Method and system for supporting use of verifiable credential

Abstract

According to an aspect of the present invention, provided is a method for supporting the use of verifiable credential, including the steps of: receiving a request to issue VC managed in a specific group; determining whether the VC has already been issued on the basis of a first identifier associated with the VC; and in response to determining that the VC has not been issued, issuing the VC, and in response to determining that the VC has already been issued, processing the request to issue the VC according to a duplicate VC management policy of the specific group or an entity that belongs to the specific group and receives the request to issue the VC.

Description

Methods and systems for supporting the use of verifiable credentials

[0001] The present invention relates to methods and systems for supporting the use of verifiable credentials.

[0002] With the recent rise in interest in Self-Sovereign Identity (SSI), there has been active discussion on how to prove one's eligibility for a desired service using a verifiable credential (VC; abbreviated as "credential" hereafter). This method essentially involves an issuer issuing a digital credential that certifies a specific entity, such as an individual or organization, as possessing a specific qualification. This credential is then presented to a verifier in the form of a verifiable presentation (VP; abbreviated as "presentation" hereafter), which the verifier then verifies.

[0003] As an example of the prior art in this regard, a technology disclosed in Korean Patent Publication No. 10-2023-0143410 can be cited, which is characterized by including the steps of: analyzing the ID issuance history recorded in the decentralized ID management contract in response to a request for issuance of a 'decentralized ID' from a user to inquire whether the user has a decentralized ID already issued; issuing a new decentralized ID to the user if there is no decentralized ID already issued as a result of the inquiry; and, when the new decentralized ID delivered to the user is recorded in the user's electronic wallet, registering the issued decentralized ID in the decentralized ID storage and updating the issuance details of the decentralized ID by recording them in the ID issuance history.

[0004] However, according to the above-mentioned conventional technology and the technologies introduced so far, there was no way to prevent the duplication of VCs when an individual receives VCs performing the same or similar roles from multiple issuers (for example, when an individual receives a VC with the same qualification to be proven from a first issuer and then receives it again from a second issuer), or when the same VC is issued to multiple devices (for example, when an individual receives a VC from a first issuer using a first device and then receives the same VC again from the first issuer using a second device).

[0005] Accordingly, the inventor(s) of the present invention propose a technology for preventing duplicate use of VCs by receiving a request for issuance of a VC managed by a specific group, determining whether the VC has already been issued based on a first identifier associated with the VC, issuing the VC in response to determining that the VC has not been issued, and processing the request for issuance of the VC in response to determining that the VC has already been issued according to a duplicate VC management policy of the specific group or an entity that belongs to the specific group and receives the request for issuance of the VC.

[0006] <Prior Art Literature>

[0007] Patent Document

[0008] (Patent Document 0001) Korean Patent Publication No. 10-2023-0143410 (October 12, 2023)

[0009] The purpose of the present invention is to solve all of the problems of the above-mentioned prior art.

[0010] In addition, the present invention has another purpose of receiving a request for issuance of a VC managed in a specific group, determining whether the VC has already been issued based on a first identifier associated with the VC, issuing the VC in response to determining that the VC has not been issued, and processing the request for issuance of the VC in response to determining that the VC has already been issued in accordance with a duplicate VC management policy of the specific group or an entity that belongs to the specific group and receives the request for issuance of the VC.

[0011] In addition, another object of the present invention is to prevent duplicate use of VC.

[0012] In addition, another object of the present invention is to enable VC to be managed efficiently while maintaining the up-to-dateness of VC.

[0013] In addition, another object of the present invention is to maintain a balance between protecting user privacy and sharing information between groups.

[0014] A representative configuration of the present invention to achieve the above purpose is as follows.

[0015] According to one aspect of the present invention, a method is provided, comprising the steps of: receiving a request for issuance of a VC managed by a specific group; determining whether the VC has already been issued based on a first identifier associated with the VC; and, in response to determining that the VC has not been issued, issuing the VC, and in response to determining that the VC has already been issued, processing the request for issuance of the VC according to a duplicate VC management policy of the specific group or of an entity that belongs to the specific group and receives the request for issuance of the VC.

[0016] According to another aspect of the present invention, a system is provided, including a request receiving unit for receiving a request for issuing a VC managed in a specific group, a duplication determining unit for determining whether the VC has already been issued based on a first identifier associated with the VC, and an issuance management unit for causing the VC to be issued in response to determining that the VC has not been issued, and for causing the request for issuing the VC to be processed in accordance with a duplication VC management policy of the specific group or of an entity that belongs to the specific group and receives the request for issuing the VC in response to determining that the VC has already been issued.

