A Method and System for Smart Device Transactions Based on Distributed Digital Identity

Abstract

This invention relates to the field of distributed digital identity technology and discloses a method and system for smart device transactions based on distributed digital identity. It aims to solve the problem of poor security in existing methods for confirming ownership of smart devices. The solution mainly includes: the manufacturer generating a public-private key pair and a DID document corresponding to the smart device; the smart device uploading the DID document to a distributed digital identity consortium blockchain; after the device purchaser creates an order, the manufacturer generates a verifiable credential; the device purchaser makes payment to a third-party payment platform; the third-party payment platform verifies the verifiable credential and, upon successful verification, pays the manufacturer for the order; the device purchaser obtains the device's private key; the third-party payment platform uploads the transaction process to the distributed digital identity consortium blockchain; the device purchaser retrieves the DID document from the distributed digital identity consortium blockchain and changes the device owner to the purchaser. This invention improves the security of confirming ownership of smart devices and is particularly suitable for IoT devices.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of distributed digital identity, in particular to a smart device transaction method and system based on distributed digital identity. BACKGROUND

[0002] With the continuous deepening and increasing richness of Internet of Things application scenarios, typical Internet of Things scenarios develop from single machine function to networking interaction. In the field of smart home, scenario linkage has become one of the core applications in the IoT field. In a home with multiple Internet of Things devices from different manufacturers, a device controls other devices to link, and the devices are connected and cooperated with each other, which can bring convenience and comfortable experience to smart home users.

[0003] When a user purchases a smart device, the smart device should be effectively attributed to the user to solve the problem of ownership of the smart device. Only when the ownership of the device belongs to the user, can the smart device linkage be performed under the authorization of the same user. Therefore, it is necessary to enable the smart device to confirm that the user is the purchaser, enable the user to confirm that the manufacturer is the manufacturer of the device, and enable the manufacturer to confirm that the device is a smart device purchased by the user. These problems involve the identity authentication and right confirmation of multiple parties. How to simply, safely and reliably solve the problem of ownership of the smart device is the basis and key of device cross-domain collaboration.

[0004] Blockchain technology is a distributed storage scheme involving knowledge in multiple disciplines such as mathematics, cryptography, and computer science. It has the characteristics of decentralization, traceability, non-tamperability, collective maintenance, and openness and transparency. Blockchain technology can meet the needs of data security and traceability in data collection of Internet of Things.

[0005] Distributed digital identity (DID) is based on blockchain technology. The decentralized characteristics of blockchain can effectively overcome the control problem of user accounts by a single service provider. The non-tamperable characteristics can effectively solve the problem of identity credit. The trust building mechanism based on credentials provides a secure mechanism for identity and authorization trust transmission, and provides a safe and reliable solution to the authentication and right confirmation problem of Internet of Things devices.

[0006] For the problem of smart device ownership transfer, the existing technology proposes a variety of solutions. For example, patent application No. 201510226295.9 discloses an Internet of Things identity authentication method based on Bluetooth communication access. This scheme uses asymmetric encryption technology to generate a key pair for the user end, exchanges public keys with the server end, and generates an id for the user based on the registration code, random number and Bluetooth MAC address submitted by the registered user and sends it to the user in encrypted form. This method uses asymmetric encryption technology, so only users with private keys can log in to the server. However, for pre-set registration passwords, it is easy for criminals to steal and disguise as honest users to access the system. At the same time, due to the short transmission distance of Bluetooth communication, it cannot meet the characteristics of wide coverage and low power consumption of the Internet of Things. For another example, patent application No. 201210281247.6 discloses an Internet of Things authentication method and system. This scheme generates a unique first and second electronic certificate by numbering the device accessories and through an algorithm, where the first electronic certificate is used to send to the third-party management platform for registration, and the second electronic certificate is used for subsequent login operations. This system uses a simple and easy authentication method to effectively reduce the burden on the third-party management platform. However, the method of generating electronic certificates based on accessory numbers is too simple, and hackers can generate second electronic certificates by obtaining device accessory numbers to invade the system, resulting in leakage of user or device data. SUMMARY

[0007] The present application aims to solve the problem of poor security in existing methods of confirming the ownership of smart devices, and proposes a smart device transaction method and system based on distributed digital identity.

