Personal authentication method and system

Abstract

To provide an identity verification method that protects an identity forgery problem, by using a block chain technique.SOLUTION: A method is configured to: store a public key of a key pair, identity identification information, and an identity identification information hash value corresponding to the identity identification information in a database of a server; store an identity identification information hash value having an electronic signature signed with an encrypted key of the key pair in a block chain connected to the server; determine whether a user account has the identity identification information; acquire the identity identification information hash value having the electronic signature signed with the encrypted key from the block chain on the basis of a determination result of the user account having the identity identification information; verify and decrypt the identity identification information hash value having the electronic signature signed with the encrypted key by the public key acquired from the database; and generate an identity verification result in comparison of the decrypted identity identification information hash value with the identity identification hash value stored in the database.SELECTED DRAWING: Figure 4

Description

[Background technology]

[0001] The present invention relates to a method for identity verification and a system thereof. Specifically, the present invention relates to a method for identity verification and a system thereof that utilizes block chain technology.

[0002] With the development of the Internet, there is an increasing demand for authenticating the identity and authority of users online, for example, application programs and websites require users to provide personal identification information, or authenticate users by real name in order to allow users to log in or provide services to users. Summary of the Invention [Problem to be solved by the invention]

[0003] However, providing personal information to application programs or websites may increase the risk of data leakage to the outside. It is also difficult for application programs and websites to identify users who have forged their identities. For this reason, it is necessary to provide an identity authentication method that reduces the risk of personal data leakage to the outside and prevents identity forgery.

[0004] An object of the present invention is to provide an identity authentication method that reduces the amount of personal information provided to application programs and websites, and reduces the risk of data leaking to the outside.

[0005] Another object of the present invention is to provide an identity authentication method that utilizes the characteristics of blockchain, which makes it difficult to tamper with, to prevent the problem of identity forgery. [Means for solving the problem]

[0006] In one embodiment of the present invention, the identity authentication method is performed by a server side, and a database on the server side stores a public key of a key pair, identity identification information, and an identity identification information hash value corresponding to the identity identification information. The server side is connected to a blockchain via a communication network, and the blockchain stores an identity identification information hash value with a digital signature of a private key of the key pair. The identity authentication method includes a step of determining whether a user account has identity identification information, a step of acquiring an identity identification information hash value with a digital signature of a private key from the blockchain based on a determination result that the user account has identity identification information, a step of authenticating the identity identification information hash value with a digital signature of a private key by a public key, and a step of acquiring a decrypted identity identification information hash value, and a step of comparing the decrypted identity identification information hash value with an identity identification information hash value stored in a database to generate an identity authentication result.

[0007] In another embodiment of the present invention, the system for identity authentication includes a server side and a database. The server side is connected to the blockchain through a communication network. The system is configured to perform the following steps: receiving a user account and a user password input by a user to the application side from the application side through the communication network; verifying that the user account and the user password are accurate, authenticating the user's identity according to the above implementation method, and generating an identity authentication result including success or failure; returning the identity authentication result to the application side, and the application side allows the user to log in to the application side if the received identity authentication result is successful. Effect of the Invention

[0008] This configuration eliminates the need for users to repeatedly provide their personal identification information to different applications, reducing the risk of data leaking to the outside. In addition, because blockchain is difficult to tamper with, the application can prevent users who have falsely identified themselves from logging in to the application. In this way, the object of the present invention is achieved. [Brief description of the drawings]

