Securing Permissioned Blockchain via Credential Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Permissioned blockchain networks are vulnerable to pseudospoofing attacks due to the lack of effective control mechanisms, which can lead to unauthorized voting power and security breaches, particularly in scenarios where a single entity can create multiple validating nodes to dominate the network.
Innovation Solution
Implementing a consensus mechanism using replicated chaincode that enforces governing rules for block creation, where each node is limited to a single credential, and an access control list is used to validate credentials, ensuring that only authorized nodes participate in consensus decisions, thereby preventing Sybil attacks and ensuring secure voting processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a permissioned blockchain network allows multiple validating nodes per organization for redundancy, then network reliability is improved, but the risk of pseudospoofing attacks increases
Solution Approach 1:
The patent segments the credential validation process into distinct components: credential identification, access control list verification, and consensus validation. This segmentation allows the system to enforce one-credential-per-organization rules while still permitting multiple validated nodes for redundancy, resolving the contradiction between reliability and security risk
Solution Approach 2:
The patent introduces an intermediary access control list that mediates between organizations and the blockchain network. This intermediary structure verifies credentials and enforces voting power limits, allowing redundant nodes while preventing pseudospoofing by ensuring each organization's credentials are properly validated and limited
2Reliability
If a single organization controls multiple validating nodes, then network redundancy is improved, but voting power concentration increases
Solution Approach 1:
The patent applies local quality by assigning different roles and credential types to different nodes within the same organization. The access control list distinguishes between primary and backup nodes, allowing redundant infrastructure while maintaining proper voting power distribution through role-based credential validation
Solution Approach 2:
The patent changes the parameter of credential validation by implementing a one-credential-per-organization rule in the access control list. This parameter change ensures that while organizations can have multiple nodes for redundancy, each organization's voting power is capped at one credential, preventing power concentration
3Speed
If the blockchain network uses traditional consensus mechanisms without credential validation, then consensus speed is maintained, but security against Sybil attacks deteriorates
Solution Approach 1:
The patent implements preliminary action by validating credentials against the access control list before the consensus process begins. This pre-validation ensures that only authorized nodes with proper credentials can participate in consensus, preventing Sybil attacks while maintaining consensus speed through efficient credential verification
Data Source
AI summary
An example operation may include one or more of identifying a new block to be created for a blockchain via a new block creation cycle, executing chaincode stored in the blockchain, identifying one or more credentials assigned as one credential per registered member organization of the blockchain based on the chaincode, validating the one or more credentials and determining consensus is satisfied via a consensus service, and creating the new block responsive to the consensus being satisfied.