[0008] The technical solution adopted by the present application to solve the above technical problems is:

[0009] On the one hand, a smart device transaction method based on distributed digital identity is provided, comprising the following steps:

[0010] Step 1, the manufacturer generates a device public-private key pair corresponding to the smart device, a DID account and a DID document, the DID document at least including: DID identifier, device public key, device owner, service and identity verification information, the device owner being the manufacturer by default;

[0011] Step 2, upload the DID document to the distributed digital identity alliance chain through the smart device;

[0012] Step 3, the device purchaser generates a personal public-private key pair, when the device purchaser creates an order to purchase the smart device, the manufacturer generates a first verifiable credential, and sends it to the device purchaser after encrypting the first verifiable credential by the personal public key and the platform public key of the third-party payment platform, the first verifiable credential at least includes: device purchaser information, device information, device private key, order information and financial information;

[0013] Step 4, the device purchaser pays to the third-party payment platform, and at the same time, the device purchaser sends the encrypted first verifiable credential to the third-party payment platform;

[0014] Step 5, the third-party payment platform decrypts the first verifiable credential using the platform private key, verifies the order information and financial information therein, and pays the order amount to the manufacturer after verification, then packs the remaining information in the first verifiable credential as a second verifiable credential, and sends it to the device purchaser;

[0015] Step 6, the device purchaser decrypts the second verifiable credential by the personal private key to obtain the device private key;

[0016] Step 7, the third-party payment platform uploads this transaction process to the distributed digital identity alliance chain;

[0017] Step 8, the device purchaser obtains the DID document from the distributed digital identity alliance chain, decrypts the DID document by the device private key, changes the device owner to the device purchaser, and updates the DID document on the distributed digital identity alliance chain.

[0018] Further, the first verifiable credential further includes: credential metadata, declaration and manufacturer proof.

[0019] Further, the first verifiable credential is encrypted by the personal public key and the platform public key of the third-party payment platform, specifically including:

[0020] The purchaser information, order information, device information and device private key are encrypted by the personal public key, and the encrypted purchaser information, order information, device information and device private key, and the unencrypted credential metadata, declaration, manufacturer proof, order information and financial information are encrypted by the platform public key of the third-party payment platform.

[0021] Further, the second verifiable credential includes: purchaser information, order information, device information and device private key encrypted by the personal public key, and unencrypted credential metadata, declaration and manufacturer proof.

[0022] Further, the smart device is an Internet of Things device.

[0023] On the other hand, a smart device transaction system based on distributed digital identity is provided, including:

[0024] The manufacturer generates a public / private key pair, DID account, and DID document corresponding to the smart device. The DID document includes at least: DID identifier, device public key, device owner, service, and authentication information. The device owner is assumed to be the manufacturer. After receiving an order created by the device purchaser, the manufacturer generates a first verifiable credential, encrypts it using a personal public key and the platform public key of a third-party payment platform, and sends it to the device purchaser. The first verifiable credential includes at least: device purchaser information, device information, device private key, order information, and financial information.

[0025] A smart device for uploading the DID document to a distributed digital identity consortium blockchain;

[0026] The device purchaser generates a personal public-private key pair, creates an order to purchase a smart device, makes payment to a third-party payment platform, and simultaneously sends an encrypted first verifiable credential to the third-party payment platform; after decrypting the second verifiable credential using personal private key A, obtains the device private key; and retrieves the DID document from the distributed digital identity consortium blockchain, decrypts the DID document using the device private key, changes the device owner to the device purchaser, and updates the DID document on the distributed digital identity consortium blockchain.

[0027] The third-party payment platform uses its private key to decrypt the first verifiable credential, verify the order information and financial information within it, and pays the order amount to the manufacturer after successful verification. Then, it packages the remaining information in the first verifiable credential into a second verifiable credential and sends it to the device purchaser.

[0028] The distributed digital identity consortium blockchain is used to receive DID documents uploaded by smart devices; to receive transaction processes uploaded by third-party payment platforms; and to receive updates to the DID documents from device purchasers.

[0029] Furthermore, the first verifiable credential also includes: credential metadata, claims, and vendor certification.

