System and method for blockchain-based device authentication based on a cryptographic challenge
A system for blockchain-based authentication comprises an interface and a processor configured to (i) receive, by a first device, a command from a second device, where the first device is associated with a first trust certificate, (ii) receive a second trust certificate from the second device, (iii) communicate a cryptographic challenge using a public key of the second device to the second device, (iv) receive a response to the cryptographic challenge from the second device, (v) check whether the response matches with a predetermined correct response or not, and (vi) authenticate the second device and execute the commend received from the second device only if the response matches with the predetermined correct response.
1. A processor implemented method for blockchain-based authentication, the method comprising:
receiving, by a first device, a command on behalf of a user linked to a user device to perform an action from a second device, wherein:
a blockchain includes identity information associated with the user;
the identity information uniquely identifies the user;
a set of credentials include a blockchain-compatible public-private key pair associated with the user that is created using a hardware-based cryptographic processor on the user device;
the blockchain-compatible public-private key pair associated with the user includes a user private key and a user public key;
the user device stores the identity information and the set of credentials on the blockchain to link the identity information and the set of credentials for the user; and
the first device is associated with a first trust certificate signed by the user device based on a user private key associated with the user on a blockchain, wherein the first trust certificate indicates that the user device trusts the first device to perform the action on behalf of the user;
the second device is associated with a second trust certificate signed by the user device based on the user private key associated with the user on the blockchain; and
receiving the second trust certificate from the second device, wherein the second trust certificate comprises a public key of the second device which is associated with a user public key of the user device; and
in response to receiving the command and the second trust certificate:
communicating a cryptographic challenge using the public key of the second device to the second device;
receiving a response to the cryptographic challenge from the second device;
checking, using the public key of the second device, whether the response matches with a predetermined correct response or not; and
authenticating the second device and executing the command received from the second device in response to the response matching with the predetermined correct response.
2. The method of claim 1 , wherein the identity information comprises one or more of: a user's password, a biometric, and/or a PIN code.
3. The method of claim 1 , wherein the user private key cannot be extracted out of the hardware-based cryptographic processor by one or more of: a device manufacturer, an operating system manufacturer, a user, and/or a manager of an open identity network.
4. The method of claim 1 , wherein the cryptographic challenge comprises a random value.
5. The method of claim 1 , wherein the response to the cryptographic challenge from the second device comprises the cryptographic challenge encrypted with a private key of the second device.
6. The method of claim 1 , wherein the response to the cryptographic challenge from the second device comprises the cryptographic challenge encrypted with a private key of the second device.
7. The method of claim 1 , wherein the predetermined correct response comprises the cryptographic challenge.
8. A system for blockchain-based authentication, the system comprising:
an interface configured to:
receive, by a first device, a command on behalf of a user linked to a user device to perform an action from a second device, wherein:
a blockchain includes identity information associated with the user;
the identity information uniquely identifies the user;
a set of credentials include a blockchain-compatible public-private key pair associated with the user that is created using a hardware-based cryptographic processor on the user device;
the blockchain-compatible public-private key pair associated with the user includes a user private key and a user public key;
the user device stores the identity information and the set of credentials on the blockchain to link the identity information and the set of credentials for the user; and
the first device is associated with a first trust certificate signed by the user device based on a user private key associated with the user on a blockchain, wherein the first trust certificate indicates that the user device trusts the first device to perform the action on behalf of the user;
the second device is associated with a second trust certificate signed by the user device based on the user private key associated with the user on the blockchain; and
receive the second trust certificate from the second device, wherein the second trust certificate comprises a public key of the second device which is associated with a user public key of the user device; and
a processor configured to:
in response to receiving the command and the second trust certificate:
communicate a cryptographic challenge using the public key of the second device to the second device;
receive a response to the cryptographic challenge from the second device;
check, using the public key of the second device, whether the response matches with a predetermined correct response or not; and
authenticate the second device and execute the command received from the second device in response to the response matching with the predetermined correct response.
9. The system of claim 8 , wherein the identity information comprises one or more of: a user's password, a biometric, and/or a PIN code.
10. The system of claim 8 , wherein the user private key cannot be extracted out of the hardware-based cryptographic processor by one or more of: a device manufacturer, an operating system manufacturer, a user, and/or a manager of an open identity network.
11. The system of claim 8 , wherein the cryptographic challenge comprises a random value.
12. The system of claim 8 , wherein the response to the cryptographic challenge from the second device comprises the cryptographic challenge encrypted with a private key of the second device.
13. The system of claim 8 , wherein the response to the cryptographic challenge from the second device comprises the cryptographic challenge encrypted with a private key of the second device.
14. The system of claim 8 , wherein the predetermined correct response comprises the cryptographic challenge.
15. A non-transitory computer program product for blockchain-based authentication, the non-transitory computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
receiving, by a first device, a command on behalf of a user linked to a user device to perform an action from a second device, wherein:
a blockchain includes identity information associated with the user;
the identity information uniquely identifies the user;
a set of credentials include a blockchain-compatible public-private key pair associated with the user that is created using a hardware-based cryptographic processor on the user device;
the blockchain-compatible public-private key pair associated with the user includes a user private key and a user public key;
the user device stores the identity information and the set of credentials on the blockchain to link the identity information and the set of credentials for the user; and
the first device is associated with a first trust certificate signed by the user device based on a user private key associated with the user on a blockchain, wherein the first trust certificate indicates that the user device trusts the first device to perform the action on behalf of the user;
the second device is associated with a second trust certificate signed by the user device based on the user private key associated with the user on the blockchain; and
receiving the second trust certificate from the second device, wherein the second trust certificate comprises a public key of the second device which is associated with a user public key of the user device; and
in response to receiving the command and the second trust certificate:
communicating a cryptographic challenge using the public key of the second device to the second device;
receiving a response to the cryptographic challenge from the second device;
checking, using the public key of the second device, whether the response matches with a predetermined correct response or not; and
authenticating the second device and executing the command received from the second device in response to the response matching with the predetermined correct response.