Authentication of Ethereum Node on a private block chain

Question

Problem: In a private block chain network, how does setting up a new node authenticate itself into the network. Is there anything which prevents one node from getting to the network and download data from other nodes.

I have seen the json file which contains a private and public key which is a config file for the node. I believe this is used for securing the data transmission between the nodes. however, this does not possible seems to have any correlation to authenticate of the node to the network.

i am a newbie to block chain so any help would be greatly appreciated. I am working on developing a startup around block chain

Answer 1

you could take some measure to prevent undesirable nodes :

1- use the option --nodiscover

Use this option to make sure that your node is not discoverable by people who do not manually add you.

2- use the option --maxpeers 0

Use maxpeers 0 if you do not want anyone else connecting to your test chain. Alternatively, you can adjust this number if you know exactly how many peers you want connecting to your private chain.

Answer 2

In a private blockchain, a new node cannot get automatically connected to the private network. That's why the network is private.

Regarding authentication, the unique --networkid of your network and your genesis file act as a first level of authentication factors to your private blockchain network. In other words, a new node cannot be added to the network unless it has a copy of the genesis file and knows the networkid.

Even if a node is aware of both these attributes, it won't be a part of the private network unless it's manually added (through it's enodeURI) as a peer to one of the nodes (of the private network) through the addPeer() function. There is no automatic peer discovery in a private blockchain network.

If you think that all the aforementioned tasks could be possibly carried out by an attacker, you can enable the --nodiscover option and use the --maxpeers option to limit the no. of connections.

Answer 3

In private deployment, you can set up protection on level 4, e.g. IP level firewall or on level 7, SSH tunnels between nodes for incoming connections.