[0017] In addition, a non-transitory computer-readable recording medium recording another method for implementing the present invention, another system, and a computer program for executing the method are further provided.

[0018] According to the present invention, a request for issuance of a VC managed by a specific group is received, and whether the VC has already been issued is determined based on a first identifier associated with the VC, and in response to determining that the VC has not been issued, the VC is issued, and in response to determining that the VC has already been issued, the request for issuance of the VC is processed according to a duplicate VC management policy of the specific group or an entity that belongs to the specific group and receives the request for issuance of the VC.

[0019] In addition, according to the present invention, it is possible to efficiently manage VC while maintaining the up-to-dateness of VC.

[0020] Additionally, the present invention enables a balance to be maintained between protecting user privacy and sharing information between groups.

[0021] FIG. 1 is a diagram schematically illustrating the configuration of an entire system for supporting the use of verifiable credentials according to one embodiment of the present invention.

[0022] FIG. 2 is a drawing detailing the internal configuration of a holder-side system according to one embodiment of the present invention.

[0023] FIG. 3 is a drawing detailing the internal configuration of an issuer-side system according to one embodiment of the present invention.

[0024] <Explanation of symbols>

[0025] 100: Communications network

[0026] 200: Verifier side system

[0027] 300: Holder-side system

[0028] 400: Issuer's system

[0029] 310, 410: Request receiving unit

[0030] 320, 420: Duplicate judgment section

[0031] 330, 430: Issuance Management Department

[0032] 340, 440: Communications Department

[0033] 350, 450: Control unit

[0034] 500: Device

[0035] The following detailed description of the present invention refers to the accompanying drawings, which illustrate specific embodiments in which the present invention may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the present invention. It should be understood that the various embodiments of the present invention, while different from each other, are not necessarily mutually exclusive. For example, specific shapes, structures, and characteristics described herein may be modified and implemented from one embodiment to another without departing from the spirit and scope of the present invention. Furthermore, it should be understood that the positions or arrangements of individual components within each embodiment may also be modified without departing from the spirit and scope of the present invention. Accordingly, the following detailed description is not to be taken in a limiting sense, and the scope of the present invention is to be construed to encompass the scope of the claims and all equivalents thereof. Like reference numerals in the drawings represent the same or similar elements throughout the several aspects.

[0036] Hereinafter, various preferred embodiments of the present invention will be described in detail with reference to the attached drawings so that a person having ordinary skill in the art to which the present invention pertains can easily practice the present invention.

[0037] Composition of the entire system

[0038] FIG. 1 is a diagram schematically illustrating the configuration of an entire system for supporting the use of verifiable credentials according to one embodiment of the present invention.

[0039] As illustrated in FIG. 1, the entire system according to one embodiment of the present invention may include a communication network (100), a verifier-side system (200), a holder-side system (300), an issuer-side system (400), and a device (500).

[0040] First, the communication network (100) according to one embodiment of the present invention can be configured regardless of the communication mode such as wired communication or wireless communication, and can be configured with various communication networks such as a local area network (LAN), a metropolitan area network (MAN), and a wide area network (WAN). Preferably, the communication network (100) referred to herein may be the well-known Internet or the World Wide Web (WWW). However, the communication network (100) is not necessarily limited thereto, and may include at least a portion of a well-known wired or wireless data communication network, a well-known telephone network, or a well-known wired or wireless television communication network.

[0041] For example, the communication network (100) may be a wireless data communication network that implements conventional communication methods such as WiFi communication, WiFi-Direct communication, Long Term Evolution (LTE) communication, 5G communication, Bluetooth communication (including Bluetooth Low Energy (BLE) communication), infrared communication, ultrasonic communication, etc., at least in part. As another example, the communication network (100) may be an optical communication network that implements conventional communication methods such as LiFi (Light Fidelity), etc., at least in part.

[0042] Next, a node (not shown) according to one embodiment of the present invention, for example, an issuer node, a holder node, a verifier node, etc., is a contact point or connection point that can communicate with other nodes through a communication network (100), and may be a concept including a physical node such as a server, a computer, a laptop, a smart phone, a tablet PC, etc. (i.e., a digital device equipped with a memory means and equipped with a microprocessor to have computational capabilities), or a logical node such as an application, a program module, a virtual machine, etc. (i.e., a virtual node).

[0043] Specifically, according to one embodiment of the present invention, a node may be a digital wallet in itself, or may be a concept that includes a digital wallet. A digital wallet is a software or hardware device that allows users to securely store and manage digital assets, authentication information, identity information, etc., and refers to a means of storing various data while allowing the stored data to be used as needed. For example, an issuer node, a holder node, and a verifier node may refer to digital wallets owned by an issuer, holder, and verifier, respectively, or digital wallets running on the devices of an issuer, holder, and verifier.

