# Blockchain-Based Multistage Continuous Authentication for Smart Devices
## 4 System Model
### System Framework  
In order to improve the problem model of the identification, this paper proposes an authentication system based on blockchain technology. The data flow of the system's storage scheme is shown in Figure 5. The modular components included are the client, service provider, IPFS, and Hyperledger Fabric:  
1. The client packages the identity data of the registered user to request the server. The server provider preprocesses the data. The identity data includes username, biometric information, and documentation information.
2. The server provider cannot store the user data for storage; at the same time, the server itself has weak computing power. Therefore, the server provider will upload user data to the peer node in the IPFS network to realize data storage and backup. In addition, the user name and document information will also be stored in the blockchain through transactions.
3. The IPFS creates a hash address of the uploaded biometric information and returns it to the server provider, which ensures that there are no files sharing the same hash. During the authentication process, the IPFS searches files by their content identifiers, rather than by their location.
4. The server provider packages the username, document information, and hash address to perform the chaining operation. This scheme adopts Hyperledger Fabric to store and manage the data in the system and at the same time utilizes smart contracts to realize the interaction with the server provider.
5. The interaction information will be fixed to the block through transactions in Fabric to realize the persistent storage of related data. The blockchain returns whether the upload has succeeded.
6. Successful uploading means that the client has applied for the service successfully on the server provider. If the upload fails, the server returns the reason for failure to the client.  
The specific implementation details for registration and authentication are as follows. The framework of the identity registration model based on the blockchain is shown in Figure 6. The client filters the optimal combination \(\omega_{i}\). The fuzzy extractor receives the biometric vector \(\omega_{i}\) and generates the user's random key \(R_{i}\) and public information \(P_{i}\) using a random character generation algorithm. It returns the random key \(R_{i}\) to the APP client. In the identity chain, each service provider acts as a node. The client inputs the hash-processed user biological key \(HR_{i}\) and document information to the service node that has write access. Then, the service node writes the user's random key \(R_{i}\) to the IPFS, which  
Figure 5: System model.  
returns the hash address of the file upon successful deposit. The service node stores the user ID, hash of document information, and hash address in the blockchain. The service and public key will be returned to the client if the message is successfully uploaded.  
When the user requests the service again, the authentication operation needs to be completed. The framework of the multistage authentication model based on blockchain technology is shown in Figure 7. The client packages the data firstly and sends the data to the server provider. In the first stage of authentication, the system retrieves the user's information in the blockchain based on the user's name. The strategy compares the user's document information and returns the hash address of the file if it matches. Successful authentication in the first stage indicates that the user's document information is verified. In the second stage of authentication, the user's random key \(HR_{i}\) is searched in the IPFS based on the preoutput of the first stage. This step compares whether the random key in the IPFS is consistent with the key generated at the time of input. If it is identical, it means the user's biometric information is authenticated successfully in the second stage.