[0030] Furthermore, the first verifiable credential is encrypted using the individual's public key and the third-party payment platform's public key, specifically including:

[0031] After encrypting the buyer information, order information, device information, and device private key using a personal public key, the encrypted buyer information, order information, device information, and device private key, as well as the unencrypted credential metadata, claims, manufacturer certifications, order information, and financial information, are then encrypted using the platform public key of a third-party payment platform.

[0032] Furthermore, the second verifiable credential includes: purchaser information, order information, device information and device private key encrypted with a personal public key, as well as unencrypted credential metadata, claims and manufacturer certifications.

[0033] Furthermore, the smart device is an Internet of Things (IoT) device.

[0034] The beneficial effects of the present invention are as follows: The smart device transaction method and system based on distributed digital identity described in the present invention solves the identity authentication problem of smart devices, manufacturers, device buyers and third-party payment platforms by using verifiable credentials, securely transmits device private keys, and updates the device owner in the DID document on the distributed digital identity consortium blockchain, thereby securely realizing the ownership problem of smart devices and improving the security of smart device ownership confirmation. Attached Figure Description

[0035] Figure 1 This is a schematic diagram of the structure of the smart device transaction system based on distributed digital identity according to an embodiment of the present invention;

[0036] Figure 2 This is a flowchart illustrating the smart device transaction method based on distributed digital identity as described in an embodiment of the present invention.

[0037] Figure 3 This is a schematic diagram of the distributed digital identity creation process described in an embodiment of the present invention;

[0038] Figure 4 This is a schematic diagram of the structure of a DID document according to an embodiment of the present invention;

[0039] Figure 5 This is a schematic diagram of the order creation process according to an embodiment of the present invention;

[0040] Figure 6 This is a schematic diagram of the process for purchasing smart devices according to an embodiment of the present invention;

[0041] Figure 7 This is a schematic diagram of the structure of the first verifiable credential according to an embodiment of the present invention;

[0042] Figure 8 This is a schematic diagram of the structure of the second verifiable credential according to an embodiment of the present invention;

[0043] Figure 9This is a schematic diagram of the process for modifying the device owner according to an embodiment of the present invention. Detailed Implementation

[0044] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0045] This invention aims to provide a smart device transaction method and system based on distributed digital identity to improve the security of device ownership confirmation. The main technical solution includes: the manufacturer generating a device public-private key pair, a DID account, and a DID document corresponding to the smart device. The DID document includes at least: a DID identifier, a device public key, a device owner, service information, and authentication information, with the device owner defaulting to the manufacturer; the smart device uploads the DID document and device public key to a distributed digital identity consortium blockchain; the device purchaser generates a personal public-private key pair; when the device purchaser creates an order to buy the smart device, the manufacturer generates a first verifiable credential, encrypts the first verifiable credential using the personal public key and the platform public key of a third-party payment platform, and sends it to the device purchaser. The first verifiable credential includes at least: device purchaser information, device information, a device private key, order information, and financial information; the device purchaser then sends the first verifiable credential to the third-party payment platform. The third-party payment platform makes the payment, and simultaneously, the device purchaser sends an encrypted first verifiable credential to the third-party payment platform. The third-party payment platform decrypts the first verifiable credential using its platform private key, verifies the order and financial information within it, and pays the order amount to the manufacturer upon successful verification. Then, it packages the remaining information from the first verifiable credential into a second verifiable credential and sends it to the device purchaser. The device purchaser decrypts the second verifiable credential using their personal private key to obtain the device private key. The third-party payment platform uploads this transaction process to the distributed digital identity consortium blockchain. The device purchaser obtains the DID document from the distributed digital identity consortium blockchain, decrypts the DID document using the device private key, changes the device owner to the device purchaser, and updates the DID document on the distributed digital identity consortium blockchain.