[0044] According to one embodiment of the present invention, these nodes may refer to each node that is interconnected to form a distributed ledger network. According to one embodiment of the present invention, these nodes may include a verifier system (200), a holder system (300), and / or an issuer system (400), which will be described later, in the form of program modules such as applications and widgets to support the use of credentials based on distributed ledger technology (DLT). Furthermore, such program modules may be downloaded from an external application distribution server (not shown) or an external system (not shown).

[0045] Here, according to one embodiment of the present invention, a distributed ledger may refer to a method of storing and managing data distributedly across multiple nodes without centralized authority, while maintaining data integrity and security. Specifically, the distributed ledger described above includes, but is not limited to, blockchain, tangle, hashgraph, and directed acyclic graph (DAG).

[0046] Specifically, the distributed ledger according to one embodiment of the present invention may be a blockchain (or blockchain network). The blockchain network described above may be a network in which multiple nodes participating in the network jointly verify information to be stored on the network, and the verified information is recorded and shared on the network, thereby ensuring the integrity and reliability of the recorded information without relying on an authorized third party. For example, according to one embodiment of the present invention, such a blockchain network may be a network that has at least some characteristics similar to those of conventional blockchain networks such as Bitcoin, Ethereum, and Quantum. Furthermore, according to one embodiment of the present invention, such a blockchain network may be a concept that includes various types of blockchain networks, such as a private blockchain network, a public blockchain network, or a hybrid network of private and public blockchains.

[0047] Meanwhile, according to one embodiment of the present invention, the nodes described above may be interconnected to form a distributed ledger network. This is merely an example and is not intended to be limiting. In other words, a node according to one embodiment of the present invention may refer to any type of reliable storage medium that serves as a participant in verifying and storing data and exchanging information with other nodes to maintain the integrity and consistency of the entire system.

[0048] Next, the verifier system (200) according to one embodiment of the present invention can perform a function of verifying the credential based on information regarding the credential provided from the holder node.

[0049] According to one embodiment of the present invention, the verifier side system (200) may mean a system including a verifier node or included in a verifier node, or may mean the verifier node itself.

[0050] Next, the holder-side system (300) according to one embodiment of the present invention may perform a function of receiving a request for issuance of a VC managed in a specific group, determining whether the VC has already been issued based on a first identifier associated with the VC, issuing the VC in response to determining that the VC has not been issued, and processing the request for issuance of the VC in response to determining that the VC has already been issued according to a duplicate VC management policy of the specific group or an entity that belongs to the specific group and receives the request for issuance of the VC.

[0051] According to one embodiment of the present invention, the holder-side system (300) may mean a system including a holder node or included in a holder node, or may mean the holder node itself.

[0052] The configuration and function of the holder-side system (300) according to the present invention will be described in detail below.

[0053] Next, the issuer system (400) according to one embodiment of the present invention can perform the function of generating a credential and issuing it to a holder node. Typically, an issuer is a trusted institution or organization with the authority to verify information about an individual or organization and issue a credential that verifies such information. Examples of such issuers include, but are not limited to, various institutions such as universities, government agencies, financial institutions, and employers.

[0054] According to one embodiment of the present invention, the issuer-side system (400) may mean a system including an issuer node or included in an issuer node, or may mean the issuer node itself.

[0055] In addition, the issuer-side system (400) according to one embodiment of the present invention, like the holder-side system (300), may perform a function of receiving a request for issuance of a VC managed in a specific group, determining whether the VC has already been issued based on a first identifier associated with the VC, issuing the VC in response to determining that the VC has not been issued, and processing the request for issuance of the VC in response to determining that the VC has already been issued according to a duplicate VC management policy of the specific group or an entity that belongs to the specific group and receives the request for issuance of the VC.

[0056] The configuration and function of the issuer system (400) according to the present invention will be described in detail below.

[0057] Next, a device (500) according to one embodiment of the present invention is a digital device that includes a function to connect to and communicate with a verifier-side system (200), a holder-side system (300), and / or an issuer-side system (400), and any digital device that has a memory means, a microprocessor, and a computing capability, such as a smart phone, a tablet, a smart watch, a smart band, smart glasses, a desktop computer, a notebook computer, a workstation, a PDA, a web pad, a mobile phone, etc., can be adopted as the device (500) according to the present invention.

