Apparatus and method for entrusted management of distributed identifier information

Abstract

The present invention relates to a technology related to a decentralized identifier (also called a DID, distributed ID, decentralized ID, or distributed identifier), and to a device and method for entrusted management of decentralized identifier information, which securely entrusts and manages self-sovereign identifier information. The self-sovereign identity certificate can be entrusted and stored in a cloud-based virtual safe, significantly reducing the reissue due to user data loss.

Description

[Technical field]

[0001] The present invention is a decentralized identifier (DID, also known as decentralized ID, decentralized ID, or distributed identifier). The present invention relates to a technology relating to a distributed identifier information entrusted management device and method for securely entrusting management of self-sovereign identifier information. [Background technology]

[0002] In the decentralized identifier method, the issuer verifies and issues the authentication information requested by the user and registers it on the blockchain network, and the authentication information submitted and requested by the user is then queried and verified by the registered blockchain network.

[0003] The recent development of a wide variety of blockchain networks has been remarkable, and as a result, the number of users using heterogeneous blockchain network environments is increasing. This causes great inconvenience because the authentication information of users registered in one blockchain network cannot be confirmed or verified even in heterogeneous blockchain network environments. There is a strong demand for technology that can confirm and verify user authentication information upon request even in many heterogeneous blockchain network environments. Summary of the Invention [Problem to be solved by the invention]

[0004] The present invention provides an apparatus and method for entrusted management of distributed identifier information, which encrypts and divides a user's self-sovereign identifier information and entrusts it to be managed based on a cloud virtual safe. [Means for solving the problem]

[0005] According to one aspect of the present invention, there is provided an apparatus for entrusted management of distributed identifier information.

[0006] A distributed identifier information entrusted management device according to one embodiment of the present invention may include a user platform that provides an identity certification processing service to a user, an identity management unit that manages identifier information, an identity certification unit that authenticates the identifier information, and an entrusted storage unit that stores the identifier information in a cloud-based virtual safe.

[0007] According to another aspect of the present invention, there is provided a method for entrusted management of distributed identifier information and a computer program for executing the same.

[0008] A method for entrusted management of distributed identifier information according to one embodiment of the present invention may include steps of selecting a certificate that needs to be submitted and inputting submission destination information, authenticating the entrustedly stored identity certificate, verifying the authenticated identity certificate, and submitting the identity certificate. Effect of the Invention

[0009] According to an embodiment of the present invention, the self-sovereign identity certificate can be entrusted to a cloud-based virtual safe to significantly reduce the risk of reissue due to loss of user data.

[0010] Furthermore, according to an embodiment of the present invention, the amount of discarded information is reduced, and the cost of inquiry and verification is also reduced, preventing the overall system response speed from slowing down.

[0011] Furthermore, according to one embodiment of the present invention, a device and method for entrusted management of distributed identifier information that is highly secure and convenient can be provided since it is cloud-based and does not transfer sensitive information using bio-authentication. [Brief description of the drawings]

[0012] [Figure 1] FIG. 2 is a diagram for briefly explaining a distributed identifier information entrustment management device according to an embodiment of the present invention. [Diagram 2] FIG. 2 is a diagram for briefly explaining a distributed identifier information entrustment management device according to an embodiment of the present invention. [Diagram 3] FIG. 2 is a diagram for briefly explaining a distributed identifier information entrustment management device according to an embodiment of the present invention. [Figure 4] FIG. 2 is a flow chart illustrating a method for entrusting management of distributed identifier information according to an embodiment of the present invention. [Diagram 5] FIG. 2 is a flow chart illustrating a method for entrusting management of distributed identifier information according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] Since the present invention can be modified in various ways and can have various embodiments, a specific embodiment is illustrated in the drawings and described in detail. However, this is not intended to limit the technical idea of ​​this disclosure to a specific embodiment, and it should be understood that it includes all modifications, equivalents, or alternatives within the scope of the technical idea of ​​this disclosure. In describing the present invention, if it is recognized that a specific description of a known technology related to the present invention may rather obscure the gist of the present invention, the detailed description will be omitted. In addition, the singular expression used in this specification and the claims generally means "one or more" unless it has a clearly different meaning from the context.

[0014] Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the description with reference to the accompanying drawings, the same or corresponding components will be given the same reference symbols, and duplicate descriptions thereof will be omitted.

[0015] 1 to 3 are diagrams for briefly explaining a distributed identifier information entrusted management device according to an embodiment of the present invention.