[0046] Specifically, device buyers purchase IoT devices from manufacturers and acquire ownership of the devices. They can authorize other users or devices to access the smart devices and customize corresponding access permissions. Specifically, this invention first establishes a distributed digital identity based on IoT devices, serving as the foundation for subsequent authentication and authorization. When a device buyer wants to purchase an IoT device, they need to prove that the manufacturer is the IoT device manufacturer, and the manufacturer needs to know that the device buyer is the purchaser involved in the payment transaction. Therefore, a verifiable credential is generated to prove mutual identities. Within this verifiable credential, order information and financial information are provided to a third-party payment platform for confirmation, while buyer information, device information, and the device's private key are provided to the buyer for confirmation and use. After generating an order, the device buyer pays the third-party platform. The third-party platform needs to verify that the device purchased by the payer belongs to the target manufacturer and ensure the buyer securely obtains the device's private key. The transaction process needs to be recorded on the blockchain for evidence storage, achieving a seamless cash-on-delivery transaction. After obtaining the device's private key, the device purchaser needs to use the device's private key to update the DID document on the distributed digital alliance blockchain, changing the device owner to the device purchaser to complete the ownership of the IoT device. After the device purchaser has ownership of the device, they can authorize other users or devices to access the smart device and customize the corresponding access permissions.

[0047] Example

[0048] Please see Figure 1 In this embodiment, smart devices are taken as IoT devices. The smart device transaction system based on distributed digital identity includes: manufacturers, IoT devices, device buyers, third-party payment platforms, and distributed digital identity consortium blockchains.

[0049] In this system, the device purchaser buys IoT devices from a manufacturer and owns the devices. They can authorize other users or devices to access the IoT devices and customize corresponding access permissions. The manufacturer refers to the company that produces the IoT devices and has initial ownership of the devices; they are the original owners. The IoT device refers to the device being accessed, requiring authentication of the visitor to confirm their access rights. A distributed digital identity consortium blockchain is used to store publicly available information such as distributed data identity accounts and public keys. A third-party payment platform completes the payment process for the device purchaser, verifying the manufacturer's identity information, the purchase order, and financial information.

[0050] Please see Figure 2 Based on the above system, the smart device transaction method based on distributed digital identity provided in this embodiment includes the following steps:

[0051] This embodiment first requires establishing a distributed digital identity based on IoT devices, which will serve as the foundation for subsequent authentication and authorization. Please refer to [link / reference]. Figure 3 According to the W3C DIDs V1.0 standard, the digital identity establishment process in this embodiment includes the following steps:

[0052] Step 1: The manufacturer generates a public-private key pair, DID account, and DID document corresponding to the smart device. The DID document includes at least: DID identifier, device public key, device owner, service, and authentication information. The device owner is the manufacturer by default.

[0053] In this embodiment, the manufacturer generates a public-private key pair for the device; this process does not require a unified CA for key creation. The DID account generation method is existing technology and will not be elaborated here, nor is this embodiment limiting in this regard.

[0054] Step 2: Upload the DID document to the distributed digital identity consortium blockchain using the smart device;

[0055] Please see Figure 4 In this embodiment, the DID document contains a DID identifier, device public key, device owner, service, and authentication information, wherein the device owner is the manufacturer.

[0056] For a buyer to purchase an IoT device, they need to prove that the manufacturer is indeed the IoT device manufacturer. The manufacturer, in turn, needs to know that the buyer is the one making the payment transaction. Therefore, verifiable credentials are required to prove each other's identities. Please refer to [link / reference]. Figure 5 and Figure 6 In this embodiment, the creation of an order and the generation of verifiable credentials include the following steps:

[0057] Step 3: The device purchaser generates a personal public-private key pair PubA and PriA. After the device purchaser creates an order to purchase a smart device, the manufacturer generates a first verifiable credential VC1, and encrypts the first verifiable credential VC1 with the personal public key PubA and the platform public key PubB of the third-party payment platform before sending it to the device purchaser.

[0058] Specifically, before creating an order, the device purchaser needs to generate a personal public-private key pair, PubA and PriA, and add the personal public key PubA to the order when creating it. The order can be created online or offline; this embodiment does not restrict this. For example, the device purchaser can create an order online using a terminal app. The manufacturer generates a first verifiable credential VC1 based on the order information, device information, and purchaser information in the order.

[0059] Please see Figure 7In this embodiment, the first verifiable credential (VC1) includes: credential metadata, claims, vendor certification, device purchaser information, device information, device private key, order information, and financial information.

