This solution allows identity authentication Identity Protocol is an address on a decentralized network,
to be performed on the Blockchain, with Web API based controlled by a private signing key, and makes use of a
implementation. decentralized public key infrastructure (PKI) that enables
With a mobile base apps and desktop version available, signature validation. On the other hand, the Claims Protocol
Waypoint allows application to secure multiple modules refers to a standard message format that enables source
within one product by defining multiple functions. It attribution and facilitates interoperability between various
provides feature to store user behaviour and perform blockchain and identity networks. The Claims Protocol
analytics for real time behavioural based authentication. The supports the JSON Web Token (JWT) and Ethereum
commercial solution is currently at beta-stage. transactions. Among the products and tools offered by uPort
D. Bloom is the self-sovereign wallet, where it allows its users to sign
transactions and manage their keys and data in one simple,
Bloom [38], a blockchain project for credit scoring and secure location. uPort also offers development tools to assist
identity management that uses Ethereum and IPFS. it is an Simple Authentication and SSO for dapps or modern web
all-encompassing protocol it that it allows for each applications. Although its seems very promising, Uport is
traditional and digital currency holders to serve as lenders to still in the closed-beta stage.
users who are unable to obtain a bank account or credit score.
users will create an id contract (BloomID) to be attested by H. I/O Digital
friends, family and corporation. The BloomIQ system then I/O Digital [41] provides an identity management that
reports and tracks debt obligations, ensuing in a BloomScore utilizes an improved blockchain called DIONS
as a metric of client’s credit worthiness. The bloom protocol (Decentralized I/O Name Server) and secured using Proof of
creates a globally portable and inclusive credit profile, Stake (POS I/O). The DIONS blockchain enables storage of
reducing the need for classic banking infrastructure and data, with capabilities of document and identity storage.
opaque, proprietary credit scores. DIONS also allows for message encryption using AES 256
E. BlockStack block cipher and accompanied with a complete Alias system.
The Alias system allows its users to store sensitive identity
Blockstack [31] [32] [33] provides decentralized services credentials and provides a way to manage reputation and
for naming (DNS), identity, authentication and storage. control their data, as the user can choose to create a public
developers can use JavaScript libraries to build serverless (unencrypted) alias, private (encrypted) alias, or both. The
apps and not worry about handling infrastructure. Blockstack aliases are easy to remember and fully transferable between
will replace the contemporary client/server model; users users. The IOC data, messaging / alias system fees are
control their information, apps run client-side, and the open redistributed to all active stakers in the network. This
Blockstack network replaces server-side functionality. ensures further IOC distribution, and incentives users to
stake while securing the network. Features such as alias
creation and decryption, secure channel negotiation via a
single Invite, secure file transfer, and secure instant message

