Method for mobile identification card authentication service using decentralized identifier based on blockchain networks and user device executing mobile identification card authentication service

Abstract

In a method for a mobile identity authentication service using a blockchain network-based Decentralized Identifier (DID), (a) User DID corresponding to a user and user public information corresponding to said User DID - said user public information includes at least a first user public key corresponding to said User DID and the ID DID application of the user terminal and a second user public key corresponding to said User DID and the Service DID application of said user terminal - registered in this blockchain network, and as each of the user identity information corresponding to said User DID is verified by an ID issuance server, identity information VC (verifiable credential) for each of said user identity information is issued and stored in a first storage unit linked to said ID DID application of said user terminal, and said user identity information is registered in this blockchain network, and as each of said user identity information corresponding to said User DID is verified by an ID issuance server, identity information VC (verifiable credential) for each of said user identity information is issued and stored in a first storage unit linked to said ID DID application of said user terminal, said user terminal transmits user information VC issuance request information, said User DID, and an issuance request information signature value signed with said User private key to said User information VC issuance request information through said Service DID application to a first service provider server, thereby causing said first service provider server to verify said issuance request information signature value to confirm the validity of said user information VC issuance request information, and if said user information VC issuance request information is confirmed to be valid, user authentication information to said user terminal Step to make a request;and (b) in response to a request for user authentication information from the first service providing server, the user terminal transmits the user authentication information, which includes the user DID, at least one specific identity information VC, and a first user signature value signed with the first user private key, to the first service providing server through the ID DID application, thereby causing the first service providing server to obtain the first user public key corresponding to the user DID from the blockchain network using the user DID, or to obtain a user DID document corresponding to the user DID from the blockchain network using the user DID through a resolver server and to obtain the first user public key from the user DID document, and to verify the first user signature value using the first user public key, and if the first user signature value is verified, to verify the specific identity information VC, and if the specific identity information VC is verified, to generate a user information VC using user information related to the first service provided by the first service providing server, and the user information VC is the user A method is disclosed comprising the step of transmitting to a terminal, and when the user information VC is obtained, storing the user information VC in a second storage unit linked to the service DID application of the user terminal through the service DID application, and a user terminal performing the same.;

Description

Technology Field

[0001] The present invention relates to a method for a mobile identity authentication service using a blockchain network-based decentralized identifier (DID) and a user terminal for performing a mobile identity authentication service. Background Technology

[0002] Traditionally, identification cards used for identity verification have been issued offline as plastic cards in response to requests for issuance online or offline.

[0003] Therefore, the person corresponding to the identification card had the inconvenience of always having to carry the physical identification card separately, as they had to personally take out and present the physical identification card when they wanted to authenticate themselves.

[0004] In addition, conventionally, there was a problem in that all information contained in the identification card had to be unnecessarily exposed to a third party during the identity verification process.

[0005] For example, a driver's license includes information such as a photograph, name, resident registration number, address, issuance date, issuing agency information, license type, and validity period; however, despite the fact that only a very small portion of this information is necessary to verify that the individual is an adult, there was a problem in that all of this information was unnecessarily exposed to third parties.

[0006] Furthermore, conventionally, various personal information issued to user terminals has been stored in the same repository and managed collectively without considering the issuing agency, which has resulted in a vulnerability to personal information leakage.

[0007] Therefore, improvement measures are required to resolve the aforementioned problems. Prior art literature

[0008] (Patent Document 0001) KR 10-2017-0078122 A The problem to be solved

[0009] The present invention aims to solve all of the aforementioned problems.

[0010] In addition, another objective of the present invention is to enable user authentication without the need to possess a physical identification card.

[0011] In addition, another objective of the present invention is to enable the provision of only the information necessary for authentication among the information included in an identification card to a verification agency.

[0012] In addition, another objective of the present invention is to prevent falsification or alteration of information related to a user by enabling a mobile identity verification service using a distributed ID based on a blockchain network.

[0013] In addition, another objective of the present invention is to prevent the leakage of personal information by classifying and storing information related to users according to the required security level. means of solving the problem

[0014] The characteristic configuration of the present invention for achieving the objectives of the present invention as described above and realizing the characteristic effects of the present invention described below is as follows.

[0015] According to one aspect of the present invention, in a method for a mobile identity authentication service using a Decentralized Identifier (DID) based on a blockchain network, (a) a user DID corresponding to a user and user public information corresponding to the user DID—the user public information includes at least a first user public key corresponding to the user DID and an identity DID application of the user terminal and a second user public key corresponding to the user DID and a service DID application of the user terminal—are registered in a blockchain network, and as each of the user identity information corresponding to the user DID is verified by an identity issuance server, identity information verifiable credentials (VCs) for each of the user identity information are issued and stored in a first storage unit linked to the identity DID application of the user terminal, wherein the user terminal transmits user information VC issuance request information, the user DID, and an issuance request information signature value signed with the second user private key to a first service provider server through the service DID application, thereby causing the first service provider server to verify the issuance request information signature value and the user A step of verifying the validity of the information VC issuance request information, and if the user information VC issuance request information is confirmed to be valid, requesting user authentication information to the user terminal;and (b) in response to a request for user authentication information from the first service providing server, the user terminal transmits the user authentication information, which includes the user DID, at least one specific identity information VC, and a first user signature value signed with the first user private key, to the first service providing server through the ID DID application, thereby causing the first service providing server to obtain the first user public key corresponding to the user DID from the blockchain network using the user DID, or to obtain a user DID document corresponding to the user DID from the blockchain network using the user DID through a resolver server and to obtain the first user public key from the user DID document, and to verify the first user signature value using the first user public key, and if the first user signature value is verified, to verify the specific identity information VC, and if the specific identity information VC is verified, to generate a user information VC using user information related to the first service provided by the first service providing server, and the user information VC is the user A method is disclosed comprising the step of transmitting to a terminal, and when the user information VC is obtained, storing the user information VC in a second storage unit linked to the service DID application of the user terminal through the service DID application.

[0016] As an example, a method is disclosed in which, in step (b) above, when user validity information indicating that the user is a valid user is obtained, in response to a request for user authentication information from the first service provider server, the user terminal transmits the user authentication information to the first service provider server, the user DID, the specific identity information VC, and the first user signature value signed with the first user private key through the ID card DID application.

