Security

Authentication and Authorization

Catalyst Blockchain Platform provides the following methods for user authentication and authorization:

• Basic authentication — Requires user credentials specified during the installation of the Platform.

• OpenID — User login can be integrated with the OpenID protocol, which allows a third-party service to authenticate a user. This removes central dependency on storing credentials in a single place and enhances platform security.

It is the user's choice to select either OpenID or basic authentication. See Installation Instructions for details.

Certificate Management

In Hyperledger Fabric, two entities are responsible for identity management:

• Certificate Authority (CA) — Issues certificates to other entities on the network. The CA issues X.509 certificates, the most popular standard for SSL/TLS connections, securing the network from malicious impersonators. See the Certificate Authority section for more information.

• Membership Service Provider (MSP) — Authenticates the CA or the certificates issued by the CA for a particular network, defining the role and responsibilities of entities based on their certificates. See the MSP section for more information.

Hyperledger Fabric uses TLS to establish secure communication between two entities based on the public key infrastructure.

Key Management

Public and private keys are major components of a Public Key Infrastructure (PKI). Effective management of these keys makes the blockchain network highly secure.

In the Hyperledger Fabric network, a certificate issued by a CA defines the identity of the entity. The public key identifies the entity on the network, while the private key authenticates transactions. Generated keys use ECDSA with Curve P256 standards.

Catalyst Blockchain Platform generates private keys and keeps them in storage (Kubernetes Secret or Hashicorp Vault). Private keys cannot be imported or exported.