[0060] After generating the first verifiable credential VC1, it is further encrypted to enhance security. Specifically, in this embodiment, the buyer information, order information, device information, and device private key are encrypted using the personal public key PubA. Then, the encrypted buyer information, order information, device information, and device private key, as well as the unencrypted credential metadata, claims, vendor certification, order information, and financial information, are encrypted using the platform public key PubB of the third-party payment platform.

[0061] Step 4: The equipment purchaser makes payment to the third-party payment platform, and at the same time, the equipment purchaser sends the encrypted first verifiable credential VC1 to the third-party payment platform;

[0062] Step 5: The third-party payment platform decrypts the first verifiable credential VC1 using its platform private key, verifies the order information and financial information within it, and pays the order amount to the manufacturer after successful verification. Then, the remaining information in the first verifiable credential VC1 is packaged into the second verifiable credential VP1 and sent to the device purchaser.

[0063] The third-party payment platform verifies that the device purchased by the buyer belongs to the target manufacturer based on order information and financial information. After verification, the platform pays the purchase fee to the manufacturer and securely provides the device buyer with the device's private key.

[0064] In this embodiment, the second verifiable credential (Verifiable Presentation 1, VP1) contains the remaining information from the first verifiable credential VC1. Please refer to [link / reference]. Figure 8 This includes: buyer information, order information, device information and device private key encrypted with a personal public key, as well as unencrypted credential metadata, claims and manufacturer certifications.

[0065] Step 6: The device purchaser decrypts the second verifiable credential VP1 using their personal private key PriA to obtain the device private key;

[0066] Step 7: The third-party payment platform uploads the transaction process to the distributed digital identity consortium blockchain;

[0067] Specifically, the device purchaser decrypts the second verifiable credential VP1 using their personal private key PriA to obtain the purchaser's information, order information, purchase information, and the device's private key. Once the device purchaser obtains the device's private key, the transaction is completed. The third-party payment platform uploads the transaction process to the distributed digital identity consortium blockchain for evidence storage, realizing the exchange of money for goods.

[0068] In the steps described above, the device purchaser has already obtained the device's private key by decrypting the second verifiable credential VP1. The device purchaser needs to use the device's private key to update the DID document on the distributed digital consortium blockchain, changing the device owner to the device purchaser to complete the ownership of the IoT device. Please refer to [link to relevant documentation]. Figure 9 The process mainly includes:

[0069] Step 8: The device purchaser obtains the DID document from the distributed digital identity consortium blockchain, decrypts the DID document using the device's private key, changes the device owner to the device purchaser, and updates the DID document on the distributed digital identity consortium blockchain.

[0070] Once the DID message on the distributed digital identity consortium blockchain is updated, a consensus is reached that the device owner is the device purchaser, and the ownership of the IoT device changes accordingly. This allows the device purchaser to own the IoT device and authorize other users or devices to access it, as well as customize the corresponding access permissions.

[0071] In summary, the smart device transaction method and system based on distributed digital identity described in this embodiment solves the identity authentication problem of IoT devices, manufacturers, device buyers, and third-party payment platforms by using verifiable credentials, securely transmits device private keys, and updates the device owner in the DID document on the distributed digital identity consortium blockchain, thereby securely realizing the ownership of smart devices and improving the security of smart device ownership confirmation.

