Development of a Distributed Authentication Framework using Decentralized Identifiers and Verifiable Credentials for Industrial and Medical Blockchains

Abstract

The proliferation of distributed multi-agent systems in industrial and healthcare domains highlights fundamental limitations of centralized authentication architectures. These systems, comprising autonomous agents operating across organizational boundaries, require authentication mechanisms that eliminate single points of failure, preserve data sovereignty, protect privacy during data aggregation, and enable trust establishment without central authorities. Central identity providers, however, introduce systemic risks by concentrating trust and control, enabling privacy-invasive observation of authentication events and, in the event of compromise, facilitating large-scale credential breaches, challenges that are particularly acute in scalability- and privacy-sensitive deployments. This thesis presents the design, implementation, and evaluation of the Distributed Authentication and Privacy System (DAPS), a decentralized authentication framework for multi-agent systems based on W3C Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs). The research adopts a Design Science Research (DSR) methodology and contributes a reference architecture together with a corresponding implementation on Hyperledger Fabric, a permissioned enterprise blockchain platform that does not natively support Self-Sovereign Identity (SSI). DAPS implements a three-component architecture comprising autonomous agents, fusion centers as data aggregators, and credential issuers. Agents generate cryptographic keys and DIDs, obtain issuer-signed Verifiable Credentials, and authenticate with fusion centers using a decentralized authentication protocol that does not require contacting credential issuers at the time of verification. Credential integrity and revocation status are validated through blockchain-anchored proofs, enabling decentralized and offline-capable authentication. To mitigate inferential privacy risks during data aggregation, DAPS integrates a modular ε-differential privacy mechanism based on the Laplace distribution, allowing configurable privacy-utility trade-offs for aggregated sensor data. The framework is evaluated through functional, performance, security, and privacy analyses. Functional evaluation verifies the correct realization of DID management, VC lifecycles, and authentication workflows. Performance analysis characterizes the behavior of critical operations under concurrent load, highlighting the impact of architectural choices such as synchronous and asynchronous blockchain interactions. Security evaluation assesses the system against an explicit threat model, examining resistance to impersonation, replay, and tampering within the assumed trust boundaries. Privacy evaluation empirically validates the behavior of the differential privacy mechanism, illustrating the trade-off between privacy guarantees and analytical utility. The results demonstrate how W3C-compliant decentralized authentication, integrated with differential privacy mechanisms, can be realized as a reference system on enterprise blockchain platforms without native SSI support, providing a reusable architectural and implementation blueprint for large-scale multi-agent environments.