Membership Services

One of the main security challenges in Open Blockchain is reconciling transactional privacy with identity management in order to enable competitive institutions to transact effectively on a common blockchain (for both intra- and interinstitutional transactions). This is achieved by forming a privacy-preserving permissioned network. The permissioned nature of this system is achieved as follows:

• Define a policy to determine the conditions under which a new entity can participate in transaction processing, evaluation, and validation (i.e., join the set

of validators or endorsers of the system).

• • Issue system certificates to all entities that are eligible to join the set of validators or endorsers, according to a predefined policy.
• • Instruct validators to accept transaction evaluation-related messages from only certified validators of the system.
• • Define a policy to determine the conditions under which a new entity can join the set of users of the system (i.e., submit transactions to the network of validators). That is, announce messages that would allow them to deploy Open Blockchain contracts, referred to as chaincodes, or invoke already deployed chaincodes.
• • Issue system certificates to all entities that request membership to Open Blockchain system and fulfill the conditions listed in the corresponding policy.
• • Instruct validators to only accept transactions that are authenticated to originate by properly formed certificates.

Membership services registration is an off-line process through which users prove that they satisfy the membership conditions defined in the associated Blockchain membership policy. To facilitate needs for privacy-preserving transactions, upon proper registration users can issue two types of credentials.

• - Enrollment certificates (ECerts) that carry user’s identity or long-term user- identifier in the system, also referred to by enrollment identity.
• - Transaction certificates (TCerts) that faithfully but pseudonymously represent enrolled users. That is, transaction certificates do not carry the enrollment identity of their owner in the clear; on the contrary, enrollment identity of the owner of a transaction certificate is incorporated in the transaction certificate such that the former can only be revealed/proven with the consent of the transaction certificate owner or an auditor.

During enrollment, users generate two key-pairs. The first is an ECDSA key- pair that facilitates authentication of a long-term user identity. The second is an elliptic curve Diffie Hellman (ECDH) key-pair that allows users to establish secret communication channels within Open Blockchain transactions. Both key-pairs are generated at the client side. The secret signing and decryption keys are maintained in user premises and never shared with the membership service authorities. On the other hand, the public signature verification, and encryption keys generated during a user enrollment, are encapsulated in the user’s enrollment certificate.

Transaction certificates are issued upon an enrolled user request, and as discussed previously, contain the identity of their owner in encrypted form. Transaction certificates contain public signature keys, to enable a transaction certificate owner authentication in transactions. These keys are generated using the enrollment signature key-pair as a basis, and their secret material is also solely accessible by their owner.

Users can use their certificates to authenticate themselves as valid users of the system. In particular, Open Blockchain membership protocols guarantee the following security properties:

• • Unforgeability of proof of certificate owner. That is, a computationally bounded attacker is not able to prove ownership of a credential he or she is not owning without the collaboration of the credential’s owner. This property also requires that information endorsed by a certificate cannot be altered in such a way that the same certificate appears to have properly endorsed something else without the collaboration of the certificate’s owner.
• • Nonrepudiation. Users equipped with a certificate to endorse a piece of information (e.g., a transaction) cannot deny having generated the endorsement (i.e., repudiate their endorsement).
• • Nonframeability. A computationally bounded attacker is not able to create an endorsement to a message that appears to have been generated by a certificate that it does not own.
• • Anonymity. Anonymity requires that a certain transaction certificate or transaction certificate endorsement on any message does not distinguish the identity of a signer with better probability than choosing this identity at random among the members of the system.
• • Unlinkability. Unlinkability requires that a set of transaction certificates or certificate endorsements cannot be linked together as having been generated by the same identity.

In the current version of Open Blockchain, the user and validator registration, and the associated issuing of credentials in Open Blockchain are performed by membership services that leverage a few trusted membership authorities (all of which are potentially controlled by the same central authority). In particular, membership services in Open Blockchain are facilitated with the help of four (trusted) entities:

• • Registration authority. The registration authority evaluates candidate system participant credentials and adds these entities to the database of registered users or validators. The database is automatically shared with the other components of membership services.
• • Enrollment certificate authority. This authority issues enrollment certificates upon registered users' or validators' request.
• • Transaction certificate authority. This authority issues transaction certificates upon enrolled users' requests.
• • TLS certificate authority. This authority issues TLS certificates to registered users/validators. It also issues TLS certificates to the other components of the membership service.

At the time the time of writing, there were discussions of moving the functionality of membership services in Open Blockchain to a decentralized network.