Claims

1. A method for smart device transaction based on distributed digital identity, characterized in that, The method comprises the following steps: Step 1, the manufacturer generates a device public-private key pair corresponding to the smart device, a DID account and a DID document, wherein the DID document at least includes a DID identifier, a device public key, a device owner, a service and identity verification information, and the device owner is the manufacturer by default; Step 2, uploading the DID document to a distributed digital identity alliance chain through the smart device; Step 3, the device purchaser generates a personal public-private key pair, and when the device purchaser creates an order for purchasing the smart device, the manufacturer generates a first verifiable credential, encrypts the first verifiable credential through the personal public key and a platform public key of a third-party payment platform, and sends the encrypted first verifiable credential to the device purchaser, wherein the first verifiable credential at least includes device purchaser information, device information, a device private key, order information and financial information; Step 4, the device purchaser makes payment to the third-party payment platform, and at the same time, the device purchaser sends the encrypted first verifiable credential to the third-party payment platform; Step 5, the third-party payment platform decrypts the first verifiable credential using a platform private key, verifies the order information and the financial information in the first verifiable credential, and after verification, pays the order amount to the manufacturer, then packs the remaining information in the first verifiable credential into a second verifiable credential, and sends the second verifiable credential to the device purchaser; Step 6, the device purchaser decrypts the second verifiable credential through the personal private key, and obtains the device private key; Step 7, the third-party payment platform uploads the transaction process to the distributed digital identity alliance chain; Step 8, the device purchaser obtains the DID document from the distributed digital identity alliance chain, decrypts the DID document through the device private key, modifies the device owner to the device purchaser, and updates the DID document on the distributed digital identity alliance chain. 2.The distributed digital identity based smart device transaction method of claim 1, wherein, The first verifiable credential further includes credential metadata, a statement and manufacturer proof. 3.The distributed digital identity based smart device transaction method of claim 2, wherein, The first verifiable credential is encrypted through the personal public key and the platform public key of the third-party payment platform, specifically including: The purchaser information, the order information, the device information and the device private key are encrypted through the personal public key, and then the encrypted purchaser information, the order information, the device information and the device private key, and the unencrypted credential metadata, the statement, the manufacturer proof, the order information and the financial information are encrypted through the platform public key of the third-party payment platform.

4. The distributed digital identity based smart device transaction method as claimed in claim 3, wherein, The second verifiable credential includes the purchaser information, the order information, the device information and the device private key encrypted through the personal public key, and the unencrypted credential metadata, the statement and the manufacturer proof.

5. The distributed digital identity based smart device transaction method of any one of claims 1 to 4, wherein, The smart device is an Internet of Things device.

6. A smart device transaction system based on distributed digital identity, characterized by, The method comprises the following steps: A manufacturer generates a device public-private key pair, a DID account, and a DID document for a smart device, the DID document including at least a DID identifier, a device public key, a device owner, a service, and identity verification information, the device owner being the manufacturer by default; after receiving an order created by a device purchaser, generates a first verifiable credential, encrypts the first verifiable credential with a personal public key and a platform public key of a third-party payment platform, and sends the encrypted first verifiable credential to the device purchaser, the first verifiable credential including at least device purchaser information, device information, a device private key, order information, and financial information; The smart device uploads the DID document to a distributed digital identity alliance chain. The device purchaser generates a personal public-private key pair, creates an order for purchasing the smart device, makes a payment to the third-party payment platform, and sends the encrypted first verifiable credential to the third-party payment platform; decrypts the second verifiable credential with the personal private key A to obtain the device private key; and obtains the DID document from the distributed digital identity alliance chain, modifies the device owner to the device purchaser, and updates the DID document on the distributed digital identity alliance chain. The third-party payment platform decrypts the first verifiable credential with a platform private key, verifies the order information and the financial information, and pays the order amount to the manufacturer after verification, then packs the remaining information in the first verifiable credential as the second verifiable credential, and sends it to the device purchaser. The distributed digital identity alliance chain receives the DID document uploaded by the smart device, receives the transaction process uploaded by the third-party payment platform, and receives the update of the DID document by the device purchaser.

7. The distributed digital identity based smart device transaction system as claimed in claim 6, wherein, The first verifiable credential further includes credential metadata, a statement, and manufacturer proof.

8. The distributed digital identity based smart device transaction system as claimed in claim 7, wherein, The first verifiable credential is encrypted with the personal public key and the platform public key of the third-party payment platform, specifically including: The purchaser information, the order information, the device information, and the device private key are encrypted with the personal public key, and the encrypted purchaser information, the order information, the device information, and the device private key, and the unencrypted credential metadata, the statement, the manufacturer proof, the order information, and the financial information are encrypted with the platform public key of the third-party payment platform.

9. The distributed digital identity based smart device transaction system as claimed in claim 8, wherein, The second verifiable credential includes the purchaser information, the order information, the device information, and the device private key encrypted with the personal public key, and the unencrypted credential metadata, the statement, and the manufacturer proof.

10. The distributed digital identity based smart device transaction system as claimed in any one of claims 6 to 9, wherein, The smart device is an Internet of Things device.

Images