[0009] [Figure 1] 4 is a flowchart of a step of uploading personal identification information in a personal authentication method according to an embodiment of the present invention. [Figure 2A] 2 is a block diagram illustrating a step of uploading personal identification information in a personal authentication method according to an embodiment of the present invention; [Figure 2B] 2 is a block diagram illustrating a step of uploading personal identification information in a personal authentication method according to an embodiment of the present invention; [Figure 2C] 2 is a block diagram illustrating a step after uploading personal identification information in a personal authentication method according to an embodiment of the present invention; [Diagram 3] 4 is a lookup table showing user accounts corresponding to identity identification codes in a personal authentication method according to an embodiment of the present invention; [Figure 4] 4 is a flowchart illustrating an authentication step in an authentication method according to an embodiment of the present invention. [Diagram 5] FIG. 11 is a block diagram illustrating an individual authentication system according to another embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] The following describes the identity authentication method of the present invention with specific embodiments and accompanying drawings. Those skilled in the art can understand the technical concept and effect of the present invention from the contents of the present disclosure. However, the contents disclosed below do not limit the scope of the claimed object, and within the principle of not departing from the concept of the present invention, those skilled in the art can realize the contents of the present disclosure through embodiments of different structures, operation sequences, etc.

[0011] With reference to FIG. 1 and FIG. 2A, an identity authentication method according to an embodiment of the present invention will be described. In this embodiment, the identity authentication method includes a step S100 of uploading identity information and a step S400 of identity authentication (see the description of FIG. 4). FIG. 2A is a block diagram showing a schematic diagram of the step S100 of uploading identity information. These blocks include an uploader side 210 providing identity information 213, a server side 230 implementing the method, and a blockchain 250, and the server side 230 includes a database 240 and is connected to the blockchain 207 via a communication network. In this embodiment, the uploader side 210 is a unit that grants, authorizes, or issues the identity information 213, for example, the identity information 213 is a certificate, license, or certificate related to status or authority, and the uploader side 210 may be a school, an institution, an organization, etc. For example, a school uploads the diplomas of this year's graduates to the server side 230, with the school being the uploader side 210 and the diploma being the identity information 213. It should be noted here that the above uploader side 210 and personal identification information 213 are merely exemplary descriptions, and in other embodiments, the uploader side 210 and personal identification information 213 may be of other types, and the present invention is not limited thereto.

[0012] Each uploader side 210 has a unique symmetric key 211 (for example, Advanced Encryption Standard (AES) algorithm), and the database 240 stores a symmetric key hash value 241 obtained by calculating the symmetric key 211 using a hash algorithm. , the server side 230A unique asymmetric key pair is generated (e.g., using an RSA encryption algorithm), and database 240 stores public key 243 and private key 245 of the key pair after encryption of symmetric key 211. It should be noted that the algorithms used for symmetric key 211 and asymmetric key pair described above are all illustrative examples, and other algorithms may be used to generate symmetric key 211 (e.g., Data Encryption Standard (DES) algorithm) and asymmetric key pair (e.g., ElGamal encryption algorithm) in alternative embodiments, and the present invention is not limited thereto.

[0013] Hereinafter, an embodiment of the present invention will be described with reference to FIGS. 1, 2A and 2B. In step S103, the method includes receiving the symmetric key 211 and the personal identification information 213 from the uploader side 210 by the server side 230. In step S105, the method includes calculating the hash value of the received symmetric key 211 and comparing it with the symmetric key hash value 241 stored in the database 240, and if they are the same, decrypting the encrypted private key 245 stored in the database 240 by the symmetric key 211. As shown in FIG. 2B, different hash values ​​are obtained after hash calculation of different data, so that the comparison is successful and the decrypted private key 245 can be obtained only by the uploader side 210 providing the correct symmetric key. With this configuration, due to the uniqueness of the symmetric key 211 possessed by each uploader side 210, the server side 230 can verify the identity of the uploader side 210 by comparing the hash value, and ensure that the personal identification information 213 is provided by the correct uploader side 210.

