  Federated identity management enables users to access multiple systems using
a single login credential. However, to achieve this a complex privacy
compromising authentication has to occur between the user, relying party (RP)
(e.g., a business), and a credential service provider (CSP) that performs the
authentication. In this work, we use a smart contract on a blockchain to enable
an architecture where authentication no longer involves the CSP. Authentication
is performed solely through user to RP communications (eliminating fees and
enhancing privacy). No third party needs to be contacted, not even the smart
contract. No public key infrastructure (PKI) needs to be maintained. And no
revocation lists need to be checked. In contrast to competing smart contract
approaches, ours is hierarchically managed (like a PKI) enabling better
validation of attribute providers and making it more useful for large entities
to provide identity services for their constituents (e.g., a government) while
still enabling users to maintain a level of self-sovereignty.