[0058] In particular, the device (500) may include an application (not shown) that supports a user to receive a service according to the present invention from a verifier-side system (200), a holder-side system (300), and / or an issuer-side system (400). Such an application may be downloaded from the verifier-side system (200), the holder-side system (300), the issuer-side system (400), and / or an external application distribution server (not shown). Meanwhile, the nature of such an application may be generally similar to the request receiving unit (310), the duplication determining unit (320), the issuance management unit (330), the communication unit (340), and the control unit (350) of the holder-side system (300), which will be described later, and the request receiving unit (410), the duplication determining unit (420), the issuance management unit (430), the communication unit (440), and the control unit (450) of the issuer-side system (400). Here, the application may be replaced by a hardware device or firmware device that can perform substantially the same or equivalent functions as required, at least in part.

[0059] According to one embodiment of the present invention, such a device (500) may mean one of a plurality of nodes (e.g., issuer node, holder node, verifier node, etc.) that are interconnected to form a distributed ledger network.

[0060] Configuration of the holder-side system

[0061] Below, the internal configuration and functions of each component of the holder-side system (300) that performs important functions for implementing the present invention will be examined.

[0062] FIG. 2 is a drawing showing in detail the internal configuration of a holder-side system (300) according to one embodiment of the present invention.

[0063] As illustrated in FIG. 2, a holder-side system (300) according to one embodiment of the present invention may be configured to include a request receiving unit (310), a duplication determining unit (320), an issuance management unit (330), a communication unit (340), and a control unit (350). According to one embodiment of the present invention, at least some of the request receiving unit (310), the duplication determining unit (320), the issuance management unit (330), the communication unit (340), and the control unit (350) may be program modules that communicate with an external system (not shown). These program modules may be included in the holder-side system (300) in the form of an operating system, an application program module, or other program modules, and may be physically stored in various known memory devices. In addition, these program modules may also be stored in a remote memory device capable of communicating with the holder-side system (300). Meanwhile, these program modules include, but are not limited to, routines, subroutines, programs, objects, components, data structures, etc. that perform specific tasks or execute specific abstract data types, as described later in accordance with the present invention.

[0064] Meanwhile, although the holder-side system (300) has been described as above, this description is exemplary, and it is obvious to those skilled in the art that at least some of the components or functions of the holder-side system (300) may be realized within a device (500) or a server (not shown) or included within an external system (not shown) as needed.

[0065] First, the request receiving unit (310) according to one embodiment of the present invention can perform a function of receiving a request for issuing a VC managed in a specific group.

[0066] Specifically, according to one embodiment of the present invention, that a VC is managed by a specific group may mean that entities belonging to that specific group (i.e., members of that group) are entitled to decide on or participate in matters relating to the use of that VC, such as issuing, renewing (or reissuing), or invalidating the VC.

[0067] For example, if there are tax-exempt accounts that can only be used at Suhyup Bank, Nonghyup Bank, and Livestock Cooperatives, and each individual can receive only one such tax-exempt account in the form of a VC (i.e., issued only by one of Suhyup Bank, Nonghyup Bank, and Livestock Cooperatives), Suhyup Bank, Nonghyup Bank, and Livestock Cooperatives can become members of the group that manages tax-exempt accounts in the form of VCs.

[0068] For another example, if there is a VC that can prove the league affiliation of a soccer player, the football associations of countries such as England, Spain, Germany, and France, or the Fédération Internationale de Football Association (FIFA) could be members of the group that manages such a VC.

[0069] As another example, suppose a multinational company uses VCs to prove employee affiliation. The HR managers (or HR teams) at headquarters and each branch office could be part of the group that manages such VCs.

[0070] According to one embodiment of the present invention, a user (e.g., an individual seeking to be issued a tax-exempt account, a soccer player seeking to prove affiliation, or an employee of a multinational corporation) may use a digital wallet or other application to request issuance of a VC managed by a specific group as described above, and the request receiving unit (310) may receive such issuance request.

[0071] Next, the duplication determination unit (320) according to one embodiment of the present invention may perform a function of determining whether a VC has already been issued based on a first identifier associated with the VC managed in a specific group.

[0072] Specifically, according to one embodiment of the present invention, a first identifier associated with a VC managed by a specific group may be a unique value in the network (such as the entire network used by all groups, a specific network used by the specific group, etc.), and may be a value that was assigned (or applied) or should be assigned (or applied) to the VC when the VC is issued in order to determine whether the VC has already been issued (therefore, even if the VC has not been issued, the first identifier may be a value that is known in advance). According to one embodiment of the present invention, the first identifier may be a randomly generated value, or may be generated as a meaningful string (e.g., specified by a user or group member). Furthermore, according to one embodiment of the present invention, the first identifier may be generated in the network when or after a specific group for managing the VC is formed.