[0014] Next, an embodiment of the present invention will be described with reference to FIGS. 1, 2A and 2C. In step S107, the method includes a step of calculating the hash value of the personal identification information 213, and then storing the personal identification information 213 and the personal identification information hash value 215 in the database 240. And in step S109, the method includes a step of digitally signing the personal identification information hash value 215 with the decrypted private key 245 and uploading it to the blockchain 250. As shown in FIG. 2C, after the above steps are completed, the personal identification information 213 and the personal identification information hash value 215 are stored in the database 240, the personal identification information hash value 215 digitally signed by the private key is stored in the blockchain 250, and the server side 230 does not store the decrypted private key 245 after uploading the digitally signed personal identification information hash value 215 to the blockchain 250. With this configuration, the database 240 of the server side 230 has only the symmetric key hash value 241 and the encrypted private key 245, and if the uploader side 210 does not provide the symmetric key 211, the server side 230 cannot decrypt the private key 245, nor can it issue a digital signature using the private key 245. Therefore, the uploader side 210 can ensure the accuracy of the source of the personal identification information 213 uploaded to the blockchain 250. In addition, since the personal identification information 213 uploaded to the blockchain 250 is a hash value calculated by hash calculation, it is possible to prevent the personal identification information 213 from leaking to the outside on the communication network.

[0015] Then, in step S111, the method further includes obtaining a blockchain identification code 251 (e.g., a message ID, a transaction ID, etc.), and storing the blockchain identification code 251 in the database 240 in a manner associated with the identity information 213 (see FIG. 2C). The blockchain identification code 251 may be a series of hexadecimal codes, such as "a05fbd93b26d6304d6e1f5ea6f231ffe9bebe6b033ba7544ea29b0f73beb7935". The blockchain identification code 251 can be used to search for data corresponding to the blockchain identification code 251 through a blockchain browser (e.g., the IOTA blockchain browser: https: / / explorer.iota.org / mainnet). It should be noted here that the above-mentioned blockchain identification code 251 and blockchain browser are merely exemplary explanations, and in other embodiments, a blockchain other than IOTA may be used, and the blockchain identification code 251 and blockchain browser are used based on the blockchain, but the present invention is not limited thereto.

[0016] Hereinafter, an embodiment of the present invention will be described with reference to FIG. 3 illustrates a lookup table 300 showing user accounts 301 corresponding to identity information identification codes 303. In this embodiment, the method S100 includes step S113, in which identity information identification codes 303 corresponding to the identity information 213 are generated, and the identity information identification code 217 is stored in the database 303 in a manner associated with the user account 301. Identity information 213 corresponding to identity information identification code 303 has uniqueness, that is, different identity information 213 generates different identity information identification codes 303, so identity information 213 can be identified by identity information identification code 303. In addition, each user account 301 corresponds to one user, and each user may have various identities or privileges, so each user account 301 may be associated with multiple different identity information identification codes 303. For example, referring to the lookup table 300 shown in FIG. 3, the same user simultaneously has a diploma awarded by a certain school (personal identification information identification code 303 is ID_1) and a professional license issued by a certain organization (personal identification information identification code 303 is ID_2), and therefore, from the lookup table 300, it can be seen that the personal identification information identification code 303 corresponding to the user account 301 (example 1) is ID_1 and ID_2. With this configuration, it is possible to know whether the user account 303 has a specified personal identification information identification code 303, and to determine whether the user account 301 has a specified personal identification information 213, thereby achieving the purpose of determining whether the user has a specified status or authority. It should be noted here that, although the lookup table 300 of this embodiment shows the association between the user account 303 and the personal identification information identification code 303, in other embodiments, the personal identification information identification code 303 may be stored in other ways to associate with the user account 303, and the present invention is not limited thereto.

[0017] Next, an identity authentication method according to an embodiment of the present invention will be described with reference to Figures 3 and 4. In this embodiment, the identity authentication method further includes an identity authentication step S400 in addition to the identity information uploading step S100. In step S401, the method includes a step of determining whether the user account 301 has the identity information 213, which includes a step of determining whether the user account 301 is associated with the identity information identification code 303. After the identity information uploading step S100, the identity information 213 uploaded by the uploader side 210 is stored in the database 240, and the identity information identification code 303 corresponding to the identity information 213 is also stored in the database 240 in a manner associated with the user account 301 (see the lookup table in Figure 3). 3, a lookup table 300 can be used to determine whether a user account 301 is associated with a particular personal identity ID code 303 (e.g., ID_1), and determine whether the user account 301 has personal identity 213 (e.g., a diploma) that corresponds to the personal identity ID code 303. With this configuration, the server side 230 can first initially verify whether the user account 301 has a specified status or authority, and then facilitate the subsequent authentication of the personal identity 213.

