Blockchain Based identity Management System

Blockchain wallet
Credentials Showing
wallet Creation
Verifier verify a Credentials
Issuer Issue a credentials

Inspiration

Our digital identity is broken. We live in a world where our personal data is not our own. It's scattered across countless centralized databases—owned by banks, social media giants, and governments. This model is flawed at its core: it results in massive data breaches, gives users zero control, and forces us to over-share sensitive information (like our full driver's license) just to prove one simple fact (like our age). We were inspired to build a new system based on the principles of Self-Sovereign Identity (SSI). We wanted to create a prototype where: Users Own Their Data: Your identity lives in a wallet you control, not on a company's server. Privacy is Paramount: You only share what is necessary, when it's necessary. Security is Unbreakable: Your identity is secured by something only you have. Our inspiration was to build a system that doesn't just protect your identity with a password that can be stolen, but links it directly to your physical self-using biometrics.

What it does

Here is a complete story and breakdown of your project, formatted for a presentation, portfolio, or hackathon submission.InspirationOur digital identity is broken. We live in a world where our personal data is not our own. It's scattered across countless centralized databases—owned by banks, social media giants, and governments. This model is flawed at its core: it results in massive data breaches, gives users zero control, and forces us to over-share sensitive information (like our full driver's license) just to prove one simple fact (like our age).We were inspired to build a new system based on the principles of Self-Sovereign Identity (SSI). We wanted to create a prototype where:Users Own Their Data: Your identity lives in a wallet you control, not on a company's server.Privacy is Paramount: You only share what is necessary, when it's necessary.Security is Unbreakable: Your identity is secured by something only you have.Our inspiration was to build a system that doesn't just protect your identity with a password that can be stolen, but links it directly to your physical self using biometrics.What it doesOur project is an end-to-end Blockchain-Based Identity Management System built on the standard "Issuer-Holder-Verifier" model. It consists of three main components: The Issuer (issuer.py): This is the trusted authority (e.g., "NADRA" in our code). It creates a digital credential (like a national ID card), generates a unique cryptographic hash ($bytes32$) of that credential, and writes that hash to the Ethereum blockchain. This acts as a tamper-proof "anchor" and a public record of issuance. The Holder (user.py): This is the citizen. They hold their actual credential data (the JSON file) securely off-chain on their own device. Their wallet is secured by our project's most unique feature: facial recognition. Before the user can access their credentials or use their blockchain wallet, they must first verify their identity with their face, ensuring the person using the wallet is the person it was issued to. The Verifier (verifier.py): This is any third party (like a bank or an airport) that needs to check the user's identity. To verify a user, they would: Ask the user to present their (off-chain) credential data. Hash this data using the exact same method as the Issuer. Call our smart contract to read the official hash stored on the blockchain for that user's address. If the two hashes match, the credential is 100% valid and has not been tampered with.

How we built it

We built this system using a powerful and flexible stack, with each component chosen for a specific purpose: Core Language: Python was our language of choice for its robust libraries and rapid prototyping capabilities. Blockchain Interaction: We used web3.py to connect our Python scripts to the Ethereum network (specifically the Sepolia testnet). This allowed our issuer.py script to write data to our smart contract and our verifier.py script to read from it. Smart Contract: The "brain" on the blockchain is a simple Solidity contract that maps a user's address to a bytes32 hash. We chose bytes32 because it is the most gas-efficient data type for storing a 256-bit SHA hash, making our system's on-chain operations extremely cheap. Biometric Security: The "key" to the user's wallet is face_recognition. We used this library to capture a user's face, create a mathematical embedding (a "faceprint"), and store it. The user.py script requires a live camera-feed to match against this stored embedding before unlocking any sensitive functions.

Challenges we ran into

This project was not without its challenges, which are reflective of the real-world hurdles in this space.

Biometric Spoofing: Our biggest security challenge is that our current face_recognition implementation is vulnerable to "spoofing." A high-quality photo or video of the user could potentially fool the system. This made us realize that a production-grade system would need to integrate liveness detection (e.g., "challenge-response" tests like "blink your left eye" or "turn your head").

Web3 User Experience (UX): We faced the dual-friction of onboarding a new user. Not only do they have to understand complex Web3 concepts like private keys and gas fees, but they also have to go through a biometric enrollment process. A "failure to enrol" (e.g., bad lighting) or a "false rejection" (the system not recognizing them) creates significant user frustration.

Data vs. Hash: We had to make a critical design choice. Storing the user's actual data on-chain would be a privacy disaster. Storing a hash of the data is extremely private and gas-efficient, but it means the verifier must have the entire credential to re-compute the hash. This "all-or-nothing" reveal is what led us to explore "What's Next."

Accomplishments that we're proud of

End-to-End Functional Prototype: We successfully built a working, three-part system that demonstrates the full lifecycle of a verifiable credential, from issuance to verification.

Fusing Biometrics with Web3: Our biggest accomplishment is successfully linking a user's physical, biometric identity to their digital, on-chain wallet. This is a massive security leap beyond simple password/PIN protection and proves a model where only you can access and use your identity.

Privacy-by-Design: We successfully avoided the #1 pitfall of blockchain projects: we stored zero sensitive personal data on the public ledger. By only storing a bytes32 hash, we built a system that is both verifiable and private.

What we learned

We learned that building a decentralized identity system is a constant balancing act between three core principles: Security, Privacy, and Usability.

We learned that on-chain "immutability" is a powerful tool for anchoring trust, but the real data must live off-chain.

We learned that biometrics are a powerful "key" but come with their own challenges (spoofing, accuracy) that must be engineered for.

Most importantly, we learned that our simple hash-based system is the "Model T" of a much larger ecosystem. It's the essential first step, but the future is even more exciting.

What's next for Blockchain Based identity Management System

This project is the foundation for a truly revolutionary identity system. The next steps are about embracing global standards for interoperability and privacy.

Evolve from Hash to Verifiable Credentials (VCs): Our next goal is to upgrade our simple JSON credential to the W3C Verifiable Credential standard. This would make our credentials interoperable, allowing them to be understood by any other standards-compliant system in the world. We can achieve this in Python using SSI libraries like didkit.

Evolve from Address to DIDs: We will replace the user's wallet address (which acts as their ID) with a Decentralized Identifier (DID) (e.g., did:ethr:). A DID is a globally unique, user-controlled identifier that is the standard for SSI.

Implement Zero-Knowledge Proofs (ZKPs): This is the ultimate upgrade for privacy. Instead of showing a verifier their entire credential (the "all-or-nothing" problem), the user can generate a ZKP. This would allow a user to prove a specific fact without revealing any other data.

Example: A user could prove "I am over 18" without ever revealing their name, address, or actual date of birth.

This project is our first step toward a future where every individual has true ownership, security, and privacy over their digital self.