[0073] According to one embodiment of the present invention, when a request for issuance of a VC managed by a specific group is received, the duplication determination unit (320) may transmit a first identifier associated with the VC to a module or system (e.g., an issuer-side system (400)) that determines whether the VC has already been issued, using a digital wallet or other application, or may notify that there has been such an issuance request, thereby determining whether the VC has already been issued.

[0074] More specifically, the duplication determination unit (320) according to one embodiment of the present invention can determine whether a VC managed in a specific group has already been issued by a subject belonging to the specific group based on the first identifier described above.

[0075] For example, in the case of the above-described example of a tax-free account, it can be assumed that the first identifier associated with the tax-free account (i.e., the VC managed by the group consisting of the National Agricultural Cooperative Federation, the National Agricultural Cooperative Federation, and the National Livestock Cooperative Federation) is ABC, and a situation can be assumed where a user attempts to receive a tax-free account in the form of a VC for the first time from the National Agricultural Cooperative Federation (which may correspond to the issuer node). In this case, when a request for issuance of a tax-free account is received from the user, the duplication determination unit (320) according to one embodiment of the present invention can transmit the first identifier ABC to a module or system (e.g., the issuer-side system (400)) that determines whether the VC has already been issued or can notify that a request for issuance of a tax-free account has been made. Then, the National Agricultural Cooperative Federation or the party managing such a module or system can use the module or system to check through the network whether there is a record of issuance of a VC having ABC as an identifier (i.e., a tax-free account managed by the group consisting of the National Agricultural Cooperative Federation, the National Agricultural Cooperative Federation, and the National Livestock Cooperative Federation). In this case, since there is no record of issuance yet, the duplicate determination unit (320) can receive information that the VC in question has not been issued. At this time, since it is determined that the VC in question has not been issued, the user can receive a tax-free account (i.e., VC) from Nonghyup (details regarding the issuance of VCs will be described later), and information that a tax-free account with the identifier ABC has been issued can be recorded on the network.

[0076] Continuing with the example, if the same user later attempts to re-issue a tax-exempt account from the National Agricultural Cooperative Federation (which may correspond to the issuer node), the National Agricultural Cooperative Federation or the party managing such a module or system can use the module or system to check through the network whether there is a record of issuing a VC with the identifier ABC (i.e., a tax-exempt account managed by a group consisting of the National Agricultural Cooperative Federation, the National Agricultural Cooperative Federation, and the National Livestock Cooperative Federation). And, since there is a record of such a VC having already been issued (since it was already issued by the National Agricultural Cooperative Federation), the duplication determination unit (320) can receive information that the VC has already been issued.

[0077] Meanwhile, according to one embodiment of the present invention, a user's privacy can be protected using Zero Knowledge Proof (ZKP) technology to determine whether a VC managed in a specific group has already been issued based on a first identifier associated with the VC. This allows for a balance between protecting user privacy and sharing information between groups.

[0078] In addition, according to one embodiment of the present invention, in determining whether a VC managed in a specific group has already been issued based on a first identifier associated with the VC, a search between groups can be efficiently performed using a distributed hash table (DHT).

[0079] Meanwhile, the duplication determination unit (320) according to one embodiment of the present invention, in response to determining that information about the VC managed in a specific group is not included in the device (500) based on a second identifier associated with the VC, may determine whether the VC has already been issued by an entity belonging to the specific group.

[0080] Specifically, when a request for issuance of a VC managed in a specific group is received from a user, the duplication determination unit (320) according to one embodiment of the present invention may determine whether information about the VC is included in the user's device (500) based on a second identifier associated with the VC before determining whether the VC has already been issued by an entity belonging to the specific group. That is, the duplication determination unit (320) according to one embodiment of the present invention may first check whether information about the VC is included in the user's device (500) before performing a duplication VC check within a specific group, thereby preventing a duplication VC check within a group from being performed unnecessarily.

[0081] According to one embodiment of the present invention, information about VCs that may be included in a user's device (500) may include a list of VCs held by the user, the type of each VC, the issuing agency, the expiration date, a first identifier, etc., and may also include information that allows access to such information through a network (for example, a second identifier may correspond to such information). Meanwhile, according to one embodiment of the present invention, when determining whether information about a corresponding VC is included in the user's device (500) based on the first identifier, the second identifier and the first identifier may be the same.

[0082] Next, the issuance management unit (330) according to one embodiment of the present invention may perform a function of causing a VC to be issued in response to a determination that a VC managed by a specific group has not been issued, and causing a request for issuance of the VC to be processed in accordance with a duplicate VC management policy of a specific group or an entity that belongs to a specific group and receives a request for issuance of the VC in response to a determination that the VC has already been issued.