[0018] Next, the personal authentication method according to this embodiment will be described with reference to FIG. 2C and FIG. In step S403, the method includes a step of obtaining the identity information hash value 215 with the digital signature of the private key 245 from the blockchain 250 based on the determination result that the user account 301 has the identity information 213. In the identity information step S100, the identity information 213 provided by the uploader side 210 is calculated as a hash value and digitally signed by the private key 245, and then uploaded to the blockchain 250 (see FIG. 2C). In this embodiment, the server side 230 can obtain the identity information hash value 215 with the digital signature of the private key 245 from the blockchain 250 through the blockchain browser described above by the blockchain identification code 251 stored in the database 240 and corresponding to the identity information 213. In step S405, the method includes a step of authenticating the identity information hash value 215 with the digital signature of the private key 245 by the public key 243 and obtaining the decrypted identity information hash value 215. With this configuration, the public key 243 and private key 245 stored in the database 240 are made into an asymmetric key pair, and upon successful authentication of the public key 243, the personal identification information hash value 215 with the electronic signature of the private key 245 is decrypted to once again confirm that the personal identification information 213 was sent from the uploader side 210 corresponding to the private key 245.

[0019] Next, in step S407, the method includes a step of comparing the decrypted personal identification information hash value 215 with the personal identification information hash value 215 stored in the database 240 to generate a personal identification authentication result. In the data uploading step S100, the personal identification information hash value 215 is stored in the database 240 and simultaneously uploaded to the blockchain 250 (see FIG. 2C). Due to the characteristic of the blockchain 250 being difficult to tamper with, it is possible to confirm whether the personal identification information 213 is forged by comparing the personal identification information hash value 215 stored in the database 240 with the personal identification information hash value 215 obtained from the blockchain 250 and decrypted. Specifically, if the above two are the same, it is confirmed that the personal identification information 213 is not forged, and a personal identification authentication result of success is generated. Conversely, if the above two are not the same, it is determined that the personal identification information 213 is forged, and a personal identification authentication result of failure is generated.

[0020] Next, an identity authentication system 500 according to another embodiment of the present invention will be described with reference to Fig. 5. The identity authentication system 500 includes a server side 230 and a database 240 as in the above-mentioned embodiment. In this embodiment, a user 501 inputs a user account 301 and a user password 505 to an application side 503, and the application side 503 receives the user account 301 and the user password 505 and transmits them to the server side 230 via a communication network. First, the server side 203 authenticates the user account 301 and the user password 505, and after authenticating success, the application side 503 executes the identity authentication step S400 of the above-mentioned embodiment based on a necessary identity or authority, and obtains an identity authentication result 507 (e.g., success or failure). After receiving the personal authentication result 507 returned by the server side 203, the application side 503 allows the user 501 to log in to the application side 503 if the personal authentication result 507 is successful, and on the other hand, denies the user 501 from logging in to the application side 503 if the personal authentication result 507 is unsuccessful. The application side 503 may be an application program, a website, or any other service provider that requires a specific identity or authority, and this configuration allows the application side 503 to achieve the purpose of personal authentication without acquiring or storing any personal identification information 213 of the user 501. In addition, the user 501 does not need to provide the personal identification information 213 to different application sides 503 multiple times, reducing the possibility of data leaking to the outside.

