Distributed Ledger Digital Identity Verification Graph Model
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing digital identity verification methods require user authorization each time identity information is accessed, and existing solutions based on distributed ledgers do not allow access to recorded identity information without user authorization, posing challenges in privacy protection and identity theft prevention.
Innovation Solution
A method using distinct distributed ledgers where user personal identifiable information is encrypted and stored in one ledger accessible only to authorized entities, while attestations and relationships are stored in another ledger, allowing verification without revealing the actual identity, using a graph data model to manage relationships between user identifiers and attestations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If user identity information is stored in a distributed ledger for verification purposes, then verification efficiency is improved, but user privacy and security are worsened because identity information may be accessed without authorization
Solution Approach 1:
The patent segments identity information into two distinct components: hashed identifiers (stored in the first distributed ledger for efficient verification) and encrypted personal identifiable information (stored in the second distributed ledger for privacy protection). This segmentation allows verification operations to proceed efficiently using hashes while the actual identity data remains protected and inaccessible without authorization.
Solution Approach 2:
The patent introduces cryptographic hashes as an intermediary representation of identity information. Instead of storing or processing actual personal identifiable information in the first distributed ledger, the system uses hashed identifiers that serve as mediators for verification operations. This intermediary layer enables verification efficiency while preventing direct access to sensitive identity data.
2Adaptability or versatility
If encrypted personal identifiable information is stored in a distributed ledger accessible to multiple entities, then verification capability is improved, but access control complexity increases
Solution Approach 1:
The patent creates two separate distributed ledgers with distinct access control policies. The first ledger stores hashed identifiers with broad access for verification purposes, while the second ledger stores encrypted personal identifiable information with restricted access. This segmentation of storage locations simplifies access control by applying different permission sets to different data types rather than managing complex permissions for a single unified ledger.
Solution Approach 2:
The patent extracts the most sensitive element (actual personal identifiable information) from the verification process and places it in a separate, highly restricted ledger. Only hashed identifiers remain in the first ledger for routine verification operations. This extraction removes the need for complex access control during normal verification, as the first ledger can be accessed by multiple entities without risking exposure of sensitive data.
3Reliability
If a centralized service provider stores and shares verified identity information, then identity verification is improved, but trust requirements and security risks increase
Solution Approach 1:
The patent segments the centralized identity verification system into a distributed architecture where hashed identifiers and encrypted personal information are stored in separate distributed ledgers. This segmentation eliminates the single point of failure and centralized data breach risk associated with centralized providers, while maintaining verification reliability through the distributed nature of both ledgers.
Solution Approach 2:
The patent uses cryptographic hashes as intermediaries to enable verification without requiring trust in a centralized provider. The hashed identifiers in the first distributed ledger allow any authorized entity to verify identity without needing to trust a central authority, while the encrypted personal information in the second ledger remains protected from centralized data breach risks.
Data Source
Figure 1
Figure 2
Figure 3a~3c
AI summary
The present invention relates to a method for recording a digital identity of a first user (102) comprising, performed by a computing device (301) of a first verification entity (101) identified by a first verification entity identifier : - receiving from the first user at least one first user identity document (302) and extracting user personal identifiable information data elements from said user identity document, - after verification, encrypting using a public key of the first verification entity and recording said encrypted user personal identifiable information data elements (304) in a first distributed ledger (103) whose access is authorized to a first set of computing devices only, - generating a user identifier (KYC ID) to be sent to said user and recording a hash of said user identifier in a second distributed ledger and, for each verified user personal identifiable information data element, an attestation (303) including the first verification entity identifier and a hash of said user personal identifiable information data element, and recording each generated attestation in said second distributed ledger, - for each generated attestation, recording in said second distributed ledger a relationship between the generated user identifier and said generated attestation, wherein said first and second distributed ledgers are configured such that access to the first distributed ledger is more restricted than access to the second distributed ledger and wherein all data stored in the second distributed ledger form a graph data model in which each node represents an attestation of a user personal identifiable information data element or a user identifier, and wherein the links between the nodes of the model represent the relationships recorded in the second distributed ledger between user identifiers and said recorded attestations, such that any entity having access to the second distributed ledger is able to perform verifications on the relationship between users whose identities have been recorded in the ledgers without having access to said recorded identities.