[0083] Specifically, if it is determined that a VC managed by a specific group has not yet been issued, the issuance management unit (330) according to one embodiment of the present invention may provide the issuer node with the necessary information so that the VC is issued to the user who requested the issuance. Here, according to one embodiment of the present invention, the fact that a VC managed by a specific group has not been issued may include not only a case where the VC has never been issued, but also a case where the VC has been issued but has been revoked and is currently not valid.

[0084] And, if it is determined that a VC managed by a specific group has already been issued, the issuance management unit (330) according to one embodiment of the present invention may provide the issuer node with the necessary information so that the request for issuance of the VC is processed according to the duplicate VC management policy of the specific group or the duplicate VC management policy of the entity (e.g., the issuer node) that belongs to the specific group and receives the request for issuance of the VC. According to one embodiment of the present invention, the processing of the request for issuance of the VC according to the duplicate VC management policy and the recording of the processing process and result may be automatically performed based on a smart contract.

[0085] For example, a duplicate VC management policy might invalidate an already issued VC and issue a new VC managed by a specific group (which could mean renewing or reissuing a VC). Another example might be a duplicate VC management policy that rejects a request to issue a VC.

[0086] Another example is if a VC has been issued but not yet reached its maximum issuance limit (e.g., a group managed by a group is allowed to issue up to 3 VCs but has only issued 1), the duplicate VC management policy could be to issue additional VCs but count the number of VCs issued.

[0087] The issuance management unit (330) according to one embodiment of the present invention may provide a user with an interface that provides relevant information so that a request for issuance of a VC is processed in accordance with a duplicate VC management policy. Here, the user may refer to the holder of the VC, but in some cases, an entity other than the holder of the VC (e.g., a human resources manager) may correspond to the user. According to one embodiment of the present invention, the issuance management unit (330) according to one embodiment of the present invention may provide the user with information through this interface that a VC managed by a specific group has already been issued, and information that the VC needs to be renewed (or reissued) if necessary (in accordance with the duplicate VC management policy).

[0088] Additionally, the issuance management unit (330) according to one embodiment of the present invention may allow the user to choose, via an interface, whether to maintain an existing VC or to invalidate the existing VC and issue a new VC. In this case, allowing the user to choose a VC processing method may itself constitute a duplicate VC management policy.

[0089] Next, the communication unit (340) according to one embodiment of the present invention can perform a function that enables data transmission and reception from / to the request receiving unit (310), the duplication determining unit (320), and the issuance management unit (330).

[0090] Finally, the control unit (350) according to one embodiment of the present invention can perform a function of controlling the flow of data between the request receiving unit (310), the duplication determining unit (320), the issuance management unit (330), and the communication unit (340). That is, the control unit (350) according to one embodiment of the present invention can control the flow of data from / to the outside of the holder-side system (300) or the flow of data between each component of the holder-side system (300), thereby controlling the request receiving unit (310), the duplication determining unit (320), the issuance management unit (330), and the communication unit (340) to perform their own functions.

[0091] Configuration of the issuer-side system

[0092] Below, the internal configuration of the issuer-side system (400) that performs important functions for implementing the present invention and the functions of each component will be examined.

[0093] FIG. 3 is a drawing detailing the internal configuration of an issuer-side system (400) according to one embodiment of the present invention.

[0094] As illustrated in FIG. 3, an issuer-side system (400) according to one embodiment of the present invention may be configured to include a request receiving unit (410), a duplication determining unit (420), an issuance management unit (430), a communication unit (440), and a control unit (450). According to one embodiment of the present invention, at least some of the request receiving unit (410), the duplication determining unit (420), the issuance management unit (430), the communication unit (440), and the control unit (450) may be program modules that communicate with an external system (not shown). These program modules may be included in the issuer-side system (400) in the form of an operating system, an application program module, or other program modules, and may be physically stored in various known memory devices. In addition, these program modules may also be stored in a remote memory device capable of communicating with the issuer-side system (400). Meanwhile, these program modules include, but are not limited to, routines, subroutines, programs, objects, components, data structures, etc. that perform specific tasks or execute specific abstract data types, as described later in accordance with the present invention.

[0095] Meanwhile, although the issuer-side system (400) has been described as above, this description is exemplary, and it is obvious to those skilled in the art that at least some of the components or functions of the issuer-side system (400) may be realized within a device (500) or a server (not shown) or included within an external system (not shown) as needed.

[0096] Below, the configuration and function of the issuer-side system (400) are described, but the operating principle is almost the same except for a slight difference in that the subject of each function is the issuer-side system (400) rather than the holder-side system (300), so any description that overlaps with the above description of the holder-side system (300) will be omitted.