[0017] As an example, a method is disclosed in which, in step (b) above, the user terminal causes the first service provider server to verify the specific identity information VC, and if it is determined that the specific identity information VC is invalid, the user terminal requests the user authentication information again, and in response to the request for the user authentication information from the first service provider server, the user re-authentication information including another identity information VC is transmitted to the first service provider server through the ID card DID application, thereby causing the first service provider server to verify the other identity information VC, and if the other identity information VC is verified, the user information VC is generated using the user information related to the first service provided by the first service provider server.

[0018] As an example, a method is disclosed in which the specific identity information VC includes an ID issuance server DID and an ID issuance server signature value, wherein the ID issuance server DID is used to obtain an ID issuance server public key corresponding to the ID issuance server DID from the blockchain network, and the ID issuance server public key is used to verify the ID issuance server signature value, thereby verifying the specific identity information VC.

[0019] As an example, a method is disclosed in which, in step (a) above, a second user public key corresponding to the user DID is obtained from the blockchain network using the user DID, and the validity of the user information VC issuance request information is confirmed by using the second user public key to verify the signature value of the issuance request information.

[0020] As an example, a method is disclosed characterized in that the user terminal manages the identity information VC on a Trusted Execution Environment (TEE) through the ID card DID application.

[0021] According to another aspect of the present invention, in a method for a mobile identity authentication service using a decentralized identifier (DID) based on a blockchain network, the method comprises: (a) a user DID corresponding to a user and user public information corresponding to the user DID—the user public information includes at least a first user public key corresponding to the user DID and an identity DID application and a second user public key corresponding to the user DID and a service DID application—being registered in a blockchain network; and identity information VCs for each of the user identity information are stored in a first storage unit linked to the identity DID application of a user terminal, and user information VCs for user information related to a first service provided by a first service providing server are stored in a second storage unit linked to the service DID application of the user terminal, wherein the user terminal transmits a service provision request to a second service providing server, thereby causing the second service providing server to request user service authentication information from the user terminal;and (b) in response to a request for user service authentication information from the second service providing server, the user terminal obtains at least one specific identity information VC and a first user signature value signed with a first user private key from the ID card DID application through the service DID application, and transmits the user service authentication information including (i) the user DID, (ii) the specific identity information VC, (iii) the first user signature value, (iv) at least one specific user information VC, and (v) a second user signature value signed with a second user private key for the specific identity information VC, the first user signature value, and the specific user information VC to the second service providing server, thereby causing the second service providing server to obtain the first user public key and the second user public key corresponding to the user DID from the blockchain network using the user DID, or to obtain a user DID document corresponding to the user DID from the blockchain network using the user DID through a resolver server, and the user DID A method is disclosed comprising the step of obtaining the first user public key and the second user public key from a document, verifying the first user signature value and the second user signature value using the first user public key and the second user public key, verifying the specific identity information VC and the specific user information VC when the first user signature value and the second user signature value are verified, and transmitting service information corresponding to the service provision request to the user terminal when the specific identity information VC and the specific user information VC are verified.

[0022] As an example, the user service authentication information includes a first user service authentication information and a second user service authentication information, and in step (b), in response to a request for the first user service authentication information and the second user service authentication information from the second service providing server, the user terminal transmits the first user service authentication information, which includes the user DID, the specific identity information VC, and the first user signature value signed with the first user private key, through the ID card DID application to the second service providing server, and (ii) transmits the second user service authentication information, which includes the user DID, the specific user information VC, and the second user signature value signed with the second user private key, through the service DID application to the second service providing server.

[0023] A method is disclosed in which, as an example, the specific identity information VC includes an ID issuance server DID and an ID issuance server signature value, and the specific user information VC includes a first service provider server DID and a first service provider server signature value, wherein the ID issuance server DID and the first service provider server DID are each utilized to obtain an ID issuance server public key and a first service provider server public key corresponding to each of the ID issuance server DID and the first service provider server DID from the blockchain network, and wherein the ID issuance server public key and the first service provider server public key are each utilized to verify the ID issuance server signature value and the first service provider server signature value, thereby verifying the specific identity information VC and the specific user information VC.

[0024] As an example, a method is disclosed characterized in that the user terminal manages the identity information VC in a Trusted Execution Environment (TEE) through the ID card DID application.

[0025] According to another aspect of the present invention, a user terminal for performing a mobile identity authentication service using a blockchain network-based decentralized identifier (DID) comprises: at least one memory for storing instructions; and at least one processor configured to execute the above instructions, wherein the processor comprises: (1) a user DID corresponding to a user and user public information corresponding to the user DID - the user public information includes at least a first user public key corresponding to the user DID and the ID DID application of the user terminal and a second user public key corresponding to the user DID and the service DID application of the user terminal - which are registered in a blockchain network; wherein, as each of the user identity information corresponding to the user DID is verified by an ID issuance server, identity information VCs (verifiable credentials) for each of the user identity information are issued and stored in a first storage unit linked to the ID DID application of the user terminal; and wherein, through the service DID application, a user information VC issuance request information, the user DID, and an issuance request information signature value signed with the second user private key are transmitted to a first service provider server, thereby causing the first service provider server to verify the issuance request information signature value to confirm the validity of the user information VC issuance request information, and the user information A process for requesting user authentication information from the user terminal when the VC issuance request information is confirmed to be valid;and (2) in response to a request for user authentication information from the first service providing server, the user authentication information including the user DID, at least one specific identity information VC, and a first user signature value signed with the first user private key is transmitted to the first service providing server through the ID DID application, thereby causing the first service providing server to obtain the first user public key corresponding to the user DID from the blockchain network using the user DID, or to obtain a user DID document corresponding to the user DID from the blockchain network using the user DID through a resolver server and to obtain the first user public key from the user DID document, and to verify the first user signature value using the first user public key, and when the first user signature value is verified, the specific identity information VC is verified, and when the specific identity information VC is verified, a user information VC is generated using user information related to the first service provided by the first service providing server, and the user information VC is transmitted to the user terminal. A user terminal is disclosed that executes the instructions, which, when the above user information VC is obtained, perform a process of storing the above user information VC in a second storage unit linked to the above service DID application of the user terminal through the above service DID application.;

[0026] As an example, a user terminal is disclosed in which, in the process (2), when user validity information indicating that the user is a valid user is obtained, the processor transmits the user authentication information to the first service provider server in response to a request for the user authentication information from the first service provider server, the user DID, the specific identity information VC, and the first user signature value signed with the first user private key through the ID card DID application.