1741
communication are available on a readily hard-coded into a (Decentralized Identifiers, DID) and DID Document Object
HTML5 wallet system. (DDO) which documents verifiable claims related to the
identity. The Jolocom user interface is a fully decentralized
I. BlockAuth mobile application to manage and use their decentralized
BlockAuth [42] is franchised network of OpenID digital identity. It currently allows for creation of new
Connect providers that that enables user to own and operate identities, creation and updating claims on identities, as well
its own identity registrar. User privacy falls within the as verifying claims on other identities. Future development
control of the users by allowing them to choose what plans of Jolocom include interaction with Ethereum smart
information they wish to make public. All user data will be contract, integration with other blockchains, as well as
encrypted. Information they wish to keep entirely private is management of tokens.
encrypted with multi-part keys that require multiple parties
L. Cambridge Blockchain
to work in tandem to decrypt. Additionally, BlockAuth use
their financial resources to help developers of open source Cambridge Blockchain [45] is founded with the mission
projects by paying grants or bounties. BlockAuth is of fostering Cambridge's blockchain ecosystem. It is
providing an easy-to-integrate authentication system through working on an identity Blockchain for validating secure
modern standards-compliant API. This framework is digital identity documents, processing electronic signatures,
necessary to build an entire resilient decentralized ecosystem and recording transactions. Cambridge Blockchain's
to perform the tasks of user authentication and verification. distributed architecture resolves the competing challenges of
transparency and privacy, leading to stronger regulatory
J. UniquID compliance, lower costs and a seamless customer
UniquID [43] is a decentralized identity and access experiences.
management platform that provide digital keys. It aims to M. KYC.LEGAL
solve the increasing challenges attributed to the Internet of
Things. This platform prioritizes identity before security. KYC.LEGAL [46] is an Ethereum based blockchain
User’s device would be saved inside their own private identity service that allows other services to verify users. It
blockchain. This private blockchain would act as a digital allows the identity of users to be established and
vault to protect the user’s digitally connected assets via documented, so that going forward online provider can
secure authentications. UniquID also enables devices to be register any services that require such verification by
independent. This means that authentications are carried out providing only that information which is required for each
device to device without the need of any third-party individual service. The product is made up of two parts:
intermediaries. This concept is applied to deal with document verification through a mobile application, and
challenges related to cybersecurity and Internet of Things. verification of identity and documents with the help of a
Besides that, UniquID’s device centric solution does not KYC.LEGAL agent.
require the usage of passwords, as it recognizes its users
through personal connected objects, or integrated with N. CertCoin
fingerprint or other biometry on personal devices. Thus, this CertCoin [47] is a decentralized authentication system
removes the risk associated with user generated passwords. based on the NameCoin [48] blockchain. This system carries
It claims to be ready for deployment on custom hardware, the best aspects of transparent certificates authorities and
servers, personal computers or smart phones and tablets. It is web of trust. Certcoin is absolutely public and auditable.
currently in a private beta stage. Certcoin helps the expected features of a full-fledged
certificate authority such as certificate creation, revocation,
K. Jolocom chaining, and recovery. Domain purchases and transfers are
Jolocom [44] aims to develop a solution to provide a executed with simple Bitcoin transactions to incentivize
decentralized identity based on hierarchically deterministic miners. The CertCoin layout additionally facilitates trusted
keys (HD keys). These keys are generated, provisioned, and key distribution that makes it more suitable for performance
controlled by the users themselves. This platform allows conscious applications. Besides that, it also addresses several
easy management of multiple personas and preservation of issues inherent to current PKIs, such as the need for a trusted
pairwise anonymity in context specific interactions. The third party and limited accessibility.
derived key pairs can be recovered by using a simple
seedphrase. Besides that, Jolocom also allows the modelling O. Authenteq
of IoT devices ownership for integrated human and machine Authenteq [49] uses a facial recognition algorithm to
identity. Jolocom is focused on providing a lightweight, create a digital identity on a blockchain. Authenteq allows
global, and self-sovereign identity solution for decentralized users to verify identity and create personal sovereign digital
systems that is easy to deploy for non-technical users. It also IDs which is stored in an encrypted blockchain. All personal
maintains an open source release to support the larger data are owned and controlled by owner, and not accessible
decentralized application community. by any third party. Authenteq can be adopted by any type of
The Jolocom system architecture consists of the Jolocom online services. API and plugin are provided for business
Library, its user interface, a public distributed storage system, integration. This is one of the commercial blockchain IdM
and a storage backend. The Jolocom library offers a solutions which incorporates biometric features for
comprehensive RESTful API for performing all available authentication.
identity related functionalities: creating a new identity

1742
 TABLE II
SUMMARY OF BLOCKCHAIN-BASED IDENTITY MANAGEMENT AND AUTHENTICATION SOLUTIONS

Solution Description Propose type Blockchain Network ID Mgmt Auth Status

Decentralized global Completed

Non-profit Hyperledger Public
Sovrin [11] public utility for self- Yes No (September
foundation Indy Permissioned
sovereign identity 2016)
This Nordic initiative
which joint forces with
Sovrin to build self- Hyperledger Public
MyData [36] Government Yes Yes On-going
sovereign identity and Indy Permissioned
authentication
mechanism
Decentralized multi- Beta stage
Waypoint
factor authentication Company Ethereum Private No Yes (October
[28]
system 2017)

Blockchain project for Completed

Bloom [38] credit scoring and Open source Hyperledger Permissioned Yes No (January
identity management 2018)

Decentralized services
Completed
BlockStack for naming/DNS,
Start-up Ethereum Private Yes Yes (October
[31, 33] identity, authentication
2017)
and storage
Identity platform to Completed
ShoCard [39] protect consumer Start-up Ethereum Public Yes No (December
privacy 2017)
Completed
Uport [40] Identity management Company Ethereum Public/Private Yes No (October
2016)
Identity management Completed
I/O Digital
based on the Blockchain Start-up Ethereum Private Yes No (January
[41]
2018)
Developing identity
BlockAuth Permission- Completed
registrar base on the Start-up Ethereum Yes No
[42] less (July 2014)
Blockchain

