A blockchain-based IAM platform that removes passwords entirely and gives users cryptographic ownership of their personal data — proven by a working three-app implementation.
Identity management systems today are mostly centralized — user identity data sits in a single location that then grants access to applications. That architecture invites data breaches and identity theft because of the single repository, and raises privacy concerns since a central authority controls users' information, creating risks of unauthorized surveillance and misuse.
This project proposes a decentralized identity management system using blockchain to address those challenges. Users control their information securely on blockchain nodes, mitigating breach and privacy risks. Focused on Personally Identifiable Information (PII), it provides an access-control system that lets users selectively grant or revoke access to their data.
It adds a passwordless authentication system built on Public Key Infrastructure (PKI), using public-key cryptography to strengthen security while eliminating traditional passwords. Together, decentralized identity and passwordless auth make digital identities more private, safe, and less dependent on passwords.
Centralized stores are a single point of failure and a locus of control over sensitive data. This IAM system decentralizes PII onto blockchain nodes and authenticates through PKI to fix both.
Distributing data across a network of nodes removes the traditional single point of failure and raises the system's overall resilience.
Cryptographic keys let users authenticate seamlessly across devices, cutting the credential-related incidents that plague password systems.
PII stays under the owner's control — access to each field can be selectively granted or revoked on demand.
No password to remember means nothing to phish. Reliance on keys adds a layer of protection against credential compromise.
Flip the switch. In a centralized system one breach exposes everyone; in the proposed model data is distributed across nodes and encrypted with keys only the user holds.
Centralized model. Every application reads and writes the same store. One compromised endpoint puts every user's PII at risk — the classic single point of failure the paper sets out to remove.
Decentralized model. Records are distributed across blockchain nodes; only the on-chain public key and non-secret profile fields ever touch the chain. Private keys and sensitive data never do.
The implementation splits into three apps talking over a REST + WebSocket backend. Click a card to focus it. The backend is a broker — it never stores plaintext PII.
keys.json, data.json, cmgmt.json — while the chain holds only the identity registry.user.solA minimal Solidity contract maps a wallet address to a public profile. Only the public key and non-secret fields are ever written on-chain.
The system uses one algorithm to prove identity and another to protect data at rest — the private key never leaves the user's device in either.
The third party encrypts a one-time code with the user's on-chain public key. Only the matching private key can read it — that's the proof of identity.
Sensitive values are encrypted client-side with a key derived from the user's wallet before being stored off-chain, and decrypted only inside the user's own app.
Step through the challenge–response ceremony, relayed over WebSockets. A random 10-digit one-time code encrypted with the public key can only be answered by the private-key holder — no password is ever exchanged.
The relying party requests a field with a purpose and expiry. If no valid consent exists, the wallet shows an Accept / Revoke prompt — and every grant is logged with an expiry date.
Sourced from the project repository — the exact ceremonies the running apps perform.
Tap a card for each tool's role in the system.
Implemented and published to GitHub. The frontends call the backend at localhost:3735; open the user and third-party apps in separate tabs.
This is a demonstration / educational project built around a local Ganache chain — it is not production-hardened. Off-chain keys are stored in plaintext JSON, the session cookie is a bare wallet address, and there's no rate-limiting or transport encryption on the local WebSocket. The goal is to illustrate the architecture of passwordless, consent-driven, blockchain-backed IAM, not to ship it as-is.
By leveraging blockchain for storage and PKI for authentication, the system removes the central point of failure and the password as attack surface at the same time. Decentralized identity plus passwordless auth enhances security, reduces dependence on traditional passwords, and — without asking the user to do more than approve a prompt — keeps digital identity private, safe, and firmly in the owner's hands.