[0027] As an example, the processor in the above process (2) causes the first service provider server to verify the specific identity information VC, and if it is determined that the specific identity information VC is invalid, it causes the user authentication information to be re-requested from the user terminal, and in response to the re-request for the user authentication information from the first service provider server, transmits user re-authentication information including other identity information VC through the ID card DID application to the first service provider server, thereby causing the first service provider server to verify the other identity information VC, and if the other identity information VC is verified, the user terminal is characterized by generating the user information VC using the user information related to the first service provided by the first service provider server.

[0028] As an example, a user terminal is disclosed in which the specific identity information VC includes an ID issuance server DID and an ID issuance server signature value, wherein the ID issuance server DID is used to obtain an ID issuance server public key corresponding to the ID issuance server DID from the blockchain network, and the ID issuance server public key is used to verify the ID issuance server signature value, thereby verifying the specific identity information VC.

[0029] As an example, a user terminal is disclosed in which, in the process (1) above, the user DID is used to obtain a second user public key corresponding to the user DID from the blockchain network, and the second user public key is used to verify the signature value of the issuance request information, thereby confirming the validity of the user information VC issuance request information.

[0030] As an example, a user terminal is disclosed that manages the identity information VC on a Trusted Execution Environment (TEE) through the ID card DID application.

[0031] According to another aspect of the present invention, a user terminal for performing a mobile identity authentication service using a blockchain network-based decentralized identifier (DID) comprises: at least one memory for storing instructions; and at least one processor configured to execute the above instructions, wherein the processor comprises: (1) a user DID corresponding to a user and user public information corresponding to the user DID - the user public information includes at least a first user public key corresponding to the user DID and an ID DID application and a second user public key corresponding to the user DID and a service DID application - are registered on a blockchain network, and identity information VCs for each of the user identity information are stored in a first storage unit linked to the ID DID application of the user terminal, and user information VCs for user information related to a first service provided by a first service providing server are stored in a second storage unit linked to the service DID application of the user terminal, and a service provision request is transmitted to a second service providing server, thereby causing the second service providing server to request user service authentication information from the user terminal; and (2) in response to the request for user service authentication information from the second service providing server, at least one specific identity information VC and the specific identity information VC from the ID DID application through the service DID application Obtaining a first user signature value signed with a user private key, and (i) the user DID, (ii) the specific identity information VC, (iii) the first user signature value, (iv) at least one specific user information VC, and (v) the specific identity information VC,By transmitting the user service authentication information, which includes the first user signature value and the second user signature value signed with the second user private key, to the second service providing server, the process is performed to cause the second service providing server to obtain the first user public key and the second user public key corresponding to the user DID from the blockchain network using the user DID, or to obtain a user DID document corresponding to the user DID from the blockchain network using the user DID through a resolver server and to obtain the first user public key and the second user public key from the user DID document, to verify the first user signature value and the second user signature value using the first user public key and the second user public key, to verify the specific identity information VC and the specific user information VC when the first user signature value and the second user signature value are verified, and to transmit service information corresponding to the service provision request to the user terminal when the specific identity information VC and the specific user information VC are verified. A user terminal executing instructions is disclosed.

[0032] A user terminal is disclosed, wherein, as an example, the user service authentication information includes a first user service authentication information and a second user service authentication information, and the processor, in the process (2), responds to a request for the first user service authentication information and the second user service authentication information from the second service provider server, (i) transmits the first user service authentication information, which includes the user DID, the specific identity information VC, and the first user signature value signed with the first user private key, through the ID card DID application, to the second service provider server, and (ii) transmits the second user service authentication information, which includes the user DID, the specific user information VC, and the second user signature value signed with the second user private key, through the service DID application, to the second service provider server.

[0033] A user terminal is disclosed, characterized in that, as an example, the specific identity information VC includes an ID issuance server DID and an ID issuance server signature value, and the specific user information VC includes a first service provider server DID and a first service provider server signature value, wherein the ID issuance server DID and the first service provider server DID are each utilized to obtain an ID issuance server public key and a first service provider server public key corresponding to each of the ID issuance server DID and the first service provider server DID from the blockchain network, and the ID issuance server public key and the first service provider server public key are each utilized to verify the ID issuance server signature value and the first service provider server signature value, thereby verifying the specific identity information VC and the specific user information VC.

[0034] As an example, a user terminal is disclosed that manages the identity information VC in a Trusted Execution Environment (TEE) through the ID card DID application. Effects of the invention

[0035] The present invention has the effect of enabling user authentication without the need to possess a physical identification card.

[0036] In addition, the present invention has the effect of enabling the provision of only the information necessary for authentication among the information included in the identification card to the verification agency.

[0037] In addition, the present invention has the effect of preventing falsification or alteration of information related to users by enabling a mobile identity verification service using a distributed ID based on a blockchain network.

[0038] In addition, the present invention has the effect of preventing personal information leakage by classifying and storing user-related information according to the required security level. Brief explanation of the drawing

[0039] The drawings attached below for use in describing embodiments of the present invention are merely some of the embodiments of the present invention, and other drawings can be obtained based on these drawings without inventive work by a person skilled in the art to which the present invention pertains (hereinafter "person skilled in the art"). FIG. 1 schematically illustrates a user terminal that performs a mobile identity authentication service using a blockchain network-based Decentralized Identifier (DID) according to an embodiment of the present invention. FIGS. 2 and 3 schematically illustrate the process of issuing identity information VC and user information VC in the process of performing a mobile identity authentication service using a blockchain network-based Decentralized Identifier (DID) according to an embodiment of the present invention. FIGS. 4 to 6 schematically illustrate the process of receiving a service by performing user authentication using previously issued identity information VC and user information VC in the process of performing a mobile identity authentication service using a blockchain network-based decentralized identification (DID) according to another embodiment of the present invention. Specific details for implementing the invention

[0040] The following detailed description of the present invention refers to the accompanying drawings, which illustrate specific embodiments in which the present invention can be practiced in order to clarify the objects, technical solutions, and advantages of the present invention. These embodiments are described in sufficient detail to enable a person skilled in the art to practice the present invention.

