Abstract
Traditional identity authentication solutions mostly rely on a trusted central entity, so they cannot handle single points of failure well. In addition, most of these traditional schemes need to store a large amount of identity authentication or public key information, which makes the schemes difficult to expand and use in distributed situations. In addition, the user prefers to protect the privacy of their information during the identity verification process. Due to the open and decentralized nature of the blockchain, the existing identity verification schemes are difficult to apply well in the blockchain. To solve this problem, in this article, we propose a privacy protection identity authentication scheme based on the blockchain. The user independently generates multiple-identity information, and these identities can be used to apply for an identity certificate. Authorities use the ECDSA signature algorithm and the RSA encryption algorithm to complete the distribution of the identity certificate based on the identity information and complete the registration of identity authentication through the smart contract on the blockchain. On the one hand, it can realize the protection of real identity information; on the other hand, it can avoid the storage overhead caused by the need to store a large number of certificates or key pairs. Due to the use of the blockchain, there is no single point of failure in the authentication process, and it can be applied to distributed scenarios. The security and performance analysis show that the proposed scheme can meet security requirements and is feasible.
1. Introduction
Nowadays, in the Internet of Things (IoT) environment, a massive quantity of devices and sensors can feel each other through the internet to share and process data [1–3]. Users have lost control of sensitive data, which has caused concerns about data security to become one of the main obstacles to data sharing between parties [4, 5]. Take e-health systems as an example; with the popularity of wearable medical equipment, the application of the e-health system has obtained widespread attention and is constantly changing our living habits [6–8]. Through the e-health system, doctors can analyze the patient’s physique data obtained by sensors in real time, realize the research on the effect of drugs, or provide patients with better medical care. In these scenarios, wearable medical sensors can obtain parameters related to the patient’s health, such as blood pressure, heart rate, and body temperature. Through the internet, the collected health data are transmitted to the doctors. Internet-based medical treatment enables doctors to treat patients no longer limited to geographic locations, which not only reduces medical costs but also saves treatment time. Even if the patient is located in a remote area, doctors can monitor the patient’s health in real time through the transmitted data and give targeted treatment plans.
In this scenario, the patient’s medical data are an important information resource containing a large amount of sensitive information, which can be in the form of signals, text, voice data, images, etc. This information needs to be effectively protected. However, since medical systems are vulnerable to cyberattacks, sharing sensitive patient information in an IoT environment may cause a series of serious security and privacy issues. For example, if the third party who obtains the information does not use the data as agreed, but instead sells or uses other forms of data abuse; this will pose a severe challenge to the privacy and safety of patients. In order to ensure that patients’ data are not used by unauthorized people in the smart medical environment, an effective identity management solution must be used. Firstly, the amount of data generated by sensors in real-time medical treatment is very large, and the data formats are heterogeneous. Therefore, for terminals with limited processing capabilities, it is not feasible to encrypt data before transmitting the data. Secondly, since terminals often have limited storage capacity, it is not feasible to use existing identity management and verification methods that require storing a large number of key pairs. In addition, most of the existing solutions rely on a trusted third party to implement identity management and authentication, which not only leads to the potential danger of a single point of failure but also makes users lose control of their own identity information.
Recently, as a decentralized technology, blockchain [9–11] provides a feasible solution to ensure the data integrity. The advantage of blockchain technology is that, through the consensus mechanism, the distributed storage of medical data can be realized, and the modification or deletion of the data of a few participants will not affect other participants. It is an interesting idea to use blockchain to solve the problem of relying on trusted third parties in traditional identity authentication. For the key management [12] and user identity authentication [13], it is also necessary to resolve user anonymity, verifiability, and nonrepudiation [14–16].
