Decentralized PKI for Secure Identity Federation

Inspiration

What it does

How we built it

Challenges we ran into

Accomplishments that we're proud of

What we learned

What's next for Decentralized PKI for Secure Identity Federation

Inspiration

Today, organizations such as universities, hospitals, banks, and companies manage digital identities and certificates. When users access services across different organizations, verifying their identities and checking whether their certificates are still valid can be challenging.

Traditional systems may depend heavily on centralized trust services, and certificate status changes may not be reflected consistently across systems. We wanted to explore how blockchain could help organizations share verifiable trust information while maintaining control over their own identities and security policies.

What It Does

Decentralized PKI for Secure Identity Federation is a blockchain-based framework designed to help multiple organizations verify digital certificates and identity-related trust information.

The framework uses a shared, tamper-evident ledger to record certificate-related metadata, status updates, and verification history. It also introduces an evidence-commitment-based selective invalidation approach: when a certificate's status changes, the system identifies previously recorded authentication decisions that may be affected and flags them for re-evaluation.

Instead of unnecessarily rechecking every decision, the goal is to focus on the decisions affected by the change.

How We Built It

We designed the framework around a permissioned blockchain network using Hyperledger Fabric.

The prototype includes:

• Hyperledger Fabric: Maintains shared, verifiable records across participating organizations.
• JavaScript chaincode: Implements certificate-evidence and status-handling logic.
• Node.js and Express: Provides API endpoints for submitting requests and retrieving recorded decisions.
• Fabric Gateway: Connects the application to the blockchain network.
• Digital signatures and cryptographic hashes: Support verification and integrity checks.
• Evidence commitments: Link authentication decisions to the evidence state used to make them.

Private keys remain off the ledger. The framework is intended to support distributed trust management without claiming to eliminate certificate authorities entirely.

Challenges We Faced

One of the main challenges was understanding how certificate management, blockchain, and cross-organization identity verification work together.

We also had to consider what happens when certificate status changes after an authentication decision has already been recorded. A simple approach that rejects every decision whenever a revocation appears could affect decisions that are unrelated to the change.

To address this, we developed the idea of linking decisions to their supporting evidence and selectively identifying decisions that require re-evaluation. Another challenge is ensuring that the system remains secure, auditable, and efficient as the number of certificates and decisions increases.

What We Learned

Through this project, we explored Hyperledger Fabric, smart contracts, certificate lifecycle management, cryptographic evidence, API integration, and distributed trust.

We also learned that a blockchain-based solution must do more than store information: it should address a clearly defined technical problem and be evaluated using measurable criteria such as correctness, latency, unnecessary re-evaluations, and ledger activity.

Future Scope

Future work includes expanding the prototype to more participating organizations, developing a user-friendly dashboard, testing additional certificate-conflict scenarios, and measuring performance on a running blockchain network.

Our long-term goal is to make cross-organization identity verification more transparent, traceable, and efficient while preserving each organization's control over its own access policies.

Our vision: Make digital trust easier to verify across organizational boundaries.

Built With

• blockchain
• cryptographic
• cybersecurity
• decentralizedsystem
• digitalidentity
• digitalsignatures
• docker
• express.js
• fabric
• gateway
• hyperledger
• hyperledgerfabric
• identitymanagement
• javascript
• node.js
• publickeyinfrastructure
• restapi
• x.509certificates