Identity-Based Blockchain Access Without Client Key Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing blockchain access methods, both public and private, store sensitive data that can be dangerous when accessed without a client session, posing security risks.
Innovation Solution
A control method and device that utilize authentication via an identity provider to generate cryptographic key pairs based on a user's identity, ensuring secure access to a blockchain without storing sensitive data, using cryptographic random number generators and compression techniques to ensure deterministic key generation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If blockchain access data is stored for client connection, then access convenience is improved, but security is worsened due to dangerous access without client session
Solution Approach 1:
The patent introduces an identity provider as an intermediary between the client and blockchain network. The identity provider issues cryptographic key pairs to authenticated users, enabling secure access without storing sensitive blockchain access data on the client device. This mediator approach resolves the contradiction by maintaining security while enabling convenient access through the intermediary's authentication mechanism.
Solution Approach 2:
The patent extracts the sensitive authentication data (cryptographic key pairs) from the client device and stores it securely on the identity provider's server. The client only retains a user identifier, not the actual cryptographic keys. This extraction eliminates the security risk of storing sensitive data on the client while maintaining access convenience through the stored identifier.
2Stability of the object's composition
If cryptographic key pairs are generated deterministically from user identity, then key consistency is improved, but complexity of key generation is worsened
Solution Approach 1:
The patent changes the parameters of key generation from random to deterministic by using the user's identity (user identifier) as the input seed for cryptographic key pair generation. This ensures that the same user always receives the same cryptographic keys, providing consistency. The complexity is managed by implementing this deterministic generation on the server side rather than requiring complex client-side implementation.
Data Source
Figure 1~2
Figure 3
AI summary
Disclosed is a method for controlling access to a first service using a blockchain implemented in a communication network. This method comprises a step (100-140) in which a user accesses a second service responsible for generating pairs of cryptographic keys, then the user uses this second service to connect to a first communication device belonging to an identity supplier in order to be authenticated, then, in the event of authentication, the first communication device provides the user, via the second service, with a user identifier, which identifies him in a unique manner that is stable over time, then the second service uses this user identifier in order to generate a pair of cryptographic keys which it transmits to the user, the user then uses this pair in order to access the first service.