Identity and access

UniquID [43] Permission- Beta Stage
management of Open source Ethereum Yes No
less (June 2016)
connected things
Applications for user to Development
own their personal stage
Jolocom [44] Start-up Ethereum Public/Private Yes No
digital identity (February
2018)
Cambridge
Permission- Alpha Stage
Blockchain Identity Blockchain Start-up Ethereum Yes No
less (June 2017)
[45]
User identification and Completed
KYC.LEGAL Permission-
verification to prevent Company Ethereum Yes No (February
[46] less
fraud 2018)
NameCoin based
CertCoin Completed
decentralized Open source Hyperledger Permissioned No Yes
[47] (May 2014)
authentication system

Identity verification
platform that uses a
Authenteq Completed
facial recognition Permission-
[49] Company Ethereum Yes No (August 2014)
algorithm to create a less
digital identity on a
blockchain

1743
 IV. CONCLUSIONS
III. RESULT AND DISCUSSION
Email and password credentials are notoriously easy to
Even though there are many legislation issues surrounding
crack as can be witnessed in all the large-scale online
the exchange of sensitive data attributes, personal privacy
account hacking. Current online services rely blindly on
concerns are addressed inadequately or simply overlooked.
online providers to perform identity management and
Self-sovereign identity management, blockchain and
authentication. There should be an ideal form of identity
Distributed Ledger Technology are going to patch the gap
management that only grants access to certain information
that current technology falls short of providing a secure and
and eliminates the need for each online service provider to
cost-efficient identity management framework. Blockchain
store credentials for every client.
authentication and self-sovereign identity management can
Blockchain can offer a solution by decentralizing the
be deployed by government agencies, financial institutions
ownership of credentials and offering a universally available
and enterprise business for providing a secure and reliable
protocol for verifying one’s record in an immutable chain of
authentication and identity management solution.
data. Blockchain can create a secure platform for online
The discovery of this new mechanism creates a secure
service providers to authenticate users. Besides, this
platform for service providers to authenticate users with no
technology could also help to instill the trust back in users.
single point of failure and prevent attacks and leakages of
Users should have full control over who has the right to use
user data. This solution is a tamper-proof reference point to
their data and what they can do with it once they gain access.
verify personal data without having to expose the actual data
To facilitate this peer-to-peer exchange of data and
to a service provider.
consent, routing of requests, mechanisms for discovery and
Blockchain identity management and authentication
recording of events, a decentralized network that is publicly
solution by design is distributed, decentralized and fault-
accessible, immutable and resistant to faults and tampering
tolerant which decreases the deployment and maintenance
is needed. Distributed ledger technology and Blockchain is
cost. However, scalability seems to be the biggest challenge
the revolution that makes this possible.
with public blockchain. Some argued that by centralizing
some parts of the technology, blockchain identity
ACKNOWLEDGMENT
management will be more cost effective and secure.
On the other hand, instead of on premise deployment of This research was supported by UNITAR International