[0041] Furthermore, throughout the detailed description and claims of the invention, the word “comprising” and its variations are not intended to exclude other technical features, additions, components, or steps. Other objects, advantages, and characteristics of the invention will become apparent to a person skilled in the art, in part from this description and in part from the practice of the invention. The following examples and drawings are provided by way of example and are not intended to limit the invention.

[0042] Furthermore, the present invention encompasses all possible combinations of the embodiments set forth in this specification. It should be understood that various embodiments of the present invention are different but need not be mutually exclusive. For example, specific shapes, structures, and characteristics described herein may be implemented in other embodiments without departing from the spirit and scope of the invention in relation to one embodiment. It should also be understood that the location or arrangement of individual components within each disclosed embodiment may be changed without departing from the spirit and scope of the invention. Accordingly, the following detailed description is not intended to be limiting, and the scope of the invention is limited only by the appended claims, including all equivalents to those claimed therein, provided appropriately described. Similar reference numerals in the drawings refer to the same or similar functions across various aspects.

[0043] Hereinafter, in order to enable a person skilled in the art to easily practice the present invention, preferred embodiments of the present invention will be described in detail with reference to the attached drawings.

[0044] FIG. 1 schematically illustrates a user terminal that performs a mobile identity authentication service using a blockchain network-based decentralized identifier (DID) according to one embodiment of the present invention.

[0045] Referring to FIG. 1, a user terminal (100) may include a memory (110) for storing instructions for performing a mobile identity authentication service using a blockchain network-based decentralized ID (DID), and a processor (120) for performing a mobile identity authentication service using a blockchain network-based decentralized ID (DID) in response to the instructions stored in the memory (110). At this time, the user terminal (100) may include a PC (Personal Computer), a mobile computer, a PDA / EDA, a mobile phone, a smartphone, a tablet, an IoT device, etc. Furthermore, the user terminal (100) is not limited thereto and may include any device having wired or wireless communication capabilities, such as a portable game console, a digital camera, a personal navigation device, etc.

[0046] Specifically, the user terminal (100) may achieve desired system performance by utilizing a combination of a computing device (e.g., a device that may include components of a computer processor, memory, storage, input device and output device, and other conventional computing devices; an electronic communication device such as a router, switch, etc.; an electronic information storage system such as a network attached storage (NAS) and a storage area network (SAN)) and computer software (i.e., instructions that cause the computing device to function in a specific way).

[0047] In addition, the processor of the computing device may include hardware components such as a Micro Processing Unit (MPU) or Central Processing Unit (CPU), cache memory, and a data bus. Furthermore, the computing device may further include software components such as an operating system and applications that perform specific purposes.

[0048] However, this does not exclude the case where the computing device includes an integrated processor in which a medium, a processor, and memory are integrated for implementing the present invention.

[0049] The process of performing a mobile identity verification service using a blockchain network-based decentralized ID (DID) by a user terminal (100) configured in this manner will be explained below with reference to FIGS. 2 to 6.

[0050] First, the user installs an ID DID application on the user terminal (100) and can generate a first user private key and a first user public key corresponding to the ID DID application. Then, through the ID DID application, the user can request the creation of a user DID including the first user public key to a blockchain network (400), for example, a blockchain network (400) that provides DID services. Accordingly, the blockchain network (400) can create a user DID and transmit it to the user terminal (100), and can register the first user public key as user public information in the blockchain network (400) by matching it with the user DID. At this time, the user DID creation request may include a signature value using the first user private key, and the blockchain network (400) can verify whether the user DID creation request was created by the user themselves by verifying the signature value using the first user public key included in the user DID creation request.

[0051] In addition, the first service providing server (200) and the identity card issuance server (300) can each generate the first service providing server DID and the identity card issuance server DID by the same method as above, and register their respective public keys, namely the first service providing server public key and the identity card issuance server public key, on the blockchain network (400).

[0052] And, the user may request (S201) the issuance of an identity information VC including a user DID, at least one user identity information, and an identity information signature value signed with a first user private key to the identity information, through the identity DID application of the user terminal (100). Then, the identity card issuance server (300) can obtain a first user public key corresponding to the user DID from the blockchain network (400) using the user DID (S202), verify the identity information signature value using the first user public key (S203), verify the user identity information when the identity information signature value is verified (S204), and when the user identity information is verified, generate identity information VCs (verifiable credentials) for each of the user identity information and transmit them to the user terminal (100) (S205), and accordingly, the user terminal (100) can store the identity information VCs obtained from the identity card issuance server (300) in a first storage unit linked to the identity card DID application of the user terminal (100).

[0053] For example, a user terminal (100) can manage identity information VC through an ID DID application on a TEE (Trusted Execution Environment).

[0054] TEE can refer to a secure execution environment provided by a separate, independent secure area within the main processor. Specifically, in a processor where the normal area and the secure area are separated, important information such as biometric data is stored in the secure area, and the exchange of information between the secure area and the normal area can be controlled.

[0055] Additionally, the identity card issuance server (300) may be operated by an administrative agency, and the identity information VC that can be issued by the identity card issuance server (300) may include at least some of the information regarding the user's name, the user's resident registration number, the user's address, the user's driver's license number, the family relationship certificate, the user's identity card issuing agency, and the date of issuance of the user's identity card. However, the identity information VC is not limited to the above examples, and any information necessary for user identity authentication can be the identity information VC.

[0056] Meanwhile, although the issuance of identity information VCs for user identity information was requested through the ID card DID application of the user terminal (100) in the above, alternatively, identity information VCs for each user identity information may be requested to be issued, and identity information VCs for each user identity information may be obtained.

[0057] Then, the user installs a service DID application on the user terminal (100) and can generate a second user private key and a second user public key corresponding to the service DID application. Then, through the service DID application, the user can request the registration of the second user public key that matches the user DID to the blockchain network (400), and accordingly, the blockchain network (400) can register the second user public key as user public information to the blockchain network (400) by matching it to the user DID. At this time, the user DID corresponding to the identity DID application and the user DID corresponding to the service DID application can be generated as user sub-DIDs corresponding to the master DID corresponding to the user, and the first user public key and the second user public key can be matched to each user sub-DID and registered to the blockchain network (400).