[0097] First, the request receiving unit (410) according to one embodiment of the present invention can perform a function of receiving a request for issuing a VC managed in a specific group.

[0098] Specifically, according to one embodiment of the present invention, a user (e.g., an individual seeking to be issued a tax-exempt account, a soccer player seeking to prove affiliation, or an employee of a multinational corporation) may use a digital wallet or other application to request issuance of a VC managed by a specific group as described above, and the request receiving unit (410) may receive such issuance request.

[0099] Next, a duplication determination unit (420) according to one embodiment of the present invention may perform a function of determining whether a VC managed in a specific group has already been issued (e.g., whether the VC has already been issued by an entity belonging to a specific group) based on a first identifier associated with the VC.

[0100] Specifically, when a request for issuance of a VC managed by a specific group is received, the duplication determination unit (420) according to one embodiment of the present invention may perform a function of determining whether the VC has already been issued by checking through a network whether there is a record of issuance of a VC having a first identifier associated with the VC. If necessary, the duplication determination unit (420) according to one embodiment of the present invention may transmit information that the VC has not been issued or has already been issued to the duplication determination unit (320) of the holder-side system (300).

[0101] Next, the issuance management unit (430) according to one embodiment of the present invention may perform a function of causing a VC to be issued in response to a determination that a VC managed by a specific group has not been issued, and causing a request for issuance of the VC to be processed in accordance with a duplicate VC management policy of a specific group or an entity that belongs to a specific group and receives a request for issuance of the VC in response to a determination that the VC has already been issued.

[0102] At this time, the issuance management unit (430) according to one embodiment of the present invention may process a VC issuance request according to the duplicate VC management policy and then notify the result of the processing to entities belonging to a specific group, i.e., members of the specific group. Furthermore, the issuance management unit (430) according to one embodiment of the present invention may record the processing process and result in a storage (e.g., blockchain). According to one embodiment of the present invention, the processing of a VC issuance request according to the duplicate VC management policy, the recording of the processing process and result, and the notification of the processing result may be automatically performed based on a smart contract.

[0103] The following embodiments can be realized by using the holder-side system (300) and / or the issuer-side system (400) described above:

[0104] (Example 1)

[0105] Consider a scenario where a football player, A, transfers from the Spanish league to the English league. In this case, A can request the Football Association to issue a new VC to prove his affiliation (or transfer).

[0106] When a request for issuance of such a VC is received, the duplication determination unit (320 or 420) according to one embodiment of the present invention can determine whether the VC has already been issued by an entity belonging to Group F, which is composed of the Spanish Football Association, the English Football Association, and other national football associations, based on the first identifier associated with the VC.

[0107] In this case, since soccer player A was affiliated with the Spanish league, it will be determined that a VC has already been issued to him by the Spanish Football Association, and the issuance management unit (330 or 430) according to one embodiment of the present invention can check whether the issuance management unit (330 or 430) agrees to invalidate the existing VC issued to player A by the Spanish Football Association and issue a new VC to him by the English Football Association, according to the duplicate VC management policy of Group F.

[0108] And, if soccer player A agrees, the issuance management unit (330 or 430) according to one embodiment of the present invention can cause soccer player A's VC issuance request to be processed (i.e., the existing VC issued by the Spanish Football Association is invalidated and a new VC is issued by the English Football Association).

[0109] In addition, the issuance management unit (330 or 430) according to one embodiment of the present invention can notify members of Group F, such as the FIFA or the football association of a relevant country, of matters related to the issuance of new VCs (i.e., matters related to player transfers).

[0110] (Example 2)

[0111] Consider a situation where Employee B is transferred from a specific company's Korean branch to a U.S. branch. In this case, Employee B or his / her HR representative can request the U.S. branch to issue a new VC to prove Employee B's affiliation (or transfer).

[0112] When a request for issuance of such a VC is received, the duplication determination unit (320 or 420) according to one embodiment of the present invention can determine whether the VC has already been issued by an entity belonging to group C, which is composed of a U.S. branch (or its human resources team), a Korean branch, and branches in other countries, based on a first identifier associated with the VC.

[0113] In this case, since employee B was affiliated with the Korean branch, it will be determined that a VC has already been issued by the Korean branch, and the issuance management unit (330 or 430) according to one embodiment of the present invention can, according to the duplicate VC management policy of Group C, check with employee B and his human resources manager whether they agree to invalidate the existing VC issued by the Korean branch and issue a new VC from the U.S. branch.

[0114] And, if employee B and his human resources manager agree, the issuance management unit (330 or 430) according to one embodiment of the present invention can cause employee B's VC issuance request to be processed (i.e., the existing VC issued from the Korean branch is invalidated and a new VC is issued from the U.S. branch).