blockchain network, Blockchain-as-a-Service (BaaS) [50] University Internal Research Grant.
allows customers to leverage cloud-based solutions to build,
host and use their own applications and smart contracts on REFERENCES
the blockchain. Cloud providers take over other necessary [1] Nakamoto, S., Bitcoin: A Peer-to-Peer Electronic Cash System. 2008.
tasks to keep the infrastructure operational. Undeniably, [2] Wood, G., Ethereum: A Secure Decentralised Generalised
BaaS is aiding the blockchain adoption across businesses. Transaction Ledger EIP-150 Revision. 2014.
Companies such as IBM, Microsoft, or even google had [3] Swan, M., Blockchain: Blueprint for a new economy. 2015: O'Reilly
started offering the cloud as a service business model based Media, Inc.
on blockchain technology. [4] Alizadeh Mojtaba, A.S., Zamani Mazdak, Baharun Sabariah, Sakurai
Even though blockchain provides the technology to Kouichi, Authentication in mobile cloud computing: A survey.
Journal of Network and Computer Applications, 2016. 61: p. 59-80.
resolve identity management glitches, some parties argued
[5] Shu Yun Lim, M.L.M.K., Tan Fong Ang, Security Issues and Future
that identity management has always been a business issue Challenges of Cloud Service Authentication. Acta Polytechnica
but not a technology problem [51]. Blockchain technology Hungarica, 2017. 14(2): p. 69-89.
does not resolve access management issues such as key [6] TheStar, M’sia sees biggest mobile data breach, in TheStar. 2017.
management problem that is inherent in server centric and [7] MalaysiaKini, After data leaks, Personal Data Protection Act needs
federated identity environment. Another long-running review, in Malaysia Kini. 2018.
problem with identity is around the verification of user [8] Nagaraju, S. and L. Parthiban, SecAuthn: Provably Secure Multi-
identity, in which there is no one responsible and liable for Factor Authentication for the Cloud Computing Systems. Indian
vetting data, the same problem where federated identity Journal of Science and Technology, 2016. 9(9).
projects have become stuck. The solution to this problem is [9] Ghazizadeh E., M., J. L. A., Zamani, M., Pashang, A. A survey on
security issues of federated identity in the cloud computing. in Cloud
probably to extend the notion of zero knowledge proof in Computing Technology and Science (CloudCom), 2012 IEEE 4th
self-sovereign identity management. This leads to a International Conference on. 2012.
mechanism in which the prover demonstrates possession of [10] Meredith, S., Facebook-Cambridge Analytica: A timeline of the data
knowledge without conveying any information apart from hijacking scandal. 2018, CNBC.
the fact that he or she possess the knowledge. [11] Andrew Tobin, D.R., The Inevitable Rise of Self-Sovereign Identity.
Besides, enhancement of Ethereum and Hyperledger 2017.
blockchain is required which in turn could improve the [12] Simon, H. SAML: The Secret to Centralized Identity Management.
performance of blockchain network. In real world 2004.
implementations, it will require an overhaul or at least a [13] Zwattendorfer, B., et al., A Federated Cloud Identity Broker-Model
for Enhanced Privacy via Proxy Re-Encryption, in Communications
focused effort to integrate this technology with exiting
and Multimedia Security, B. De Decker and A. Zúquete, Editors.
implementations of identity authentication to begin an initial 2014, Springer Berlin Heidelberg. p. 92-103.
acceptance of this technology in the market. [14] Andrew Tobin, D.R., The Inevitable Rise of Self-Sovereign Identity
(White paper). 2017: Sovrin Foundation.

