Decentralized Cross-Network Identity Management for Blockchain Interoperation

Abstract

Interoperation for data sharing between permissioned blockchain networks\nrelies on networks' abilities to independently authenticate requests and\nvalidate proofs accompanying the data; these typically contain digital\nsignatures. This requires counterparty networks to know the identities and\ncertification chains of each other's members, establishing a common trust basis\nrooted in identity. But permissioned networks are ad hoc consortia of existing\norganizations, whose network affiliations may not be well-known or\nwell-established even though their individual identities are. In this paper, we\ndescribe an architecture and set of protocols for distributed identity\nmanagement across permissioned blockchain networks to establish a trust basis\nfor data sharing. Networks wishing to interoperate can associate with one or\nmore distributed identity registries that maintain credentials on shared\nledgers managed by groups of reputed identity providers. A network's\nparticipants possess self-sovereign decentralized identities (DIDs) on these\nregistries and can obtain privacy-preserving verifiable membership credentials.\nDuring interoperation, networks can securely and dynamically discover each\nothers' latest membership lists and members' credentials. We implement a\nsolution based on Hyperledger Indy and Aries, and demonstrate its viability and\nusefulness by linking a trade finance network with a trade logistics network,\nboth built on Hyperledger Fabric. We also analyze the extensibility, security,\nand trustworthiness of our system.\n