# IMBIE: Identity Management with Blockchain Information Exchange

Lucas Airam Castro de Souza, Gabriel Antonio Fontes Rebello, Gustavo Franco Camilo, Miguel Elias Mitre Campista, Luís Henrique Maciel Kosmalski Costa

► To cite this version:

Lucas Airam Castro de Souza, Gabriel Antonio Fontes Rebello, Gustavo Franco Camilo, Miguel Elias Mitre Campista, Luís Henrique Maciel Kosmalski Costa. IMBIE: Identity Management with Blockchain Information Exchange. BRAINS 2024 - 6th Conference on Blockchain Research & Applications for Innovative Networks and Services, Oct 2024, Berlin, Germany. hal-04739279

HAL Id: hal-04739279

https://hal.science/hal-04739279v1

Submitted on 16 Oct 2024

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# IMBIE: Identity Management with Blockchain Information Exchange

Lucas Airam C. de Souza¹,², Gabriel Antonio F. Rebello¹,³,⁴, Gustavo F. Camilo¹, Miguel Elias M. Campista¹, Luís Henrique M. K. Costa¹

¹Universidade Federal do Rio de Janeiro (GTA/Poli/COPPE), Brazil

²École Polytechnique, INRIA Saclay

³Sorbonne Université, CNRS, LIP6, F-75005 Paris, France

⁴Instituto de Pesquisas Eldorado, Brazil

***Abstract***—Citizen identification is essential to allow access to basic services such as healthcare and education. Nevertheless, traditional identity management systems embrace approaches that are poorly scalable or detrimental to user security and privacy. We present a proposal for an identity management system based on blockchain interoperability. In our system, each domain maintains a blockchain to manage the identity of its users. Furthermore, the paper analyzes the technique of exchanging information between blockchains to implement the concept of bring your own identity (BYOI). Thus, the system mitigates scalability problems and guarantees users control over their data. The work developed is part of the project promoted by the National Network for Education and Research, “Identity Management with Information Exchange between Blockchains”.

## I. INTRODUCTION

Identity is one of a citizen's most precious assets. Only with documents that prove their identity, people are able to access basic rights such as voting, education, health, services, and employment. Despite its extreme relevance to the general welfare, approximately 1 billion people worldwide do not have access to any form of proof of identity today [1]. Nowadays centralization of identity management affects the speed of new records and the citizens who have records and entrust their data to centralized government storage. This process creates a single point of failure, implying multiple security vulnerabilities for user data, which becomes subject to, for example, information leakage and unavailability due to denial of service (DoS) attacks. Thus, ensuring a secure and unbureaucratic way of creating and proving identity is essential to reverse this situation.

Multifactor authentication [2] increases the security level, however, the centralization and the bureaucracy remain as current challenges. Blockchain technology presents itself as an alternative that can create simple and affordable Decentralized Identifiers (DID) in relation to common bureaucratic

processes [3], [4], [5]. Despite the use of blockchain, service providers such as Amazon or Google can limit identities inside their services. Thus, each identity created has validity only in the service provider domain, and is unknown by other services. Moreover, the difficulty of memorizing information for authentication and service access motivates users to take measures, which are detrimental to security, such as reusing data, storing information in plaintext, or at insecure locations. Thus, it is convenient to implement a blockchain-based identity system that requires users to store little information to access various services.

This paper proposes an architecture that applies the concept of Bring Your Own Identity (BYOI) by exchanging information between blockchains. The system has two types of blockchains: secondary and primary. Secondary blockchains store metadata of customer identities [6]. Thus, when a client creates an account in domain A, it stores the client data on its own server and includes the registered information hash in the blockchain. In this way, the proposal guarantees the user the integrity of his information registration and that his data is not public in the blockchain, reducing the cost of information storage and mitigating privacy issues. If the user wants to register in another domain, domain B issues a transaction to the primary blockchain with a request signed by the user. Domains monitor the primary blockchain and verify that a transaction has been issued with its identifier as the destination. Thus, domains can verify the user's signature and authenticate the request. Creating an identity allows the user to register a set of permissions for the domain to share information with third parties. These permissions can be secured in a distributed manner from smart contracts.

