Skip to main content
U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Smart Contract Federated Identity Management without Third Party Authentication Services

Published

Author(s)

Peter M. Mell, James F. Dray Jr., James Shook

Abstract

Federated identity management enables users to access multiple systems using a single login credential. However, to achieve this a complex authentication has to occur between the user, relying party (RP) (e.g., a business), and a credential service provider (CSP) that performs the authentication. In this work, we use a smart contract on a blockchain to enable an architecture where the CSP is no longer needed. This has all the same benefits of traditional federated identity management solutions but authentication is performed solely through user to RP communications. No third party needs to be contacted (not even the smart contract). No public key infrastructure (PKI) needs to be maintained. And no revocation lists need to be checked. Our resultant solution has additional strengths. It is hierarchically managed (like a PKI) which enables authoritative data to be added about users, but it still enables a level of user self- sovereignty. Users can to choose to be authoritatively identified (when they desire to do so) and provide their attributes to RPs to support business interactions. Privacy is maintained by encrypting user attributes such that only the user can view and share them.
Proceedings Title
Open Identity Summit 2019
Volume
293
Conference Dates
March 28-29, 2019
Conference Location
Garmisch-Patenkirchen

Keywords

federated identity management, authentication, smart contract, blockchain, self-sovereignty

Citation

Mell, P. , Dray, J. and Shook, J. (2019), Smart Contract Federated Identity Management without Third Party Authentication Services, Open Identity Summit 2019, Garmisch-Patenkirchen, -1, [online], https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=925957 (Accessed May 29, 2024)

Issues

If you have any questions about this publication or are having problems accessing it, please contact reflib@nist.gov.

Created March 28, 2019, Updated May 1, 2019