[0016] The decentralized identifier information entrustment management device 10 entrusts and stores identity certificates issued through a blockchain-based decentralized identifier network in a cloud-based virtual safe and manages them.

[0017] 1, when the decentralized identifier information entrustment management device 10 requests registration or discarding of identifier information via a user platform 100, the identity management unit 200 registers or discards the identifier information in the identity certification unit 300. The identity management unit 200 encrypts and stores the identity certificate of the registered identifier information in the entrustment storage unit 400.

[0018] Thereafter, in response to a request for verification or submission of the identity certificate via the user platform 100, the identity management unit 200 submits the identity certificate information stored in the entrustment storage unit 400 to a destination after verification by the identity certification unit 300.

[0019] Referring to FIG. 2, the decentralized identifier information entrustment management device 10 may include a user platform 100, an identity management unit 200, an integrated management unit 300, and an entrustment storage unit 400.

[0020] The user platform 100 may provide an identity certification processing service to a user. The user platform 100 may be a service provided for a request for identity certification processing by a user using a personal computer, tablet, laptop, mobile phone, etc. A user may request an identity information management service such as registration, authentication, submission, and disposal of identity information to the identity management unit 200 using a net key and an authentication key via the user platform 100. The net key is a key for authenticating the identity of the user, and may be a key obtained by combining an identification code of an issuer of a blockchain token. The user platform 100 may request to entrust storage and management of authenticated identity certificate information using the net key and authentication key that authenticate the identity of the user.

[0021] A user can join the platform through the user platform 100 and manage their identifier information through the identity manager 200 .

[0022] The present invention can reduce inconveniences associated with user data loss by entrusting identity certificate information issued and authenticated by a blockchain-based self-sovereign identifier network to be stored in a cloud-based virtual safe upon a user request. In detail, the present invention can store and manage identifier information authenticated by the identity certification unit 300 in the entrustment storage unit 400 via the identity management unit 200.

[0023] The identity management unit 200 can request that the certification information used to certify a user's identity be registered / revoked in the identity certification unit 300, which is a blockchain-based distributed identifier network.

[0024] In addition, the identity management unit 200 can entrust the storage of the identifier information of the user authenticated by the identity certification unit 300 in a cloud-based virtual safe and manage it. In detail, the identity management unit 200 can encrypt and divide the certificate information of the authenticated user, entrust the storage of the information to a cloud-based virtual safe, and manage it.

[0025] The identity management unit 200 can collectively manage the life cycle of identity certificate information, such as registration, authentication, submission, and revocation, in response to a request via the user platform 100.

[0026] When identity authentication or proof is required at the user's request, the identity management unit 200 can verify using the credential information entrusted and stored in the cloud-based virtual safe. Since the identity management unit 200 performs verification using the credential information entrusted and stored in the cloud-based virtual safe, identity proofing can be performed even if the credential information stored in the user device is damaged or lost.

[0027] The present invention entrusts the storage of distributed identifier information authenticated through the blockchain in a cloud-based virtual safe, significantly reducing the reissue of lost user data and reducing the amount of discarded information, saving time for inquiries and verification and preventing a slowdown in the overall system response speed.

[0028] Referring to FIG. 3, the identity proofing unit 300 may include a circle chain 310 and an authentication block chain 320.

[0029] The identity certifying unit 300 may be a blockchain-based self-sovereign distributed identifier network. The identity certifying unit 300 is compatible with a plurality of different blockchain environments. The identity certifying unit 300 can perform a function of creating and discarding identifier information registered in a plurality of different blockchains by utilizing a Circle Chain 310. The identity certifying unit 300 can manage a distributed identifier (DID) in the blockchain to authenticate identifier information.

[0030] The identity certification unit 300 can utilize the circle chain 310 as a relay channel that can link identifier information to each other even in a case of multiple heterogeneous blockchain environments. The identity certification unit 300 can collectively manage identifier information stored in multiple heterogeneous blockchains in response to a management request for one person's identifier information.

[0031] The identity proofing unit 300 can collectively manage authentication information using the circle chain 310 that links different blockchains together. The identity proofing unit 300 can store and manage each of the different types of blockchain authentication information that are linked to each other via the circle chain 310 using the user's unique key (ECDSA).

[0032] The identity proofing unit 300 can collectively store and manage the authentication information of each different type of blockchain in the authentication blockchain 320. In detail, the identity proofing unit 300 can register identifier information in each different type of blockchain via the circle chain 310 based on the authentication information of each different type of blockchain stored in the authentication blockchain 320, and can easily respond to requests such as authentication, submission, and discarding of the stored identifier.

