Self-Sovereign Identity using Smart Contracts on the ...

1 Self-Sovereign Identity using Smart Contractson the ethereum BlockchainbyZachary DieboldDissertationPresented to theUniversity of Dublin, Trinity Collegein fulfilmentof the requirementsfor the degree ofMaster in Computer ScienceUniversity of Dublin, Trinity CollegeSupervisor: Dr. Donal O MahonyMay 2017 Declaration of AuthorshipI, Zachary Diebold, declare that the following dissertation, except where otherwisestated, is entirely my own work; that it has not previously been submitted as an exercisefor a degree, either in Trinity College Dublin, or in any other University; and that thelibrary may lend or copy it or any part thereof on DieboldMay 18, 2017iSelf-Sovereign Identity using Smart Contractson the ethereum BlockchainZachary Diebold, Master in Computer ScienceUniversity of Dublin, Trinity College, 2017 Supervisor: Dr.

2 Donal O MahonyCentralised Identity services that exist today fail to operate transparently and protectthe rights of users. Single points of trust present constant operational risks for bothcompanies and individuals. Self-Sovereign Identity is a solution to address this, whichspecifies a user-focused approach that gives full control of an Identity back to theindividual. This paper proposes the blockchain, a secure and decentralised trust-lesssystem, as the platform to achieve this. A proof-of-concept Identity system for theEthereum blockchainis designed and developed in this contractsareused to facilitate the secure storage and open processing of user data. It also presentsa novel approach to the secure recovery of encrypted private data. Emphasis is placedon the implementation security, information privacy and data recovery procedures ofthe Identity systems that exist today are fragmented between service need to duplicate their Identity information between services, which reducesoverall usability and increases the risk of data addition, logically centralised providers that offer single sign-on methods restrictthe end-user from controlling how their data is stored and processed.

3 Trusting cen-tralised entities to manage sensitive information can lead to issues like Identity theft,data leaks and privacy Identity is a user-focused approach to Identity management, thatensures full data control and transparency is retained by the individual. Self-sovereignidentity also serves to protect the rights of the users from the ever-increasing controlof centralised technology offers a decentralised , transparent and immutable platformon which to safely transmit and track assets like digital currency. The Ethereumblockchain extends this concept by allowing programmable pieces of code known assmart contractsto be executed. These Smart Contracts can manage digital currency,and store and verify arbitrary paper investigates existing Identity solutions, blockchain technology and de-centralised systems.

4 It then proposes a solution implemented with ethereum smartcontracts that encompasses the elements of cryptographic security, operational trans-parency, data autonomy and account recoverability. It is finally evaluated under a setof design objectives and comprehensive security d like to express my sincere gratitude to the following people for their support: My supervisor, Dr. Donal O Mahony, for his unwavering enthusiasm, immenseguidance and continuous support throughout my research. The kind folks over at IPFS, uPort and the Solidity support channels for theirextensive answers and technical advice. My fellow classmates in Integrated Computer Science, for their shared advice,dedication and energy during our college career. Finally, my loving family, for their constant encouragement, help and guidancethroughout all my endeavours in DieboldUniversity of Dublin, Trinity CollegeMay 2017ivContentsDeclaration of AuthorshipiAbstractiiSummaryiiiAcknowled gementsivList of FiguresxList of TablesxiList of Acronymsxii1 Motivation.

5 Research Objectives .. Use Cases .. Technical Approach ..42 Digital Introduction .. Your Customer .. Identity .. Identity Management Systems .. Public Key Infrastructure .. Authorities .. Authorities .. of Trust ..163 Introduction .. Wallets .. Consensus .. ethereum .. Contracts .. Virtual Machine .. decentralised Storage .. Blockchain Identity Systems .. e-Residency ..284 Solution System Overview .. Contracts .. Creation .. Attributes .. Signing .. Disclosure .. Recovery .. Revocation ..36vii5 Components .. Framework .. Signing .. Interface .. Screen .. Transfer .. Additional Features .. Wallet Seed .. Attribute Privacy ..426 Security Attack Considerations.