1744
[15] M I Awang, M.A.M., R R Mohamed, A Ahmad, N A Rawi, A [31] M. Ali, R.S., J. Nelson and M. J. Freedman, Blockstack: A New
Pattern-Based Password Authentication Scheme for Minimizing Internet for Decentralized Applications (Whitepaper). 2017.
Shoulder Surfing Attack. International Journal on Advanced Science, [32] J. Nelson, M.A., R. Shea and M. J. Freedman, Extending Existing
Engineering and Information Technology, 2017. 7(3). Blockchains with Virtualchain, in Workshop on Distributed
[16] Keszthelyi, A., About Passwords. Acta Polytechnica Hungarica, 2013. Cryptocurrencies and Consensus Ledgers. 2016.
Vol. 10, No. 6. [33] M. Ali, J.N., R. Shea and M. J. Freedman. Blockstack: A Global
[17] Recordon, D. and B. Fitzpatrick, OpenID Authentication 1.1. Naming and Storage System Secured by Blockchains. in 2016
Finalized OpenID Specification, May, 2006. USENIX Annual Technical Conference. 2016.
[18] Celesti, A., et al. Three-Phase Cross-Cloud Federation Model: The [34] Atzori, M., Blockchain technology and decentralized governance: Is
Cloud SSO Authentication. in Advances in Future Internet (AFIN), the state still necessary? 2015.
2010 Second International Conference on. 2010. [35] Foundation, T.L., Hyperledger Overview. 2018.
[19] Senk, C., Future of Cloud-Based Services for Multi-factor [36] Panetta, R., & Cristofaro, Lorenzo, A closer look at the EU-funded
Authentication: Results of a Delphi Study, in Cloud Computing, M. My Health My Data project. Digital Health Legal, 2017. 10-11.
Yousif and L. Schubert, Editors. 2013, Springer International
Publishing. p. 134-144. [37] Council of the European Union , E.P., Regulation (EU) 2016/679 of
the European Parliament and of the Council Official Journal of the
[20] Chaurasia, B., A. Shahi, and S. Verma, Authentication in Cloud European Union, 2016.
Computing Environment Using Two Factor Authentication, in
Proceedings of the Third International Conference on Soft [38] Jesse Leimgruber, A.M., John Backus, Bloom Protocol:
Computing for Problem Solving, M. Pant, et al., Editors. 2014, Decentralized credit scoring powered by Ethereum and IPFS. 2018.
Springer India. p. 779-785. [39] Shocard, Identity Management Verified Using the Blockchain. 2017.
[21] Banyal, R.K., P. Jain, and V.K. Jain. Multi-factor Authentication [40] Christian Lundkvist, R.H., Joel Torstensson, Zac Mitton, Michael
Framework for Cloud Computing. in Computational Intelligence, Sena, UPORT: A Platform for Self-Sovereign Identity. 2016.
Modelling and Simulation (CIMSim), 2013 Fifth International [41] Digital, I.O., I/O Digital Application Based Blockchain Whitepaper.
Conference on. 2013. 2016.
[22] Imran Naguru, N.K.R.B., Feature Matching in Iris Recognition [42] BlockAuth, Powering a franchised network of OpenID Connect
System using MATLAB. International Journal on Advanced Science, providers that verify user authentication and authenticity. 2014.
Engineering and Information Technology, 2017. 7(5).
[43] Uniquid. Uniquid Blockchain Access Management. 2017; Available
[23] Hahn, C. and J. Hur, Efficient and privacy-preserving biometric from: http://uniquid.com/.
identification in cloud. ICT Express, 2016. 2(3): p. 135-139.
[44] Charleen Fei, J.L., Eugeniu Rusu,Kasia Szawan, Kai Wagner,
[24] Rathgeb, C. and A. Uhl, A survey on biometric cryptosystems and Natascha Wittenberg, Jolocom: Decentralization By Design. 2018.
cancelable biometrics. EURASIP Journal on Information Security,
2011. 2011(1): p. 3. [45] Blockchain, C. Identity compliance, simplified. 2018; Available from:
https://www.cambridge-blockchain.com/.
[25] Markus Jakobsson, E.S., Philippe Golle, Richard Chow, Implicit
authentication for mobile devices, in Proceedings of the 4th USENIX [46] Legal, K. Blockchain identity verification. 2018; Available from:
conference on Hot topics in security. 2009, USENIX Association: https://kyc.legal/en.
Montreal, Canada. p. 9-9. [47] Conner Fromknecht, D.V., Sophia Yakoubov CertCoin: A NameCoin
[26] Jeong, H. and E. Choi, User Authentication using Profiling in Mobile Based Decentralized Authentication System. 2014.
Cloud Computing. Aasri Conference on Power and Energy Systems, [48] NameCoin. Namecoin. 2018; Available from:
2012. 2: p. 262-267. https://www.namecoin.org/.
[27] Chow, R., et al., Authentication in the clouds: a framework and its [49] Authenteq. Identity Verification & KYC. 2018; Available from:
application to mobile users, in Proceedings of the 2010 ACM https://authenteq.com/.
workshop on Cloud computing security workshop. 2010, ACM: [50] Samaniego, M., & Deters, R. . Blockchain as a Service for IoT. in
Chicago, Illinois, USA. p. 1-6. IEEE Green Computing and Communications (GreenCom) and IEEE
[28] Ismail, R., Enhancement of Online Identity Authentication Though Cyber, Physical and Social Computing (CPSCom) and IEEE Smart
Blockchain Technology. 2017: Malaysia. Data (SmartData). 2016. IEEE.
[29] Abdellaoui, A., Y.I. Khamlichi, and H. Chaoui, A Novel Strong [51] Kirk, J. Blockchain for Identity Management: It's Years Away. 2018
Password Generator for Improving Cloud Authentication. Procedia [cited 2018; Available from:
Computer Science, 2016. 85: p. 293-300. https://www.bankinfosecurity.com/blockchain-for-identity-
[30] Vukolić, M., The Quest for Scalable Blockchain Fabric: Proof-of- management-its-years-away-a-10598.
Work vs. BFT Replication, in Open Problems in Network Security.
iNetSec 2015. Lecture Notes in Computer Science. 2016, Springer.

1745

View publication stats