SPDID: A Secure and Privacy-Preserving Decentralized Identity utilizing Blockchain and PUF

For internet users, using digital identities has become increasingly essential. Traditional systems often rely on centralized control, which no longer meets privacy demands. Decentralized identity systems offer a more transparent and resilient solution by giving users control over their identity data through distributed ledgers, decentralized identifiers, and verifiable credentials. However, existing schemes are often based on assumptions such as the presence of a reliable anonymous credential issuer, making them challenging to implement in real-world scenarios. Furthermore, they overlook handling user credentials securely and struggle with ensuring user authentication while providing privacy. These systems are unable to provide public audits of issued credentials without jeopardizing sensitive data. This paper introduces SPDID, a novel decentralized identity system based on blockchain technology is introduced. First, it transforms legacy documents into anonymous credentials without interaction or alteration using zero-knowledge proofs and Pedersen commitments. SPDID also employs the physical unclonable function (PUF) to design a secure key management system resilient to physical attacks. Additionally, it suggests a user authentication method that is unlinkable and resistant to Sybil without the need for new trusted third parties. Furthermore, SPDID uses Merkle trees to construct a credential issuance list that is publicly auditable on the blockchain. The system’s security and practical performance are demonstrated through security analysis and a prototype implementation on Hyperledger Fabric.