deController
Web3-native cyberspace infrastructure

Decentralization all the way down to the network.

deController is an infrastructure controller for Web3. It organizes the network into an underlay and an overlay operated by blockchain nodes, gives every user a three-tier identity, and keeps the whole stack compatible with lawful governance.

Web3 still runs on centralized things

"Read, write and own" is the promise of Web3. Ownership means little if access to the network can be denied, and privacy is void if a user can be tracked where the connection begins and ends.

Access

Infrastructure controllers

Decentralized applications still depend on network infrastructure owned and operated by centralized resource controllers.

Identity

Anonymous authentication

Every identity in a decentralized network is anonymous, so access control has to authenticate users without revealing any personal information.

Law

Governance and sovereignty

Full anonymity challenges legislation and jurisdiction. A workable Web3 has to respect privacy and cyber sovereignty at the same time.

Underlay and overlay

The Web3 network is split into two logical layers. The underlay provides physical connectivity; the overlay, hosted by blockchain nodes, controls and manages it. deController sits in the overlay.

Decentralized applications and services dApps · decentralized service providers · distributed storage users reach backends by the blockchain address of a smart contract Overlay · blockchain nodes deController identity registry and association · per-session authentication overlay routing · encrypted tunnelling · resource allocation Underlay · physical network segments segments run P2P or DAO-to-DAO (federated) NEAT maps BCADDs to device identifiers, ports and names operated increasingly by DAO-based infrastructure operators
The three layers of the proposed Web3 network architecture.

Blockchain nodes as the overlay

Each full node already runs a complete networking and service stack, which makes the blockchain delivery network a natural Web3 overlay with tunnelling and routing capability.

NEAT

Network Encrypted Address Translation associates an encrypted blockchain address (BCADD) with device identifiers, ports and domain names, so deController can look up any BCADD globally and build the overlay on any underlay.

Per-session routing

Traffic is steered by BCADD. Every handshake between two encrypted identities is mutually authenticated, and the identity manager tracks service quality, aliveness and identity.

Three tiers of identity

A real identity is bridged to virtual identities through one-way derivations. Each tier is visible only to the parties that need it.

RealID never revealed in Web3 one-way function BCADD wallet address · operators one-way function or VRF APPID 1 APPID 2 APPID 3
Identities regenerate together: renewing a BCADD renews its APPIDs, which resists tracking.
TierHeld by / visible to
RealIDThe user, and the regulatory body where registration is required.
BCADDThe payment system and authorized infrastructure such as mobile network operators and ISPs, to validate network access.
APPIDService providers. It is both the network interface indicator and the service account, so it cannot be linked back without the derivation parameters.

Security and privacy by construction

Public keys serve as identities, so no certificate authority is needed to endorse them. Regulated privacy is added with cryptography instead of disclosure.

Selective disclosure

With zero-knowledge proofs and verifiable random functions, a user can prove an attribute, for example being over 18, without revealing the underlying data.

Registered on-chain

Nodes and identities register by a bootstrapped transaction carrying a BCADD or an APPID with its access-control information, such as an NFT that represents access privilege.

Decentralized mutual authentication

Routers check APPIDs against their BCADDs and forward packets transparently, so users and application servers authenticate each other without a central party.

Legacy compatibility

A registered AAA server can still run the Generic Bootstrapping Architecture for applications that do not support decentralized authentication.

Governance, law and the operator

Decentralized applications are not fully decentralized while their roots sit in centralized infrastructure. The underlay operators themselves have to decentralize.

DAO-based infrastructure operator
  • Flat structure. Decisions are proposed and made by stakeholders, with no central management role.
  • Rules in code. Organizational rules are encoded in smart contracts on a permissionless blockchain.
  • Automatic execution. Once a proposal passes an on-chain vote, the change is applied without further human involvement.
  • Transparent by default. Every transaction is open to public and consortium scrutiny.
Law and cyber sovereignty
  • Privacy aligned with regulation. Native encryption gives users control over personal data, in line with the objectives of GDPR.
  • Mandatory registration where required. Regulators can require active public-key identities to be registered.
  • Lawful interception. Traffic steering and duplication can be implemented in deController.
  • Jurisdiction. A legal consortium lets different jurisdictions reach consensus by smart contracts on judicial jurisdiction, preventing unauthorized cross-border movement of data.

Publication

deController was introduced in IEEE Communications Magazine.

deController: A Web3 Native Cyberspace Infrastructure Perspective
Hao Xu, Yunqing Sun, Zihao Li, Yao Sun, Lei Zhang and Xiaoshuai Zhang
IEEE Communications Magazine, vol. 61, no. 8, pp. 68–74, August 2023
DOI 10.1109/MCOM.005.2200481