[0058] Meanwhile, although the registration of the user DID and the first user public key using the ID DID application and the registration of the user DID and the second user public key using the service DID application were described sequentially above, the operation of the ID DID application and the operation of the service DID application can be performed separately regardless of the chronological order.

[0059] Next, by the method described above, a user DID corresponding to a user and user public information corresponding to the user DID, that is, at least a first user public key and a second user public key, are registered in the blockchain network (400), and as each of the user identity information corresponding to the user DID is verified by the identity card issuance server (300), identity information VCs (verifiable credentials) for each of the user identity information are issued and stored in a first storage unit linked to the identity card DID application of the user terminal (100). Then, by the user's interaction to receive a user information VC related to a service provided by the first service provision server (200), the user terminal (100) can transmit the user DID, user information VC issuance request information, and an issuance request information signature value signed with the second user private key to the first service provision server (200) through the service DID application (S206).

[0060] And, the user terminal (100) can cause the first service provider server (200) to obtain a second user public key corresponding to the user DID from the blockchain network (400), and verify the validity of the user information VC issuance request information by verifying the signature value of the issuance request information using the second user public key, and if the user information VC issuance request information is confirmed to be valid, request user authentication information (S207) to the user terminal (100).

[0061] And, in response to a request for user authentication information from the first service providing server (200), the user terminal (100) can transmit user authentication information including a user DID, a specific identity information VC, and a first user signature value signed with the first user private key to the first service providing server (200) through an ID card DID application (S208).

[0062] Here, specific identity information VC may include an ID issuance server DID and an ID issuance server signature value.

[0063] For example, when user authentication information is requested from the first service provider server (200) to the user terminal (100) after the user information VC issuance request information is confirmed to be valid, and user validity information indicating that the user is a valid user is obtained, the user terminal (100) can transmit the user authentication information to the first service provider server (200) in response to the request for user authentication information from the first service provider server (200).

[0064] At this time, the valid user information that the user inputs into the user terminal (100) may include at least some of the user's user terminal password information, iris information, vein information, fingerprint information, retina information, facial information, voice information, DNA pattern information, and hand shape information.

[0065] And, the user terminal (100) may cause the first service provider server (200) to obtain a first user public key corresponding to the user DID from the blockchain network (400) using the user DID, or to obtain a user DID document corresponding to the user DID from the blockchain network (400) using the user DID through a resolver server and obtain a first user public key from the user DID document (S209), and to verify a first user signature value using the first user public key (S210).

[0066] And, when the first user signature value is verified, the user terminal (100) can cause the first service provider server (200) to obtain the ID issuance server public key corresponding to the ID issuance server DID from the blockchain network (400) using the ID issuance server DID (S211), and verify the specific identity information VC by verifying the ID issuance server signature value using the ID issuance server public key (S212).

[0067] At this time, the user terminal (100) may have the first service provider server (200) verify a specific identity information VC, and if it is determined that the specific identity information VC is invalid, the user terminal (100) may be asked to re-request user authentication information.

[0068] And, in response to a re-request for user authentication information from the first service provider server (200), the user terminal (100) can transmit user re-authentication information including other identity information VC to the first service provider server (200) through an ID card DID application, thereby causing the first service provider server (200) to verify other identity information VC.

[0069] Here, other identity information VCs may be at least one of the remaining identity information VCs, excluding a specific identity information VC that is determined to be invalid among the user's identity information VCs.

[0070] And, when a specific identity information VC or another identity information VC is verified, the user terminal (100) may cause the first service providing server (200) to generate a user information VC using user information related to the first service provided by the first service providing server (200) (S213), and transmit the user information VC to the user terminal (100) (S214).

[0071] In addition, in addition to the user information VC, access authorization information may be transmitted so that the user terminal (100) can access a first storage unit where the identity information VC is stored through a service DID application. Alternatively, request authorization information may be transmitted so that the user terminal (100) can request the identity information VC from an ID card DID application through a service DID application.

[0072] And, when user information VC is obtained, the user terminal (100) can store the user information VC in a second storage unit linked to the service DID application of the user terminal (100) through a service DID application.

[0073] At this time, the user information VC is a VC for user information related to the first service provided by the first service providing server (200), and may include various information depending on the first service provided by the first service providing server (200).

[0074] For example, the first service providing server (200) may correspond to a financial institution, a medical institution, a school, etc., but is not limited thereto, and any entity capable of issuing information related to a user can be the first service providing server (200).

[0075] In addition, at least some of the information regarding the user's account number, bank name, deposit and withdrawal transaction history, insurance premium payment certificate, graduation certificate, and employment certificate may be included in the user information VC, but this is merely an example for ease of understanding, and the information included in the user information VC is not limited to the above examples.

[0076] Up until now, the process of obtaining a user information VC using the user's identity information VC has been explained with reference to FIGS. 2 and 3. The process of a user terminal (100) receiving a service from a service provider server using the identity information VC and user information VC obtained through the above process will be explained below with reference to FIGS. 4 to 6.

[0077] First, user DIDs corresponding to the user and user public information corresponding to the user DID are registered in the blockchain network (400), and identity information VCs for each of at least one user identity information are issued and stored in a first storage unit linked to the ID DID application of the user terminal (100), and user information VCs for user information related to the first service provided by the first service provider server (200) are issued and stored in a second storage unit linked to the service DID application of the user terminal (100).

[0078] Here, the user public information may include at least a first user public key corresponding to the user DID and the ID DID application of the user terminal (100), and a second user public key corresponding to the user DID and the service DID application of the user terminal (100).

[0079] For reference, regarding the user DID, the first user private key, the first user public key, the second user private key, the second user public key, the ID DID application, the service DID application, the identity information VCs, and the user information VCs, since they have already been explained with reference to FIGS. 2 and FIGS. 3, a redundant explanation will be omitted.

[0080] In addition, the first service provider server (200) and the identity card issuance server (300) can each generate the first service provider server DID and the identity card issuance server DID by the method described above, and register their respective public keys, namely the first service provider server public key and the identity card issuance server public key, on the blockchain network (400).

