Blockchain Digital Identity Management Using Trusted Execution Environment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current identity security solutions are inadequate due to password insecurity, identity theft, and inefficiencies in existing systems, which fail to provide robust and fundamental redesigns for secure identity management.
Innovation Solution
A blockchain-based digital identity management system utilizing public/private key cryptography, with a Trusted Execution Environment on mobile devices, that securely generates and manages user credentials, protects private keys with biometrics and PIN codes, and uses immutable blockchains for credential and identity token management, enabling secure login, verification, and transaction signing without passwords.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If passwords are used for authentication, then ease of operation is improved, but security is worsened due to password reuse, hacking, and identity theft
Solution Approach 1:
The patent replaces the mechanical password-based authentication system with a cryptographic system using public/private key pairs. Instead of relying on users to manage passwords, the system uses cryptographic keys where the private key never leaves the device and the public key is shared for authentication. This substitution eliminates password-related security issues while maintaining ease of use through automated cryptographic operations.
Solution Approach 2:
The patent introduces a trusted execution environment (TEE) as an intermediary between the user and the authentication system. The TEE securely stores the private key and performs cryptographic operations without exposing the key to external systems. This intermediary layer provides security without requiring users to directly manage sensitive credentials, thus maintaining ease of operation.
2Reliability
If private keys are stored on mobile devices, then security is improved through cryptographic protection, but device complexity is worsened due to trusted execution environment requirements
Solution Approach 1:
The patent implements a nested structure where the trusted execution environment (TEE) is embedded within the mobile device's existing security architecture. The TEE itself contains the private key storage and cryptographic operation capabilities. This nesting approach allows the complex security features to be contained within a standardized component that integrates with existing mobile device architectures, minimizing overall system complexity.
Solution Approach 2:
The trusted execution environment provides self-service capabilities by automatically managing private key generation, storage, and cryptographic operations without requiring external intervention or complex user configuration. The TEE handles security-critical functions autonomously, reducing the burden on both users and system integrators despite the underlying complexity.
3Reliability
If immutable blockchains are used for credential management, then reliability is improved through tamper-proof storage, but loss of time is worsened due to blockchain transaction processing
Solution Approach 1:
The patent extracts the time-consuming aspects of blockchain operations by separating credential verification from blockchain transaction processing. The trusted execution environment performs local verification of credentials using cryptographic proofs without requiring real-time blockchain validation. Only essential credential issuance and revocation operations interact with the blockchain, significantly reducing processing time while maintaining integrity through the immutable ledger.
Data Source
AI summary
A method, software, and system for a Digital Identity Management (DIM) system is discussed. The system facilitates the creation of a Public Key/Private Key pair based user credentials using the Trusted Execution Environment in mobile phones, and is protected by DIM app with the user's biometrics and/or a PIN code. Identity tokens representing identity attributes of the user are issued by Issuing Parties using Hardware Security Modules and stored in the DIM app on the mobile device.