Beyond the Hype: On Using Blockchains in Trust
Management for Authentication
Nikolaos Alexopoulos, J
¨
org Daubert, Max M
¨
uhlh
¨
auser, and Sheikh Mahbub Habib
Telecooperation Lab
Technische Universit
¨
at Darmstadt
Hochschulstraße 10, Darmstadt D-64289, Germany
Email: {alexopoulos, daubert, max, sheikh}@tk.tu-darmstadt.de
Abstract—Trust Management (TM) systems for authentication
are vital to the security of online interactions, which are ubiq-
uitous in our everyday lives. Various systems, like the Web PKI
(X.509) and PGP’s Web of Trust are used to manage trust in
this setting. In recent years, blockchain technology has been
introduced as a panacea to our security problems, including that
of authentication, without sufficient reasoning, as to its merits.
In this work, we investigate the merits of using open distributed
ledgers (ODLs), such as the one implemented by blockchain
technology, for securing TM systems for authentication. We
formally model such systems, and explore how blockchain can
help mitigate attacks against them. After formal argumentation,
we conclude that in the context of Trust Management for
authentication, blockchain technology, and ODLs in general, can
offer considerable advantages compared to previous approaches.
Our analysis is, to the best of our knowledge, the first to
formally model and argue about the security of TM systems
for authentication, based on blockchain technology. To achieve
this result, we first provide an abstract model for TM systems
for authentication. Then, we show how this model can be
conceptually encoded in a blockchain, by expressing it as a series
of state transitions. As a next step, we examine five prevalent
attacks on TM systems, and provide evidence that blockchain-
based solutions can be beneficial to the security of such systems,
by mitigating, or completely negating such attacks.
I. INTRODUCTION
We live in an increasingly interconnected world, where online
interactions are a common occurrence in the daily routine of
most individuals. Billions of interactions, possibly of a sensitive
nature, take place every day around the world. The security
of these interactions is essential for the orderly operation of
organizations, as well as for the well-being of people.
Authentication is a major enabler of security on the Internet.
In this context, authentication corresponds to a mechanism
that verifies the identities of interacting entities. It is a
requirement of almost all secure online interactions, ranging
from email exchange to banking transactions. As an example,
authentication mechanisms as part of the TLS/SSL protocol [
1
]
are used each time a user browses a website through https [
2
].
Through the use of public key cryptography, authentication of
an entity equates to verifying the correctness of the binding
between a public key and an identity, which in our context also
includes related attributes of the entity (see section II). For the
remainder of the paper this will be called a public-key-to-id
binding.
Trust is a vital component of authentication systems. The
electronic nature of online interactions means, that physical
identification using, e.g. state issued id cards and passports,
is not possible, or even appropriate. Furthermore, in many
instances, identification includes more than just name verifica-
tion, e.g. in an online marketplace scenario, the client would
need to know if the interacting party is actually the shop with
the corresponding physical address that it claims, possibly
along with other relevant attributes, such as certifications
of the shop’s quality. Therefore, entities that have not had
direct physical experience with the holders of the public
keys that they want to identify, need to rely on others to
authenticate the public-key-to-id bindings
1
. Entities trust that
other entities are proficient in the identification process and
honest in the authentication process of third parties. This trust
is then disseminated in the network through chains of trust
expressed via cryptographic credentials, thus making possible
the authentication of entities without physical interaction. Two
of the most widely used systems that achieve this goal are
the web X.509 PKI ([
3
], [
4
]) and PGP’s Web of Trust [
5
].
The former follows the centralized hierarchical approach, with
designated root certification authorities (CAs) trusted a priori by
browsers and operating systems. These can in turn delegate this
trust to other CAs and so on, to form chains. The latter is based
on a decentralized approach and allows users to authenticate
other users by forming trust chains through their social relations
in the real world.
Real-world issues [
6
], [
7
], [
8
] have highlighted the need
for more secure and transparent authentication systems. Re-
cently, and in accordance with the need for decentralized and
secure authentication, preliminary solutions using blockchain
technology have been proposed to solve some aspects of the
problem ([
9
], [
10
], [
11
], [
12
], [
13
], [
14
]) with a varying degree
of success. For example, Namecoin [
9
] offers a decentralized
namespace supported by a dedicated cryptocurrency. In [
12
],
the authors propose storing PGP keys and signatures on
the bitcoin blockchain, while [
13
] introduces a distributed
naming and storage service that can be implemented on top
of any suitable blockchain. Blockchains and Open Distributed
Ledgers (
ODL
s) in general, as explained in Section II, can
1
We refer to systems that rely on trust for authenticating third parties as:
“Trust Management systems for authentication”
2017 IEEE Trustcom/BigDataSE/ICESS
2324-9013/17 $31.00 © 2017 IEEE
DOI 10.1109/Trustcom/BigDataSE/ICESS.2017.283
546
评论0
最新资源