Blockchain Document Certification with Key-Based Erasure
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current document certification systems using blockchain face challenges in proving the authenticity of the document issuer and compliance with data protection regulations, such as the GDPR, particularly in ensuring the 'right to be forgotten' and managing document persistence.
Innovation Solution
A computer-based method and system that utilizes a public blockchain, generating an issuer permanent master key and document persistence key, encrypting document data, and allowing erasure of the persistence key upon request, ensuring secure and compliant document certification and storage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a hash function is used to store diploma imprint in a public blockchain, then the authenticity of the diploma is guaranteed, but the identity of the diploma issuer is not proven and the diploma remains recognizable forever
Solution Approach 1:
The system segments the document certification process into two independent parts: (1) storing only the hash/imprint of the document in the blockchain to guarantee authenticity, and (2) storing the actual document data in a separate, controllable storage system. This segmentation allows the blockchain to provide verification without permanently storing personally identifiable information, thus enabling the right to be forgotten while maintaining document authenticity.
Solution Approach 2:
The system introduces an intermediary verification mechanism that uses the hash function as a mediator between the original document and the blockchain storage. The hash acts as a reference key that proves document authenticity without exposing the actual document content, allowing verification while protecting personal data and enabling its eventual erasure.
2Reliability
If document data is encrypted and stored in blockchain, then document authenticity is certified, but compliance with GDPR and right to be forgotten cannot be achieved
Solution Approach 1:
The system extracts the personally identifiable information and actual document data from the blockchain storage, keeping only the essential verification element (the hash/imprint) in the blockchain. This extraction allows the system to maintain document certification capabilities while removing the problematic data elements that conflict with GDPR compliance and the right to be forgotten.
Solution Approach 2:
The system implements dynamic data management where the actual document data can be stored, accessed, and eventually erased from controllable storage systems, while the immutable blockchain record maintains only the hash for verification. This dynamic approach allows compliance with data protection regulations that require data erasure while preserving the ability to verify document authenticity.
3Stability of the object's composition
If a public blockchain is used for document storage, then document integrity is maintained, but the cost and complexity of the system increases
Solution Approach 1:
The system applies partial action by storing only the essential verification data (hash/imprint) in the blockchain rather than complete document data. This partial storage approach maintains document integrity verification capabilities while significantly reducing the complexity and cost associated with storing and managing large volumes of document data in the blockchain.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The method is implemented in a computer system deployed through the internet and interacts with a blockchain (BKC). Document issuers and validators are connected to the system. The method comprises generating a master key (MK) assigned to an issuer, certifying a document (DocData) through a first process (P2) including generating a document persistence key (PK), encrypting document data (CredData) with an encryption algorithm (AES) and an encryption key (KAES) derived (∂) from the master key, the document persistence key and an intermediate key (IK), registering encrypted document data (EncData) in the blockchain, and generating a web address (URL) carrying recovery information of the certified document; reading the document through a second process (P3) accessible to the web address, the second process including recovering the encrypted data in the blockchain and an access to the three keys, decrypting the encrypted data using the encryption key derived from the three keys, and displaying the document; and upon request from a legitimate holder of the document erase the persistence key.