[0081] Next, by the method described above, user DID and user public information corresponding to the user DID, namely, at least a first user public key and a second user public key, are registered in the blockchain network (400), identity information VCs are stored in a first storage unit linked to the ID card DID application of the user terminal (100), and user information VCs are stored in a second storage unit linked to the service DID application of the user terminal (100). Then, by means of a user interaction to receive a service provided by the second service providing server (500), the user terminal (100) transmits a service provision request to the second service providing server (500) (S401), thereby causing the second service providing server (500) to request user service authentication information from the user terminal (100) (S402).

[0082] For example, the second service providing server (500) may include an e-commerce server, a corporate job application server, etc., but is not limited thereto, and may be a server corresponding to any company that provides various services to users.

[0083] For example, a user terminal (100) may transmit a user DID, service provision request information, and a provision request information signature value signed with a second user private key to a second service provision server (500). Then, the user terminal (100) may cause the second service provision server (500) to obtain a second user public key corresponding to the user DID from the blockchain network (400), and verify the validity of the service provision request information by verifying the provision request information signature value using the second user public key, and if the service provision request information is confirmed to be valid, the user terminal (100) may be asked to request user service authentication information. However, the service provision request information is not limited to being signed with a second user private key and may also be signed with a first user private key.

[0084] And, in response to a request for user service authentication information from a second service providing server (500), the user terminal (100) may obtain at least one specific identity information VC and a first user signature value signed with a first user private key from an identity card DID application through a service DID application, and transmit user service authentication information including (i) user DID, (ii) specific identity information VC, (iii) first user signature value, (iv) at least one specific user information VC, and (v) a second user signature value signed with a second user private key including the specific identity information VC, the first user signature value, and the specific user information VC to the second service providing server (500) (S403).

[0085] Here, specific identity information VC includes an ID issuance server DID and an ID issuance server signature value, and specific user information VC may include a first service provider server DID and a first service provider server signature value.

[0086] And, the user terminal (100) may cause the second service provider server (500) to obtain a first user public key and a second user public key corresponding to the user DID from the blockchain network (400) using the user DID, or to obtain a user DID document corresponding to the user DID from the blockchain network (400) using the user DID through a resolver server and to obtain the first user public key and the second user public key from the user DID document (S404), and to verify the first user signature value and the second user signature value using the first user public key and the second user public key (S405).

[0087] And, when the first user signature value and the second user signature value are verified, the user terminal (100) can cause the second service provider server (500) to obtain the identity issuance server public key and the first service provider server public key corresponding to the identity issuance server DID and the first service provider server DID, respectively, from the blockchain network (400) using the identity issuance server DID and the first service provider server DID, respectively (S406), and verify the identity issuance server signature value and the first service provider server signature value, respectively, using the identity issuance server public key and the first service provider server public key, respectively, thereby verifying the specific identity information VC and the specific user information VC (S407).

[0088] And, when specific identity information VC and specific user information VC are verified, the user terminal (100) can cause the second service providing server (500) to transmit service information corresponding to the service provision request to the user terminal (100) (S408).

[0089] In the above description, as illustrated in FIG. 5, a user terminal (100) obtains at least one specific identity information VC and a first user signature value signed with a first user private key from an ID card DID application through a service DID application, and transmits user service authentication information including (i) user DID, (ii) specific identity information VC, (iii) first user signature value, (iv) at least one specific user information VC, and (v) a second user signature value signed with a second user private key including the specific identity information VC, the first user signature value, and the specific user information VC to a second service provider server (500), but is not limited thereto.

[0090] For example, a user terminal (100) may obtain at least one specific user information VC and a second user signature value signed with a second user private key from a service DID application through an identity DID application, and transmit user service authentication information including (i) user DID, (ii) specific user information VC, (iii) second user signature value, (iv) at least one specific identity information VC, and (v) a first user signature value signed with a first user private key for the specific user information VC, the second user signature value, and the specific identity information VC to a second service providing server (500).

[0091] Alternatively, the user terminal (100) may transmit user authentication information through each of the ID DID application and the service DID application.

[0092] For example, as illustrated in FIG. 6, user service authentication information may include first user service authentication information and second user service authentication information, and in response to a request for first user service authentication information and second user service authentication information from a second service providing server (500), a user terminal (100) may (i) transmit first user service authentication information including a user DID, specific identity information VC, and a first user signature value signed with a first user private key through an ID DID application to the second service providing server (500), and (ii) transmit second user service authentication information including a user DID, specific user information VC, and a second user signature value signed with a second user private key through a service DID application to the second service providing server (500), so that the specific identity information VC and the specific user information VC are each verified.

[0093] Furthermore, the embodiments according to the present invention described above may be implemented in the form of program instructions that can be executed through various computer components and recorded on a computer-readable recording medium. The computer-readable recording medium may include program instructions, data files, data structures, etc., either individually or in combination. The program instructions recorded on the computer-readable recording medium may be those specifically designed and configured for the present invention, or they may be those known and available to those skilled in the art of computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes; optical recording media such as CD-ROMs and DVDs; magneto-optical media such as floptical disks; and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, and flash memory. Examples of program instructions include machine code, such as that generated by a compiler, as well as high-level language code that can be executed by a computer using an interpreter, etc. The hardware device may be configured to operate as one or more software modules to perform processing according to the present invention, and vice versa.

[0094] Although the present invention has been described above with specific details such as specific components, limited embodiments, and drawings, this is provided only to aid in a more comprehensive understanding of the invention, and the invention is not limited to the above embodiments, and a person skilled in the art to which the invention belongs can make various modifications and variations from this description.

[0095] Accordingly, the scope of the present invention should not be limited to the embodiments described above, and all modifications equivalent to or equivalent to the claims set forth below, as well as the claims described below, shall be considered to fall within the scope of the concept of the present invention.