In this paper, we propose a blockchain-based identity authentication scheme, which can realize anonymous user identity authentication and identity management without a lot of storage space. The main contributions of this paper can be summarized as follows:(i)We propose a blockchain-based identity authentication scheme. By introducing the blockchain, users will generate their own identities and generate publicly verifiable information for those identities. Users store public information on the blockchain, thus solving the problem of relying on third parties to manage identity information. Users do not need to maintain a database of publicly verified information and can realize identity authentication by querying the blockchain, which saves the time delay of waiting for block confirmation. Therefore, during the identity authentication process, there is no need to rely on a trusted third party, and there is no need for users to store the identity information of other users.(ii)The identity authentication scheme we proposed can support privacy preservation, including communication privacy protection and user identity privacy protection. By using the ECDSA signature scheme, the verifiability and unforgeability of the identity verification process are ensured. The communication process is encrypted by the RSA encryption algorithm to ensure the security of communication. In addition, the user can generate multiple identities, and the corresponding public information is not related, so the user’s identity privacy can be effectively protected.(iii)Our analysis and comparison proved that the proposed identity authentication scheme meets the security requirements, and the feasibility of the scheme was proved through simulation experiments.
1.1. Related Work
Traditional identity management solutions often rely on a centralized trusted third party [17, 18], where users’ personally identifying information is controlled by an organization rather than the user himself/herself. This means that the third party has complete control over the user’s information. Third-party entities may leak user information due to software vulnerabilities, hardware damage, and economic benefits. In addition, a centralized system inevitably brings a single point of failure problem, and due to the limited capacity of a single node, it is difficult to achieve effective identity authentication when the system user is very large, that is, it lacks scalability.
In order to solve the centralization problem, some studies have proposed federated identity management [15, 19, 20]. Allow users to log in to the system with the same identity in multiple different scenarios. Although this solution avoids the storage of a large amount of identity information to some extent, the user’s identity is still controlled and managed by the joint service provider. At the same time, there have been many proposed schemes to help meet user privacy protection requirements [21–24]. They focus on user-centric identity management, enabling users to selectively authorize personal data under various conditions and display credentials provided in response to authentication requests.
Recently, some researchers have introduced blockchain technology into identity authentication [25–27]. In [15], the authors proposed a blockchain-based identity management and authentication scheme for mobile networks, where users’ identifying information is controlled by the users themselves. In [13], the authors proposed a blockchain-based multi-WSN authentication scheme for IoT. In their scheme, the nodes of IoT are divided into base stations, cluster head nodes, and ordinary nodes according to capability, which are formed to a hierarchical network. A blockchain network is constructed among different types of nodes to form a hybrid blockchain model, including local chain and public chain. In this hybrid model, nodes’ identity mutual authentication in various communication scenarios is realized, ordinary node identity authentication operation is accomplished by the local blockchain, and cluster head node identity authentication is realized in the public blockchain. In [28], the authors proposed a new EHR paradigm which can help in dealing with the centralized problem of cloud-based EHRs. After that, they proposed an authentication scheme for blockchain-based EHRs. The proposed scheme is an identity-based signature scheme with multiple authorities which can resist the collusion attack out of from authorities. In [29], the authors presented a permissioned blockchain-based identity management and user authentication (PBBIMUA) scheme for the e-health environment. The proposed scheme satisfies the security requirements of medical data.
It can be seen that the existing blockchain-based identity authentication schemes can be divided into two categories according to their application scenarios: multidomain and single domain. Among the multidomain authentication schemes, the existing schemes are difficult to solve the cross-domain system compatibility issues and the privacy security issues between different domains. In the single-domain authentication scheme, most of the information used for authentication is stored in the blockchain in plaintext messages. However, in the process of identity management and authentication, the openness and immutability of the blockchain will inevitably bring security risks and difficulties in changing identity information.
2. Preliminaries
In this section, we illustrate background knowledge used in this paper, including the definition of discrete logarithm and its security assumptions, chameleon hash algorithm, and description of the verifiable claim.
