Zero-Knowledge Proof Login via OpenID Connect
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication solutions for anonymous user accounts on blockchain transactions face challenges such as reliance on extra entities for trust and direct exposure of sensitive data on the blockchain, compromising privacy.
Innovation Solution
The implementation of zero-knowledge proofs (ZKPs) in conjunction with the OpenID Connect protocol allows users to authenticate with anonymous user accounts without revealing Personal Identifiable Information (PII), using a trusted authentication provider to generate a unique anonymous user account ID.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If OpenID Connect protocol is used for authentication, then user authentication is enabled without exposing passwords, but Personal Identifiable Information (PII) and email addresses are exposed in public authentication claims
Solution Approach 1:
The patent extracts only the essential authentication verification from the OpenID Connect protocol, separating the authentication proof from the PII-containing claims. This allows the system to retain the security benefits of OpenID Connect while removing the privacy-increasing elements (email addresses and PII) from public exposure.
Solution Approach 2:
The patent introduces an intermediary layer that processes OpenID Connect authentication claims. This intermediary verifies the authentication proof while filtering out PII before making it available to the application, thus mediating between the authentication provider and the application to protect user privacy.
2Reliability
If traditional credential mechanisms like passwords are used, then user authentication is established, but users face burden of creating and remembering unique passwords with high entropy
Solution Approach 1:
The patent enables existing authentication providers (Google, Facebook, etc.) to serve multiple purposes: both traditional password-based authentication and the new anonymous authentication method. This universality allows users to leverage their existing accounts without creating new credentials, simplifying onboarding while maintaining security.
Solution Approach 2:
The system allows users to automatically leverage their existing authentication provider accounts without manual setup. The anonymous user account ID is generated automatically from the authentication provider account, eliminating the need for users to manually create and manage additional credentials.
3Loss of information
If anonymous user accounts are used for blockchain transactions, then user privacy is preserved, but trust mechanisms become more complex requiring extra entities
Solution Approach 1:
The patent extracts the trust verification from complex multi-entity mechanisms and consolidates it into a single verifiable anonymous user account ID. This extracted trust proof can be independently verified without requiring users to trust additional intermediaries, simplifying the trust model while preserving anonymity.
Data Source
AI summary
The present technology can allow a user to use the OpenID Connect protocol to login to an account that has an anonymous user account ID. More specifically, the present technology can programmatically combine information received from an OpenID provider during the OpenID Connect protocol with a random value to yield a unique anonymous user account ID. The present technology also makes use of the ability within the OpenID Connect protocol to embed a chosen nonce into the token signed by the OpenID provider. This allows for embedding hashes of cryptographic keys, like signature verification keys, into ID tokens received from the OpenID provider that authenticates the user. Subsequently, the user can sign messages that can be verified using the verification key bound to the ID token from the OpenID provider.