Decentralized application authentication

#Multi-user applications often implement one or more authentication mechanisms to verify the identity and authenticity of individual users of the application. These authentication mechanisms can be used to identify and prevent fraudulent transactions (e.g., authentication mechanisms implemented by financial websites). As another example, the authentication mechanisms can be used to verify the identity of a user in order to confirm that a user is authorized to perform a particular operation or initiate a particular transaction.

#However, many authentication mechanisms are often device specific. For example, a device fingerprint may be recorded when a user visits a web site. Subsequent visits by the user can be authenticated in part based on whether the same device fingerprint is identified by the application. However, when a user switches devices, a different device fingerprint may be generated, limiting the utility of the device fingerprint. Likewise, the device fingerprint often has to be authenticated independently by each web site visited by the user.

#Many aspects of the present disclosure can be better understood with reference to the following drawings. The components in the drawings are not necessarily to scale, with emphasis instead being placed upon clearly illustrating the principles of the disclosure. Moreover, in the drawings, like reference numerals designate corresponding parts throughout the several views.

#FIG. 1 is a drawing of a networked environment according to various embodiments of the present disclosure.

#FIG. 2 is a flowchart illustrating one example of functionality implemented as portions of an application executed in a computing environment in the networked environment of FIG. 1 according to various embodiments of the present disclosure.

#Disclosed are various approaches for implementing a decentralized authentication system for authenticating users with applications. A device fingerprint associated with a user can be authenticated by a first application. A record of the authentication of the device fingerprint can be stored in a decentralized data store, such as a distributed ledger (DL), a distributed hash table (DHT), or other decentralized data storage mechanism. When a second application attempts to authenticate a user that is associated with the same device fingerprint, the second application can query the decentralized data store to retrieve the records associated with the user and the device fingerprint. The second application can then determine whether to authenticate the user based on how trustworthy the second application determines the record of the previous authentication by the first application to be. By using a decentralized data store, no single entity is able to control the authentication data that can be used to identify individual users. In the following discussion, a general description of the system and its components is provided, followed by a discussion of the operation of the same.

#As illustrated in FIG. 1, shown is a networked environment 100 according to various embodiments. The networked environment 100 includes a computing environment 103, a client device 106, an identity hub 109, and a distributed ledger 113, which are in data communication with each other via a network 116. The network 116 includes wide area networks (WANs) and local area networks (LANs). These networks can include wired or wireless components or a combination thereof. Wired networks can include Ethernet networks, cable networks, fiber optic networks, and telephone networks such as dial-up, digital subscriber line (DSL), and integrated services digital network (ISDN) networks. Wireless networks can include cellular networks, satellite networks, Institute of Electrical and Electronic Engineers (IEEE) 802.11 wireless networks (i.e., WI-FI®), BLUETOOTH® networks, microwave transmission networks, as well as other networks relying on radio broadcasts. The network 116 can also include a combination of two or more networks 116. Examples of networks 116 can include the Internet, intranets, extranets, virtual private networks (VPNs), and similar networks.

#The computing environment 103 can include a server computer or any other system providing computing capability. Alternatively, the computing environment 103 can employ a plurality of computing devices that can be arranged in one or more server banks or computer banks or other arrangements. Such computing devices can be located in a single installation or can be distributed among many different geographical locations. For example, the computing environment 103 can include a plurality of computing devices that together can include a hosted computing resource, a grid computing resource or any other distributed computing arrangement. In some cases, the computing environment 103 can correspond to an elastic computing resource where the allotted capacity of processing, network, storage, or other computing-related resources can vary over time.