2.1. Blockchain
Blockchain [30] is a distributed hyperledger with irreversibility and traceability. Generally, the blockchain integrates various technologies such as cryptographic algorithms, P2P communication, consensus, and smart contracts and can establish trust relationships without a special trust relationship between peers and no trusted central authority. Cryptographic algorithms, such as hash functions and signature algorithms, can guarantee the integrity and unforgeability of information. P2P technology can realize point-to-point communication between nodes. The consensus mechanism (such as PoW, PoS, and DPos) is the core of the blockchain. The nodes participating in the consensus in the blockchain system are called miners. They are responsible for packaging the transaction data in the system into a block and obtain the accounting rights by participating in the consensus, thereby recording the block on the blockchain.
2.2. Elliptic Curve Digital Signature Algorithm
Elliptic Curve Digital Signature Algorithm (ECDSA) [31] is used to create a digital signature of the data (a file, for example) in order to allow one to verify their authenticity without compromising their security. We use and to represent the signing process and the verification process in ECDSA, respectively.
The signing process is as follows:(1)Choose an elliptic curve and the base point (2)Select the private key (, is the order of ), and use the base point to calculate the public key (3)Generate a random integer (), and calculate the point (4)Take the original data and the coordinate values , of point as parameters, and calculate (5)Calculate (6)As the signature value, and , if one of and is 0, restart from Step 3
The verification process is as follows. After receiving the message and signature value , the recipient performs the following operations:(1)Calculation: and (2)Verify the equation: (3)If the equation holds, accept the signature; otherwise, the signature is invalid
2.3. RSA Encryption
RSA encryption algorithm [32, 33] is an asymmetric key encryption algorithm. The encryption key (i.e., public key) is public information, and the decryption key (i.e., secret key) needs to be kept secret. The encryption algorithm and the decryption algorithm are also public.
The specific description of the RSA algorithm is as follows:(1)Choose two different large prime numbers and to calculate the product , (2)Choose a large integer arbitrarily and satisfy , and the integer is used as the encryption key(3)The determined solution key satisfies (4)The integers and are disclosed, and is kept secret(5)Encrypt the plaintext ( is an integer) into ciphertext ; the encryption algorithm is (6)Decrypt ciphertext into plaintext ; the decryption algorithm is
3. System Model
As shown in Figure 1, in the system model, we assume a blockchain network in which each member holds a related distributed ledger. The network systems are formed with the data owner (DO) and the data user (DU). In the e-health system, data owners are generally patients with wearable medical equipment, and data users are doctors who provide medical assistance to patients. Users establish a blockchain network maintained by miners. Authority is responsible for the registration of users and providing the proof of their valid identity. The responsibility of the miner is to check the user’s identity information and add this information to the blockchain as a transaction for mining user enrolment requests. After successful execution of the process, users can complete the authentication process by accessing the blockchain.(i)User: the user realizes its own identity control and management by generating its own identity identification () and its corresponding public and private keys. The user can have multiple independent at the same time and store and public and private keys locally. Only when necessary, the and public key are disclosed to other users. According to different roles, users can be divided into data owners (DO, such as patients) and data users (DU, such as doctors).(ii)Authority: the authority is an entity that distributes certificates to users (Steps ① and ②), such as governments or medical management agencies. The certificate distributed to users contains the signature of the authorities and can be verified by other users. It is worth pointing out that although the authority distributes certificates to users, the authority does not participate in the verification process in the process of performing identity authentication (Step ④).(iii)Blockchain: It is a consortium blockchain maintained by miners for publishing users’ and public keys (Step ③). The miner is the execution node of the packaged transaction mining block in the blockchain. It verifies the signature of the transaction and stores the verified transaction on the blockchain. Any entity can read the information on the blockchain (Step ⑤).
4. The Proposed Identity Authentication Scheme
In this section, we first give the overview of our proposed privacy-preserving identity authentication scheme. In the following, we provide a detailed description of our scheme, which mainly consists of three phases: initialization, registration, and authentication.