[0021] The above disclosure is merely a preferred embodiment of the present invention, and does not limit the scope of the claims of the present invention. In addition, the order of the method described in this specification is merely an exemplary explanation, and a person skilled in the art can change the order of steps under an equivalent concept of the present invention. In addition, unless clearly contradictory to the contents of this specification, the singular terms "a" and "the" used in this specification also include the plural cases. In the attached drawings, the shape, position, size, etc. of each element, member, unit, etc. are intended to concisely and clearly show the technical contents of the present invention, and do not limit the present invention. In addition, well-known details and structures are omitted in the drawings. [Explanation of symbols]

[0022] 210...uploader side, 211...symmetric key, 213...personal identification information, 215...personal identification information hash value, 230...server side, 240...database, 241...symmetric key hash value, 243...public key, 245...private key, 250...blockchain, 251...blockchain identification code, 300...lookup table, 301...user account, 303...personal identification information identification code, 500...personal authentication system, 501...user, 503...application side, 505...user password, 507...personal authentication result, S100...method, S103...step, S105...step, S107...step, S109...step, S111...step, S113...step, S400...method, S401...step, S403...step, S405...step, S407...step,

Claims

1. A method for authenticating an individual, which is implemented by a server side having a database and connected to a blockchain and an uploader side via a communication network, The database stores a public key, a user identification, and a user identification hash value corresponding to the user identification, and the public key is included in a unique asymmetric key pair generated by the server side for the uploader side; The blockchain stores the customer identification information hash value digitally signed by the server side using a private key included in the asymmetric key pair, The method for authenticating an individual includes the steps of: determining whether a user account has said identifying information; acquiring the digitally signed hash value of the personal identification information from the blockchain based on a determination result that the user account has the personal identification information; authenticating the identity-identification-information hash value having the digital signature applied thereto by using the public key and obtaining a decrypted identity-identification-information hash value; a step of comparing the decrypted personal identification information hash value with the personal identification information hash value stored in the database, and generating a personal authentication result.

2. The database further stores a symmetric key hash value and an encrypted private key corresponding to one unique symmetric key possessed by the uploader side, the encrypted private key being generated by the server side by encrypting the private key included in the asymmetric key pair using the symmetric key, The method comprises: receiving the symmetric key and the identity information from the uploader; calculating a hash value of the received symmetric key and comparing the calculated hash value of the symmetric key with the symmetric key hash value stored in the database; decrypting the encrypted private key using the symmetric key based on a comparison result that the calculated hash value of the symmetric key is the same as the symmetric key hash value stored in the database; calculating a hash value of the received identity information to obtain the identity information hash value; storing the identity information and the identity information hash value in the database; The method of identity authentication according to claim 1, further comprising the steps of digitally signing the identity identification information hash value with the decrypted private key and uploading the identity identification information hash value with the digital signature to the blockchain.

3. 3. The method of claim 2, further comprising: generating an identity identification code corresponding to the identity information; and storing the identity identification code in the database in a manner associated with the user account.

4. The step of determining whether the user account has the personal identification information comprises:

4. The method of claim 3, further comprising determining that the user account has the personal identification information based on the user account associated with the personal identification information identification code.

5. The step of uploading the digitally signed identity information hash value to the blockchain includes: The method for personal authentication according to claim 2, further comprising a step of storing a blockchain identification code in the database in a manner associated with the personal identification information, the blockchain identification code corresponding to the personal identification information hash value to which the electronic signature is applied and which is stored in the blockchain.

6. The step of acquiring the identity identification information hash value to which the digital signature is applied from the blockchain includes: The method for personal authentication according to claim 5, further comprising a step of searching the blockchain using the blockchain identification code and obtaining the uploaded personal identification information hash value to which the electronic signature has been applied.

7. An identity authentication system including a server side and a database, the server side being connected to a blockchain and an uploader side via a communication network, and the system: receiving a user account and a user password input by a user to the application side from the application side via a communication network; After verifying that the user account and the user password are correct, authenticating the identity of the user according to the method of any one of claims 1 to 6, and generating an identity authentication result including success or failure; returning the result of the personal authentication to the application side, and if the received result of the personal authentication is successful, allowing the user to log in to the application side.

Images