Decentralization all the way down to the network.
deController is an infrastructure controller for Web3. It organizes the network into an underlay and an overlay operated by blockchain nodes, gives every user a three-tier identity, and keeps the whole stack compatible with lawful governance.
Web3 still runs on centralized things
"Read, write and own" is the promise of Web3. Ownership means little if access to the network can be denied, and privacy is void if a user can be tracked where the connection begins and ends.
Infrastructure controllers
Decentralized applications still depend on network infrastructure owned and operated by centralized resource controllers.
Anonymous authentication
Every identity in a decentralized network is anonymous, so access control has to authenticate users without revealing any personal information.
Governance and sovereignty
Full anonymity challenges legislation and jurisdiction. A workable Web3 has to respect privacy and cyber sovereignty at the same time.
Underlay and overlay
The Web3 network is split into two logical layers. The underlay provides physical connectivity; the overlay, hosted by blockchain nodes, controls and manages it. deController sits in the overlay.
Blockchain nodes as the overlay
Each full node already runs a complete networking and service stack, which makes the blockchain delivery network a natural Web3 overlay with tunnelling and routing capability.
NEAT
Network Encrypted Address Translation associates an encrypted blockchain address (BCADD) with device identifiers, ports and domain names, so deController can look up any BCADD globally and build the overlay on any underlay.
Per-session routing
Traffic is steered by BCADD. Every handshake between two encrypted identities is mutually authenticated, and the identity manager tracks service quality, aliveness and identity.
Three tiers of identity
A real identity is bridged to virtual identities through one-way derivations. Each tier is visible only to the parties that need it.
| Tier | Held by / visible to |
|---|---|
| RealID | The user, and the regulatory body where registration is required. |
| BCADD | The payment system and authorized infrastructure such as mobile network operators and ISPs, to validate network access. |
| APPID | Service providers. It is both the network interface indicator and the service account, so it cannot be linked back without the derivation parameters. |
Security and privacy by construction
Public keys serve as identities, so no certificate authority is needed to endorse them. Regulated privacy is added with cryptography instead of disclosure.
Selective disclosure
With zero-knowledge proofs and verifiable random functions, a user can prove an attribute, for example being over 18, without revealing the underlying data.
Registered on-chain
Nodes and identities register by a bootstrapped transaction carrying a BCADD or an APPID with its access-control information, such as an NFT that represents access privilege.
Decentralized mutual authentication
Routers check APPIDs against their BCADDs and forward packets transparently, so users and application servers authenticate each other without a central party.
Legacy compatibility
A registered AAA server can still run the Generic Bootstrapping Architecture for applications that do not support decentralized authentication.
Governance, law and the operator
Decentralized applications are not fully decentralized while their roots sit in centralized infrastructure. The underlay operators themselves have to decentralize.
- Flat structure. Decisions are proposed and made by stakeholders, with no central management role.
- Rules in code. Organizational rules are encoded in smart contracts on a permissionless blockchain.
- Automatic execution. Once a proposal passes an on-chain vote, the change is applied without further human involvement.
- Transparent by default. Every transaction is open to public and consortium scrutiny.
- Privacy aligned with regulation. Native encryption gives users control over personal data, in line with the objectives of GDPR.
- Mandatory registration where required. Regulators can require active public-key identities to be registered.
- Lawful interception. Traffic steering and duplication can be implemented in deController.
- Jurisdiction. A legal consortium lets different jurisdictions reach consensus by smart contracts on judicial jurisdiction, preventing unauthorized cross-border movement of data.
Publication
deController was introduced in IEEE Communications Magazine.