4.1. Overview
In the privacy-preserving identity authentication scheme, the user independently generates their identity information () and corresponding public and private key pairs . Before implementing the authentication process, the user should send and to the authority for registration in order to obtain a valid identity proof (). It is worth noting that the user can generate several different certifications by different authorities to obtain multiple verifiable proofs. In order to achieve the authentication process, the user sends the publicly verifiable identity proof generated by the authority and the corresponding public information to the blockchain network in the form of a transaction. The transaction is finally added to the blockchain. After that, the user in the system can query other users’ public information through the blockchain and verify the user’s identity. After the authentication is completed, the users can negotiate a session key through shared secret parameters to ensure the privacy of subsequent session information.
4.2. Details of the Proposed Scheme
Next, we divided the proposed system into three phases which are described in detail, namely, initialization phase, registration phase, and authentication phase. The overall process of authentication is shown in Figure 2.
4.2.1. Phase 1: Initialization
The initialization phase can be divided into two parts. One part is the authorities and the blockchain network initialization. The other part is the user initialization. Initially, the users and the authorities initialize the system, and the system constructs a permissioned blockchain network, where users (DO and DU) are the participant and the miners are the maintainer of the blockchain. The users write transactions in order to provide identity authentication function. The miners verify the transactions in order to provide valid information for identity authentication. Specifically, the users and the authorities establish a consortium blockchain, and the miners who maintain the blockchain network rely on a practical Byzantine fault tolerance (PBFT) consensus mechanism. They execute the following operations to initialize a series of system parameters:(1)For two large primes , and an elliptic curve , there is a nonregular elliptic curve additive cyclic group of order and a generator of . Choose SHA256 as the encryption hash function , elliptic curve digital signature algorithm (ECDSA) as the signature algorithm , and RSA encryption algorithm as the asymmetric encryption algorithm .(2)The identity of the authority is marked as . The authority generates public and private key pairs . Then, publishes to the users in the system and the in the blockchain network.(3)The identity of the user is marked as . The user generates its own pseudo-identity and calculates by choosing a secret key . Then, pushes to the other users in the system and the in the blockchain network.(4)The users write a smart contract (SC) in order to provide the registration function, in which public and private key pairs are and .(5)The public parameters can be represented as .
4.2.2. Phase 2: Registration
(1)The user sends to through a secure channel.(2)Upon receiving the user’s message, firstly verifies . If has already been registered or it is invalid, rejects the request. Otherwise, generates a verifiable proof and its signature for , where is the valid time of the proof. Then, sends to the user through a secure channel.(3)Upon receiving from , the user sends the public information to the blockchain. Firstly, generates a timestamp and then computes and signature . Finally, the user sends to the blockchain network.(4)Upon receiving the message from , the verifies whether the timestamp is within the allowed range compared to the current time. If not, rejects the transaction; otherwise, continues to check whether the lifetime is within the allowed time. If not, stops the session. Otherwise, decrypts to get the proof and verifies the signature . If the signature is valid, writes this transaction to the blockchain. The user can generate several and corresponding public and private keys to obtain verifiable proofs of different authorities and store them locally.
4.2.3. Phase 3: Authentication
After a user’s and public key are added to the blockchain, the detailed authentication process is as follows:(1)User with identity first generates random value and timestamp and computes signature . Then, sends to user .(2)Upon receiving the message from , first verifies the timestamp and the signature. If is not within the allowed range compared to the current time or the signature is invalid, rejects the access request; otherwise, searches for on the blockchain with . If there is no , rejects the access request. Otherwise, verifies the signature with . If is invalid, stops the session; otherwise, the user’s identity is verified.
5. Security and Performance Analysis
5.1. Security Analysis
In this section, we first compare the proposed scheme with four other representative authentication schemes in terms of authentication, privacy preservation, scalability, and centralized trusted authority. Then, we introduce the security requirements and give the corresponding analysis.