## II. THE PROPOSED ARCHITECTURE

Figure 1 illustrates our proposed system architecture. Blockchains provide some properties, such as immutability, transparency, and decentralization, necessary for security assurance in a scenario with multiple participants without mutual trust [7]. This architecture allows for high scalability, since each domain stores data only of its interest, and privacy,

<footnote>This study was financed in part by the Coordenação de Aperfeiçoamento de Pessoal de Nível Superior – Brasil (CAPES) – Finance Code 001. This paper was also funded by CNPq, FAPERJ, and Fundação de Amparo à Pesquisa do Estado de São Paulo (FAPESP), Grants 2015/24494-8, 2018/23292-0, 2015/24485-9, 2014/50937-1.</footnote>
<figure><img src="image_2.png" /><figcaption>Figure 1. Proposed identity management system architecture.</figcaption></figure>

since a domain holds information only from its clients, with
no access to information from other secondary blockchains.

The primary blockchain is responsible for registering re-
quests for identity information between domains. The primary
blockchain performs the necessary operations to guarantee in-
teroperability between the secondary blockchains and transfer
information requested by one domain to some other.

Secondary blockchains are responsible for registering user
information at the service provider domains. The domains
manage their own secondary blockchain. Thus, each domain
has full autonomy to manage its own blockchain, and can
privilege different aspects according to its preferences and
demands, such as faster and more efficient consensus mecha-
nisms and block parameters. Furthermore, domains manage the
record permissions and registration of their clients, without
revealing information to other domains. Identity registration
information is stored to ensure transparency to clients. To
ensure customer privacy, we store the personal data off-chain.
The blockchain transaction, however, presents the data hash
in a public way, providing integrity to the stored information.

The goal of this architecture with one blockchain per
domain is to mitigate the scalability problems of the number
of users by avoiding the existence of a single blockchain
responsible for storing all the data. We achieve scalability
by parallelizing the management of identities by different
domains in separate secondary blockchains.

III. PROTOTYPE IMPLEMENTATION

As a proof of concept, we implemented a prototype of the
proposed architecture to verify the feasibility of the solution<fnref n="2" />.
The implementation is based on the open source Hyperledger
Fabric 2.4 platform hyperledger. The organizational aspect
of the Fabric fits the multi-domain scenario of the proposed
architecture and the possibility of splitting the chain into
multiple logically isolated channels allows the simulation
of multiple local blockchains with different characteristics.

The scenario run with two domains that have their own
blockchains and perform the data exchange protocol de-
scribed in Section refsec:proposta. Besides implementing the
blockchain in Hyperldeger Fabric, code was also developed
in Python that implements the communication between the
domains, clients and blockchain for a proof of concept.

IV. CONCLUSION

This paper proposes an identity management system based
on the Bring Your Own Identity paradigm. The system has
the benefits of blockchain technology for creating identities
in a decentralized manner through a scalable solution with
multiple blockchains.

REFERENCES

[1] M. Pangestu et al., “ID4D Data: Global Identification Challenge by the Numbers,” The World Bank, Tech. Rep., 2022. [Online]. Available: https://id4d.worldbank.org/global-dataset

[2] E. Ribeiro de Mello, M. Silva Wangham, S. Bristot Loli, C. E. da Silva, G. Cavalcanti da Silva, S. A. de Chaves, and B. Bristot Loli, “Multi-Factor Authentication for Shibboleth Identity Providers,” *Journal of Internet Services and Applications*, vol. 11, pp. 1–21, 2020.

[3] S. Nakamoto, “Bitcoin: A Peer-to-Peer Electronic Cash System,” 2008, Last Access: 5th August 2024. [Online]. Available: https://bitcoin.org/bitcoin.pdf

[4] D. Reed, J. Law, and D. Hardman, “The Technical Foundations of Sovrin,” *The Technical Foundations of Sovrin*, 2016.

[5] G. A. F. Rebello, G. F. Camilo, L. A. C. de Souza, M. Potop-Butucaru, M. D. de Amorim, M. E. M. Campista, and L. H. M. Costa, “A Survey on Blockchain Scalability: From Hardware to Layer-Two Protocols,” *Communications Surveys & Tutorials*, 2024.

[6] P. Dunphy and F. A. Petitcolas, “A First Look at Identity Management Schemes on the Blockchain,” *IEEE Security & Privacy*, vol. 16, no. 4, pp. 20–29, 2018.

[7] G. A. F. Rebello, G. F. Camilo, L. C. Guimarães, L. A. C. de Souza, G. A. Thomaz, and O. C. Duarte, “A Security and Performance Analysis of Proof-Based Consensus Protocols,” *Annals of Telecommunications*, pp. 1–21, 2021.

<footnote n="2">²Available at https://github.com/GTA-UFRJ/giti-cb</footnote>