Claims

Claim 1 In a method for a mobile identity authentication service using a Decentralized Identifier (DID) based on a blockchain network, (a) a user DID corresponding to a user and user public information corresponding to said user DID - said user public information includes at least a first user public key corresponding to said user DID and an identity DID application of a user terminal and a second user public key corresponding to said user DID and a service DID application of said user terminal - are registered in this blockchain network, and as each of said user identity information corresponding to said user DID is verified by an identity DID issuance server, identity information VCs (verifiable credentials) for each of said user identity information are issued and stored in a first storage unit linked to said identity DID application of said user terminal, and said user identity information issuance request information, said user DID, and an issuance request information signature value signed with a second user private key are transmitted to a first service provider server through said service DID application, thereby causing said first service provider server to verify said issuance request information signature value and said user information VC issuance request information of A step of verifying validity, and if the user information VC issuance request information is confirmed to be valid, requesting user authentication information to the user terminal;and (b) in response to a request for user authentication information from the first service provider server, the user terminal transmits the user authentication information, which includes the user DID, at least one specific identity information VC, and a first user signature value signed with the first user private key, to the first service provider server through the ID DID application, thereby causing the first service provider server to obtain the first user public key corresponding to the user DID from the blockchain network using the user DID, or performs a user public key acquisition route (a) to obtain a user DID document corresponding to the user DID from the blockchain network using the user DID and to obtain the first user public key from the user DID document through a resolver server, and causes the first service provider server to verify the first user signature value using the first user public key, and if the first user signature value is verified, verifies the specific identity information VC, and if the specific identity information VC is verified, the first service provider server A method comprising the step of generating a user information VC using user information related to a first service provided, transmitting the user information VC to the user terminal, and, when the user information VC is obtained, storing the user information VC in a second storage unit linked to the service DID application of the user terminal through the service DID application. Claim 2 A method according to claim 1, wherein, in step (b), when user validity information indicating that the user is a valid user is obtained, the user terminal transmits the user authentication information to the first service provider server in response to a request for the user authentication information from the first service provider server, the user DID, the specific identity information VC, and the first user signature value signed with the first user private key through the ID card DID application. Claim 3 A method according to claim 1, wherein in step (b), the user terminal causes the first service provider server to verify the specific identity information VC, and if the specific identity information VC is determined to be invalid, the user terminal requests the user authentication information again, and in response to the request for the user authentication information again from the first service provider server, transmits user re-authentication information including other identity information VC through the ID card DID application to the first service provider server, thereby causing the first service provider server to verify the other identity information VC, and if the other identity information VC is verified, the user information VC is generated using the user information related to the first service provided by the first service provider server. Claim 4 A method according to claim 1, wherein the specific identity information VC includes an ID issuance server DID and an ID issuance server signature value, wherein the ID issuance server DID is used to obtain an ID issuance server public key corresponding to the ID issuance server DID from the blockchain network, and the ID issuance server public key is used to verify the ID issuance server signature value, thereby verifying the specific identity information VC. Claim 5 A method according to claim 1, characterized in that, in step (a), the user DID is used to obtain a second user public key corresponding to the user DID from the blockchain network, and the second user public key is used to verify the signature value of the issuance request information, thereby confirming the validity of the user information VC issuance request information. Claim 6 A method according to claim 1, characterized in that the user terminal manages the identity information VC on a Trusted Execution Environment (TEE) through the ID card DID application. Claim 7 In a method for a mobile identity authentication service using a decentralized identifier (DID) based on a blockchain network, (a) a user DID corresponding to a user and user public information corresponding to said user DID - in a method for a mobile identity authentication service using a decentralized identifier (DID) based on said blockchain network, (a) a user DID corresponding to a user and user public information corresponding to said user DID - said user public information includes at least a first user public key corresponding to said user DID and an identity DID application of a user terminal and a second user public key corresponding to said user DID and a service DID application of said user terminal - registered in this blockchain network, and identity information VCs for each of the user identity information are stored in a first storage unit linked to said identity DID application of said user terminal, and user information VCs for user information related to a first service provided by a first service providing server are stored in a second storage unit linked to said service DID application of said user terminal, and said user terminal transmits a service provision request to a second service providing server, thereby providing said second service A step of causing the providing server to request user service authentication information from the user terminal;and (b) in response to a request for user service authentication information from the second service providing server, the user terminal obtains at least one specific identity information VC and a first user signature value signed with a first user private key from the ID card DID application through the service DID application, and transmits the user service authentication information including (i) the user DID, (ii) the specific identity information VC, (iii) the first user signature value, (iv) at least one specific user information VC, and (v) a second user signature value signed with a second user private key to the specific identity information VC, the first user signature value, and the specific user information VC to the second service providing server, thereby causing the second service providing server to obtain the first user public key and the second user public key corresponding to the user DID from the blockchain network using the user DID through a user public key acquisition root or resolver server. A method comprising the step of: performing a b-user public key acquisition route to acquire the first user public key and the second user public key from the user DID document; causing the second service providing server to verify the first user signature value and the second user signature value using the first user public key and the second user public key; if the first user signature value and the second user signature value are verified, verifying the specific identity information VC and the specific user information VC; and if the specific identity information VC and the specific user information VC are verified, transmitting service information corresponding to the service provision request to the user terminal; Claim 8 A method according to claim 7, wherein the user service authentication information includes a first user service authentication information and a second user service authentication information, and in step (b), in response to a request for the first user service authentication information and the second user service authentication information from the second service providing server, the user terminal transmits to the second service providing server (i) the first user service authentication information including the user DID, the specific identity information VC, and the first user signature value signed with the first user private key through the ID card DID application, and (ii) the second user service authentication information including the user DID, the specific user information VC, and the second user signature value signed with the second user private key through the service DID application, characterized in that the user terminal transmits to the second service providing server. Claim 9 A method according to claim 7, wherein the specific identity information VC includes an ID issuance server DID and an ID issuance server signature value, and the specific user information VC includes a first service provision server DID and a first service provision server signature value, wherein the ID issuance server DID and the first service provision server DID are each utilized to obtain an ID issuance server public key and a first service provision server public key corresponding to the ID issuance server DID and the first service provision server DID, respectively, from the blockchain network, and wherein the ID issuance server public key and the first service provision server public key are each utilized to verify the ID issuance server signature value and the first service provision server signature value, respectively, thereby verifying the specific identity information VC and the specific user information VC. Claim 10 A method according to claim 7, characterized in that the user terminal manages the identity information VC in a Trusted Execution Environment (TEE) through the ID card DID application. Claim 11 A user terminal that performs a mobile identity authentication