The security requirements mainly include integrity, availability, scalability, nonrepudiation, identity authentication, and communication security. In addition, we compared the solution with the existing blockchain-based solutions in a comprehensive function. The comparison results are shown in Table 1. It can be seen from the table that our scheme not only supports identity anonymity, authentication, nonrepudiation, scalability, and decentralized functions but also has more advantages in privacy protection and communication security. In particular, the proposed scheme does not need to wait for the block confirmation and cross-blockchain operations during the authentication process.(i)Identity anonymity: identity anonymity means that other users cannot obtain the user’s true information through the user’s access request. In the proposed scheme, the user completes the identity registration by generating the identity information independently and uploads the corresponding valid proof to the blockchain network. First, the user can have multiple information independent of the real identity, and the information is also independent of each other. Secondly, in the process of performing authentication, users also use information independent of identity information, so the validity of user identity can be guaranteed.(ii)Authentication: authentication means that two users need to be identified before they interact. The authentication scheme proposed in this paper is the identity information generated by the user independently, and the registration of the identity and the disclosure of the effective proof are completed by the blockchain network, that is, the effective proof is stored in the blockchain network. The authenticating party can identify the authenticated party by accessing the blockchain and realize identity authentication.(iii)Integrity: the security requirements for integrity mainly include two aspects: data integrity and message integrity. Data integrity means that unauthorized users and devices cannot access and modify the data. Message integrity means that the message sent by the user and the device cannot be tampered with illegally during the interaction. The authentication process of this scheme is realized with the help of the blockchain. The core of the verification is that the user transmits the valid identity certificate to the blockchain network and stores it in the form of a transaction. In the blockchain network, every transaction will be verified by miners, so the integrity of the message can be guaranteed. In the proposed scheme, the user’s data are stored on the blockchain network. Once the verified data are stored, it will be difficult to be tampered with, so the data integrity can be effectively guaranteed.(iv)Nonrepudiation: nonrepudiation means that users and devices cannot reject the operations they have implemented and the messages they send. Since the scheme is carried out through the blockchain, all operations are stored in the blockchain in the form of transaction records, and all access requests and transactions are signed; therefore, the scheme is undeniable.(v)Scalability: scalability is one of the important security requirements of blockchain identity authentication. Due to the time delay characteristics of the blockchain, if users frequently complete identity authentication through transactions, it will consume a lot of resources and time. In the scheme designed in this paper, users only need to complete the corresponding proof data on the blockchain during the registration phase. In the identity authentication phase, there is no need to wait for block confirmation, and there is only a need to search the data on the blockchain to complete the identity authentication. For scalability requirements, this solution can be well adapted.(vi)Privacy preservation: privacy protection mainly refers to the privacy and security of the user data and identity in the storage process. In the schemes in [13, 21, 36], the authority can know the identity of the user during the registration phase, and then the authority will store the information on the blockchain. In addition, the identity identifier used in the above solution is the unique identity of the device/user. This results in that the user’s identity information is stored in the blockchain in the plaintext, which will result in the user’s identity information not being protected during the communication process, and it also faces the security risks of the storage process. Different from using unique identities to achieve authentication, users in our solution can create multiple independent identities according to their needs. Although the authority can still know the user’s identity, the user can hash the identity information and independently decide whether to store the information on the blockchain. In addition, when storing, the message is encrypted by an encryption algorithm, so the proposed scheme has more advantages in privacy protection. Therefore, the proposed scheme can more comprehensively realize privacy protection.(vii)Communication security: communication security refers to the security of the user’s communication data during the identity authentication process. In the scheme proposed in [13, 36], the certification information used for authentication not only contains the unique identities of the authenticated parties but is also transmitted in the blockchain network in the form of a plaintext. In the scheme proposed in [21], the security of communication is achieved by establishing a blockchain-level bubble, which can be seen as establishing a safe environmental space. Different from the method in the above schemes, the communication security in the proposed scheme is realized by cryptography methods. In the registration stage, the user uses public key information to register, and then when transmitting the identity certificate, the method of symmetric data encryption is used to ensure the security of data transmission. In the authentication process, on the one hand, the user does not need to send a complete certificate. On the other hand, the identity identifier used in the authentication is not unique. Therefore, the proposed scheme has obvious advantages in communication security.(viii)Cross-blockchain: cross-blockchain authentication refers to whether a hybrid blockchain combining a private blockchain and a public blockchain is used in the process of implementing the authentication scheme. For different blockchains, each individual blockchain network is a relatively independent network. The block structure and the deployment of the consensus mechanism may be different, data information is difficult to interconnect and synchronize, and there is a problem of information islands. This makes it difficult to collaborate between different blockchain networks and greatly limits the development of blockchain applications. Therefore, avoiding the use of hybrid blockchains to complete identity verification and avoiding cross-domain identity verification are also issues that need to be considered. Different from the cross-blockchain identity authentication scheme designed in scheme [13], the proposed scheme in this article, only a single blockchain is used to record the credential information, thereby avoiding the security risks caused by cross-chain authentication.(ix)Block confirmation: block confirmation refers to whether it is necessary to wait for a transaction during the identity authentication process. In the scheme proposed in [13, 36], the identity authentication process needs to invoke the smart contract in the blockchain, so it needs to wait for the execution of the smart contract and the confirmation of the relevant block, but in this proposed scheme, the verifier only needs to search the blockchain once to complete the identity verification without waiting for the confirmation of the transaction block. In terms of time cost, the authentication time of using smart contracts depends on the time to reach consensus in the blockchain. In the proposed scheme, the authentication time mainly depends on the search time for related information.
