Diseño y aplicación de un sistema de seguridad descentralizado mediante la tecnología Blockchain para aplicaciones web.

Abstract

The present work aims to develop a decentralized security system using BLOCKCHAIN technology for web applications, to implement an additional layer of security to the authentication system. Two prototypes were designed and implemented in the Nodejs language, prototype 1 had a traditional authentication system (user, password), while prototype 2 implemented an additional layer based on blockchain and smart contracts to register users and keep track of their accesses, relying on the digital firm that allows to univocally identificate each user in the webserver, being the main components of the proposed system the web application, the user, and the smart contract. Authentication in the proposed web system is performed in two stages: the first by providing the username and password to the desired application/website, and the second is by decrypting the One Time Key (OTP) that is generated and sent through a smart contract requested by the web application to authorize the user, where the blocks of records are stored in the blockchain. For the demonstration of the hypothesis the 2 prototypes were evaluated using Vooki and Owasp ZAP tools and based on the analysis of vulnerabilities presented it was concluded that the proposed system improves the level of security in a web application by reducing by 83.33% the vulnerabilities presented, it should be emphasized that the system is exempt from common attacks such as XSS, SQL injection because there is no central server where the login information is stored. Finally, the proposed system inherits the characteristics of blockchain technology which are decentralization, immutability, the use of cryptographic hashes, and digital signatures; parameters that provide added value to the security of a web system/application.