6 Replay Attack .. Attack .. Compromise .. Attack ..467 Research Objectives .. Future Work .. Release ..50 Bibliography52viiiAppendices59 Appendix A Contract Source Identity Contract .. Recovery Contract .. Project Repository ..62ixList of How the Bitcoin blockchain propagates transactions .. Identity Creation: Key generation and contract deploy steps.. Attribute Disclosure: Steps to disclose user attributes to a third Identity Recovery: Steps to recover an Identity using a network oftrusted peers.. Home Screen: Initial view of a user s Identity on the platform.. Signature Request: An example using a QR code to request a signature. 41xList of Identity contract storage variables .. Recovery contract storage variables.

7 Message types and values for passing data between users..41xiList of AcronymsPKIP ublic Key InfrastructureGDPRG eneral Data Protection RegulationKYCKnow Your CustomerAMLAnti-Money LaunderingIPFSI nterPlanetary File SystemOPOpenID ProviderRPRelying PartySAMLS ecurity Assertion Markup LanguageSSOS ingle Sign-OnMSDMean Shortest DistanceCACertificate AuthorityUUIDU niversally Unique IdentifierJSONJavaScript Object NotationOCSPO nline Certificate Status ProtocolxiiDLTD istributed Ledger TechnologyMRZM achine Readable ZoneDHTD istributed Hash TableIPNSI nterPlanetary Naming SystemRPCR emote Procedure CallBIPB itcoin Improvement ProposalPIIP ersonally Identifiable InformationxiiiChapter 1 IntroductionThis section introduces the motivation for the dissertation work. The background tothe field is explored, as well as the desired research objectives and possible , the technical approach to implementing the planned work is MotivationThe concept of Identity is fundamental to human activities.

8 The Identity of an individ-ual, their attributes, and representation ofthe selfis understood worldwide regardlessof culture. Psychological and social well-being is also said to be dependent on main-taining a stable personal Identity [1].Modern society binds the notion of individual Identity with a legal Identity , such associal security numbers, passports and driving licences. This binding leads to situationswhere one can lose their Identity if the state rescinds it. It is especially apparent in thecase of refugee crises, where migrants have difficulty living in countries in which theyare not Identity represents entities such as people and organisations in an online1 Chapter 1. Introduction2context. In its current state digital Identity is siloed between providers, necessitatingthe creation of many identities across the to this fragmentation, users eventually link multiple identities to their legalidentity over time, which can pose risks of Identity theft, privacy breaches and dataleaks [2].

9 As the digital world becomes more prevalent in everyday life and the quantity ofinternet-connected devices increases, the risks of trusting disparate centralised servicesbecome very high. As a result of this, an opportunity arises to redefine modern conceptsof digital Identity in a decentralised Research ObjectivesSelf-sovereign Identity is the notion that an individual should have complete authorityover their digital Identity and its data. It removes control from centralised entities andpushes it out to the edges of the network, the users core mission of blockchain technology is to provide a decentralised trust net-work. This can be mapped nicely onto the problems with centralised system trust inthe Identity , this dissertation proposes a system using the ethereum blockchain, a de-centralised application platform, to create a Self-Sovereign Identity solution.

10 Such asolution, in pursuit of this goal, should conform to the following Security: Identities and their corresponding attributes should be storedin a secure manner, to prevent data compromise. Access and modification of userdata should be restricted to the sole owner of the 1. Usability: To interface with the system, it should not require priorknowledge of the underlying blockchain technology, key management proceduresor encryption protocols. Public Key Infrastructure (PKI) is an example of asystem that has not reached widespread consumer adoption, partly due to poorsystem usability [3]. Verifiability: Individuals should be uniquely identifiable in the sys-tem, and have the ability to prove ownership of their information. Externalentities should be able to attest to the attributes of an Recovery: The system should allow for Identity recovery in the caseof device loss or data compromise.