[0115] In addition, the issuance management unit (330 or 430) according to one embodiment of the present invention can notify members of group C (which may refer to the entire company's personnel system) of matters related to the issuance of a new VC (i.e., matters related to personnel transfer).

[0116] Next, the communication unit (440) according to one embodiment of the present invention can perform a function that enables data transmission and reception from / to the request receiving unit (410), the duplication determining unit (420), and the issuance management unit (430).

[0117] Finally, the control unit (450) according to one embodiment of the present invention can perform a function of controlling the flow of data between the request receiving unit (410), the duplication determining unit (420), the issuance management unit (430), and the communication unit (440). That is, the control unit (450) according to one embodiment of the present invention can control the flow of data from / to the outside of the issuer-side system (400) or the flow of data between each component of the issuer-side system (400), thereby controlling the request receiving unit (410), the duplication determining unit (420), the issuance management unit (430), and the communication unit (440) to perform their own functions.

[0118] The embodiments of the present invention described above may be implemented in the form of program commands that can be executed through various computer components and recorded on a computer-readable recording medium. The computer-readable recording medium may include program commands, data files, data structures, etc., either singly or in combination. The program commands recorded on the computer-readable recording medium may be specially designed and configured for the present invention or may be known and available to those skilled in the art of computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical recording media such as CD-ROMs and DVDs, magneto-optical media such as floptical disks, and hardware devices specifically configured to store and execute program commands, such as ROMs, RAMs, and flash memories. Examples of program commands include not only machine language codes generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter, etc. Hardware devices may be changed into one or more software modules to perform processing according to the present invention, and vice versa.

[0119] Although the present invention has been described above with specific details such as specific components and limited examples and drawings, these are provided only to help a more general understanding of the present invention, and the present invention is not limited to the above examples, and those with ordinary knowledge in the technical field to which the present invention pertains can make various modifications and changes based on this description.

[0120] Therefore, the idea of ​​the present invention should not be limited to the embodiments described above, and not only the scope of the patent claims described below but also all scopes equivalent to or equivalently modified from the scope of the patent claims are considered to fall within the scope of the idea of ​​the present invention.

Claims

1. A method to support the use of verifiable credentials (VCs). Step of receiving a request for issuance of a VC managed by a specific group; A step of determining whether the VC has already been issued based on a first identifier associated with the VC, and In response to determining that the VC has not been issued, causing the VC to be issued, and in response to determining that the VC has already been issued, causing a request for issuance of the VC to be processed according to a duplicate VC management policy of the specific group or an entity that belongs to the specific group and receives the request for issuance of the VC. method.

2. In paragraph 1, In the above judgment step, it is determined whether the VC has already been issued by a subject belonging to the specific group based on the first identifier. method.

3. In paragraph 2, In the above judgment step, in response to determining that the information about the VC is not included in the device based on the second identifier associated with the VC, it is determined whether the VC has already been issued by a subject belonging to the specific group. method.

4. In paragraph 1, The above duplicate VC management policy invalidates the already issued VC and issues a new VC managed by the specific group. method.

5. In paragraph 1, The above duplicate VC management policy is to reject the request for issuance of the above VC. method.

6. In paragraph 1, In the above processing step, after processing the request for issuance of the VC, the result of the processing is notified to the subject belonging to the specific group. method.

7. A non-transitory computer-readable recording medium recording a computer program for executing the method according to paragraph 1.

8. A system to support the use of verifiable credentials (VC). A request receiving unit that receives a request for issuing a VC managed by a specific group; A duplication determination unit that determines whether the VC has already been issued based on a first identifier associated with the VC, and An issuance management unit that causes the VC to be issued in response to a determination that the VC has not been issued, and causes the request for issuance of the VC to be processed in accordance with a duplicate VC management policy of the specific group or an entity that belongs to the specific group and receives the request for issuance of the VC in response to a determination that the VC has already been issued. System.

9. In paragraph 8, The above duplicate determination unit determines whether the VC has already been issued by a subject belonging to the specific group based on the first identifier. System.

10. In paragraph 9, The above duplicate determination unit determines whether the VC has already been issued by a subject belonging to the specific group in response to determining that the information about the VC is not included in the device based on the second identifier associated with the VC. System.

11. In paragraph 8, The above duplicate VC management policy invalidates the already issued VC and issues a new VC managed by the specific group. System.

12. In paragraph 8, The above duplicate VC management policy is to reject the request for issuance of the above VC. System.

13. In paragraph 8, The above issuance management department, after processing the issuance request of the above VC, notifies the result of the processing to the entity belonging to the above specific group. System.

Images