[0033] Circle Chain 310 can act as a relay channel to support interlinking between heterogeneous blockchains.

[0034] The Circle Chain 310 can generate heterogeneous blockchain linking blocks that contain linking information between heterogeneous blockchains. The heterogeneous blockchain linking blocks can be referenced to each other using the unique hash values ​​of blocks generated at the representative nodes of the heterogeneous blockchains.

[0035] Circle Chain 310 can link each blockchain's identifier authentication information, including private keys, public keys, identifiers (IDs), validity periods, etc., to each other.

[0036] Returning to Fig. 2, the entrusted storage unit 400 is a cloud-based virtual safe that stores the user's identifier information. The entrusted storage unit 400 can entrust and store the identity certificate information authenticated by the identity certification unit 300 in response to a request from the user platform 100.

[0037] The trust storage unit 400 can encrypt and divide the identity certificate information of an authenticated user before storing it.

[0038] The entrustment storage unit 400 stores separately the net key for verifying the identity of the person and the identity certificate information.

[0039] According to the embodiment of the present invention, the identity management unit 200 can authenticate a user using the authentication key of the user platform 100 and the net key stored in the entrustment storage unit 400, verify the user's identity certificate stored in the entrustment storage unit 400 in the identity certification unit 300, and provide the verified identity certificate information to the submission destination.

[0040] Conventionally, an identity certificate is stored in a user device and then submitted to a destination after being verified by the identity certification unit 300. However, when there is a change in the user device or data loss, it is necessary to discard the existing information and reissue it every time, which is troublesome.

[0041] 4 and 5 are flow charts for explaining a method for entrusted management of distributed identifier information according to an embodiment of the present invention. Each process described below is a process performed by each functional unit constituting an apparatus for entrusted management of distributed identifier information in a step, but for a simple and clear explanation of the present invention, the subject of each step will be collectively referred to as an apparatus for entrusted management of distributed identifier information in the step.

[0042] Referring to FIG. 4, a distributed identifier information trust management device 10 can request issuance of an identity certificate via a user platform 100.

[0043] In step S4010, the distributed identifier information entrusted management device 10 inputs information for issuing a certificate.

[0044] In step S4020, the distributed identifier information trustee management device 10 requests issuance of a certificate.

[0045] In step S4030, the distributed identifier information entrustment management device 10 authenticates the information of the person who has made the issuance request using the authentication key.

[0046] In step S4040, the distributed identifier information entrusted management device 10 can issue a certificate via the identity management unit 200.

[0047] In step S4050, the entrusted management device 10 of the distributed identifier information registers the identifier information in the distributed identifier network. At this time, the entrusted management device 10 of the distributed identifier information may be a plurality of heterogeneous distributed identifier network environments. The entrusted management device 10 of the distributed identifier information can generate a heterogeneous blockchain linking block including linking information between heterogeneous blockchains. The heterogeneous blockchain linking blocks can be mutually referenced using unique hash values ​​of blocks generated in the representative nodes of the heterogeneous blockchains. The authentication blockchain 320 can store the heterogeneous blockchain linking blocks and collectively store and manage the authentication information of each heterogeneous blockchain.

[0048] The decentralized identifier information entrusted management device 10 can utilize the circle chain 310 as a relay channel capable of linking the identifier information stored in each of the different blockchains to each other.

[0049] The distributed identifier information entrusted management device 10 can collectively manage certification information registered in multiple different types of blockchains in response to one certification information management request.

[0050] When identifier information is registered in one blockchain, the distributed identifier information entrusted management device 10 can transmit the registered information to other linked blockchains.

[0051] In step S4060, the distributed identifier information entrusted management device 10 can complete the registration of the certification information into the distributed identifier network.

[0052] In step S4070, the distributed identifier information trustee management device 10 completes the issuance of the identity certificate for the registered identifier.

[0053] In step S4080, the distributed identifier information entrustment management device 10 stores the issued identity certificate information and the net key in the entrustment storage unit 400. The entrustment storage unit 400 can encrypt and store the net key and the identity certificate information in a divided manner.

[0054] In step S4090, the distributed identifier information entrusted management device 10 confirms that there are no errors and completes storing the certificate.

[0055] In step S4100, the distributed identifier information entrusted management device 10 checks the result of the certificate issuance and notifies the user of the completion.