5.2. Performance Evaluation
In this section, we conduct experiments to evaluate the effectiveness and feasibility of our scheme. We employ the related cryptographic operations in the C/C++ OPENSSL library [37]; the parameters used are shown in Table 2.
The complex calculations and large-capacity storage required in the authentication process are placed on the blockchain. In order to realize user identity authentication based on the blockchain, a valid and public identity proof is stored on the blockchain. In this part, we mainly analyze the performance of the registration process and the identity authentication process. Since there are few existing blockchain-based identity authentication schemes, starting from the core idea of the scheme, the feasibility of the scheme is analyzed by analyzing the calculation cost, the communication cost, and the storage cost of each process in the scheme.
In the registration phase, the user first sends a request message to the authority. After receiving the proof returned by the authority, the user sends a registration transaction to the blockchain network. From the user’s point of view, it is necessary to execute the signature generation algorithm twice, the verification algorithm once, and the encryption algorithm once. Besides, the user needs to store the proof returned by and the pseudo-identity information () generated by himself. From the authority perspective, the signature generation algorithm needs to be executed once. For miners on the blockchain, it is necessary to execute the signature verification algorithm twice and the decryption algorithm once.
In the identity authentication phase, the user first sends a request to the verifier . After the verifier completes the message integrity check, it visits the blockchain network and completes the identity authentication by querying whether valid identity information exists. It needs to be pointed out that, at this stage, the verifier does not need to store any ’s information, which reduces a lot of storage overhead for the verifier. Therefore, at this stage, the access requester needs to execute a signature algorithm; the verifier needs to execute a verification algorithm and a blockchain search request. The search process here can be implemented by miners or corresponding smart contracts.
In order to show the performance of the solution more intuitively, the communication cost and the calculation cost at different phases are shown in Figures 3 and 4, respectively. Through the above analysis, this solution meets expectations and is feasible in terms of computing and storage overhead.
6. Conclusion
In this article, an identity authentication scheme based on blockchain-based privacy protection is proposed. The user generates identity information independently and completes the registration of identity certification through the blockchain. On the one hand, it can realize the protection of real identity information; on the other hand, it can avoid the storage overhead caused by the need to store a large number of certificates or key pairs. Due to the use of blockchain, there is no single point of failure in the authentication process, and it can be applied to distributed scenarios. Finally, the security analysis and performance evaluation demonstrate that the proposed scheme can meet the security requirements and is feasible.
Data Availability
The parameter data used to support the findings of this study are included within the article.
Conflicts of Interest
The authors declare that they have no conflicts of interest.
Acknowledgments
This research was supported by the National Key R&D Program of China (Grant no. 2017YFB1400700), the National Natural Science Foundation of China (Grant no. 62072487), the Natural Science Foundation of Beijing (Grant no. M21036), and the National Statistical Science Foundation of China (Grant no. 2020LD01).