service using a decentralized identifier (DID) based on a blockchain network, comprising: at least one memory for storing instructions; and at least one processor configured to execute the above instructions, wherein the processor comprises: (1) a user DID corresponding to a user and user public information corresponding to the user DID - the user public information includes at least a first user public key corresponding to the user DID and the ID DID application of the user terminal and a second user public key corresponding to the user DID and the service DID application of the user terminal - which are registered in a blockchain network; wherein, as each of the user identity information corresponding to the user DID is verified by an ID issuance server, identity information VCs (verifiable credentials) for each of the user identity information are issued and stored in a first storage unit linked to the ID DID application of the user terminal; and wherein, through the service DID application, a user information VC issuance request information, the user DID, and an issuance request information signature value signed with the second user private key are transmitted to a first service provider server, thereby causing the first service provider server to verify the issuance request information signature value to confirm the validity of the user information VC issuance request information, and the user information A process for requesting user authentication information from the user terminal when the VC issuance request information is confirmed to be valid;and (2) in response to a request for user authentication information from the first service providing server, the user authentication information including the user DID, at least one specific identity information VC, and a first user signature value signed with the first user private key is transmitted to the first service providing server through the ID DID application, thereby causing the first service providing server to obtain the first user public key corresponding to the user DID from the blockchain network using the user DID, or to perform a user public key acquisition route (a) to obtain a user DID document corresponding to the user DID from the blockchain network using the user DID through a resolver server and to obtain the first user public key from the user DID document, and the first service providing server to verify the first user signature value using the first user public key, and if the first user signature value is verified, to verify the specific identity information VC, and if the specific identity information VC is verified, to perform a first service related to the first service provided by the first service providing server A user terminal executing the instructions that perform a process of generating a user information VC using user information, transmitting the user information VC to the user terminal, and, when the user information VC is obtained, storing the user information VC in a second storage unit linked to the service DID application of the user terminal through the service DID application. Claim 12 A user terminal according to claim 11, wherein, in the process (2), when user validity information indicating that the user is a valid user is obtained, the processor transmits the user authentication information to the first service provider server in response to a request for the user authentication information from the first service provider server, the user DID, the specific identity information VC, and the first user signature value signed with the first user private key through the ID card DID application. Claim 13 In claim 11, the processor, in the process (2), causes the first service provider server to verify the specific identity information VC, and if it is determined that the specific identity information VC is invalid, causes the user authentication information to be re-requested from the user terminal, and in response to the re-request for the user authentication information from the first service provider server, causes the first service provider server to verify the other identity information VC by transmitting user re-authentication information including other identity information VC through the ID card DID application to the first service provider server, and if the other identity information VC is verified, causes the user information VC to be generated using the user information related to the first service provided by the first service provider server. Claim 14 A user terminal characterized in that, in claim 11, the specific identity information VC includes an ID issuance server DID and an ID issuance server signature value, and the specific identity information VC is verified by using the ID issuance server DID to obtain an ID issuance server public key corresponding to the ID issuance server DID from the blockchain network, and by using the ID issuance server public key to verify the ID issuance server signature value. Claim 15 A user terminal according to claim 11, wherein, in the process (1), the processor is used to obtain a second user public key corresponding to the user DID from the blockchain network, and the validity of the user information VC issuance request information is confirmed by using the second user public key to verify the signature value of the issuance request information. Claim 16 A user terminal characterized by managing the identity information VC on a Trusted Execution Environment (TEE) through the ID card DID application in claim 11. Claim 17 A user terminal that performs a mobile identity authentication service using a decentralized identifier (DID) based on a blockchain network, comprising: at least one memory for storing instructions; and at least one processor configured to execute the above instructions, wherein the processor comprises: (1) a user DID corresponding to a user and user public information corresponding to the user DID - the user public information includes at least a first user public key corresponding to the user DID and an ID DID application and a second user public key corresponding to the user DID and a service DID application - are registered in a blockchain network, and identity information VCs for each of the user identity information are stored in a first storage unit linked to the ID DID application of the user terminal, and user information VCs for user information related to a first service provided by a first service providing server are stored in a second storage unit linked to the service DID application of the user terminal, and a process of transmitting a service provision request to a second service providing server to cause the second service providing server to request user service authentication information from the user terminal; and (2) in response to the request for user service authentication information from the second service providing server, at least one specific identity information VC and the specific identity information VC from the ID DID application through the service DID application Obtaining a first user signature value signed with a user private key, and (i) the user DID, (ii) the specific identity information VC, (iii) the first user signature value, (iv) at least one specific user information VC, and (v) the specific identity information VC,By transmitting the user service authentication information, which includes the first user signature value and the second user signature value signed with the second user private key, to the second service providing server, the second service providing server is made to obtain the first user public key and the second user public key corresponding to the user DID from the blockchain network using the user DID, or perform a user public key acquisition route (a) to obtain a user DID document corresponding to the user DID from the blockchain network using the user DID through a resolver server, and to obtain the first user public key and the second user public key from the user DID document; the second service providing server is made to verify the first user signature value and the second user signature value using the first user public key and the second user public key; and when the first user signature value and the second user signature value are verified, the specific identity information VC and the specific user information VC are verified, and the specific identity information VC and the specific A user terminal executing the instructions that perform a process of transmitting service information corresponding to the service provision request to the user terminal when the user information VC is verified. Claim 18 A user terminal characterized in that, in the 17th paragraph, the user service authentication information includes a first user service authentication information and a second user service authentication information, and the processor, in the process (2), responds to a request for the first user service authentication information and the second user service authentication information from the second service providing server, (i) transmits to the second service providing server the first user service authentication information including the user DID, the specific identity information VC, and the first user signature value signed with the first user private key through the ID card DID application, and (ii) transmits to the second service providing server the second user service authentication information including the user DID, the specific user information VC, and the second user signature value signed with the second user private key through the service DID application. Claim 19 A user terminal characterized in that, in claim 17, the specific identity information VC includes an ID issuance server DID and an ID issuance server signature value, and the specific user information VC includes a first service provision server DID and a first service provision server signature value, wherein the ID issuance server DID and the first service provision server DID are each utilized to obtain an ID issuance server public key and a first service provision server public key corresponding to the ID issuance server DID and the first service provision server DID, respectively, from the blockchain network, and the ID issuance server public key and the first service provision server public key are each utilized to verify the ID issuance server signature value and the first service provision server signature value, respectively, thereby verifying the specific identity information VC and the specific user information VC. Claim 20 A user terminal characterized by managing the identity information VC in a Trusted Execution Environment (TEE) through the ID card DID application in claim 17.

Images