[0056] Referring to FIG. 5, the distributed identifier information trust management device 10 authenticates and verifies the identity certificate entrusted and stores it, and submits it to the destination upon request.

[0057] In step S5010, the distributed identifier information entrusted management device 10 selects the certificate that needs to be submitted, and inputs the submission destination information.

[0058] In step S5020, the entrustment management device 10 of the distributed identifier information decrypts and authenticates the identity certificate using the authentication key (biometric authentication) and the net key stored in the entrustment storage unit 400.

[0059] In step S5030, the distributed identifier information trust management device 10 queries the distributed identifier (DID) of the user who has requested the identity certificate.

[0060] In step S5040, the delegated management device 10 of the distributed identifier information requests the identity certification unit 300 to verify the decrypted and authenticated identity certificate.

[0061] In step S5050, the entrusted management device 10 of the distributed identifier information submits an identity certificate based on the verification result of the identity certifying unit 300.

[0062] The above-mentioned method for entrusted management of distributed identifier information may be realized by computer readable codes on a computer readable medium. The computer readable recording medium may be, for example, a portable recording medium (compact disc (CD), digital versatile disc (DVD), Blu-ray disc, USB storage device, portable hard disk) or a fixed recording medium (read only memory (ROM), random access memory (RAM), computer-installed hard disk). The computer program recorded on the computer readable recording medium may be transmitted to another computing device via a network such as the Internet and installed in the other computing device, and thus can be used in the other computing device.

[0063] Although it has been described above that all of the components constituting the embodiments of the present invention are combined into one or operate in combination, the present invention is not necessarily limited to such an embodiment. In other words, within the scope of the present invention, all of the components can be selectively combined into one or more components and operate.

[0064] Additionally, although the acts in the figures are depicted in a particular order, it should not be understood that the acts must be performed in the particular order shown, or in a sequential order, or that every act shown must be performed to achieve desired results. In certain circumstances, multitasking and parallel processing may be advantageous. Furthermore, the separation of various components in the embodiments described above should not be understood as requiring such separation in all embodiments, and the program components and systems described may generally be incorporated together in a single software product or packaged as multiple software products.

[0065] The present invention has been described above with reference to specific embodiments. Those skilled in the art will appreciate that the present invention can be realized as modified embodiments without departing from the technical characteristics of the present invention. Therefore, the disclosed embodiments should be considered from an explanatory perspective, not a restrictive one. The scope of the present invention is defined in the claims, not the above description, and all differences within the scope of the equivalents are included in the present invention.

[0066] The embodiments of the invention are described together in the "Description of Embodiments of the Invention" section above. [Industrial Applicability]

[0067] The present invention can significantly reduce the reissue due to loss of user data by entrusting self-sovereign identity certificates to be stored in a cloud-based virtual safe, and since sensitive personal information is not used, convenience and security are increased, and thus the present invention has industrial applicability.

Claims

1. In a distributed identifier information entrustment management device, A user platform for providing users with identity authentication processing services; an identity management unit that manages identifier information; an identity certifier for authenticating the identifier information; a depository unit that deposits the identifier information in a cloud-based virtual safe; Equipped A distributed identifier information entrusted management device comprising:

2. The entrusted storage unit includes: Identifier information is encrypted and stored in separate chunks 2. The apparatus for entrusted management of distributed identifier information according to claim 1.

3. The identity management unit includes: Verification using credentials stored in a cloud-based virtual safe 2. The apparatus for entrusted management of distributed identifier information according to claim 1.

4. The identity certification unit includes: It is a blockchain-based self-sovereign decentralized identifier network.

2. The apparatus for entrusted management of distributed identifier information according to claim 1.

5. A method for entrusting management of distributed identifier information, which is performed by an entrusted management device for distributed identifier information, comprising: Selecting the certificate you need to submit and entering the submission information; authenticating the held identity certificate; validating the authenticated identity certificate; submitting an identity certificate; Includes A method for entrusted management of distributed identifier information, comprising:

6. The identity certificate is divided and encrypted for storage.

6. A method for entrusted management of distributed identifier information according to claim 5.

7. The identity certificate is stored in a cloud-based virtual safe.

6. A method for entrusted management of distributed identifier information according to claim 5.

8. In the step of verifying the authenticated identity certificate, Use a blockchain-based self-sovereign decentralized identifier network 6. A method for entrusted management of distributed identifier information according to claim 5.

9. A method for entrusted management of distributed identifier information according to any one of claims 5 to 8, comprising: A computer program characterized by:

Images