KR102139645B1 - System for Certificating identity based on Blockchain and Driving method thereof - Google Patents

Abstract

The present invention relates to an identity verifying system based on a blockchain, which suggests a blockchain network perfectly suitable for KISMI using hyperledger fabric and hyperledger INDY specialized in DID, and to a driving method thereof. According to the present invention, the identity verifying system based on a blockchain comprises: a distributed ID issuing unit for issuing a distributed ID in accordance with a distributed ID issuance request received from a user terminal; and an identity authenticating unit for storing the distributed ID issued by the distributed ID issuing unit as blockchain data and performing identity authentication by inquiring the stored blockchain data when an identity verifying request is received. Accordingly, the overall process from issuance to utilization of DID can be provided via a single network by generating a new blockchain network structure on the basis of hyperledger fabric and INDY by the identity verifying system based on blockchain.

Description

System for Certificating identity based on Blockchain and Driving method thereof}

The present invention relates to a blockchain-based identity authentication system and a driving method thereof. More specifically, a blockchain-based identity authentication system that proposes a Blockchain Netowork suitable for KISMI by utilizing Hyperledger Fabric and Hyperledger INDY specialized for DID and its It relates to a driving method.

Blockchain is a form of distributed data storage technology. This is a change list in which continuously changing data is recorded in all participating nodes, and is designed so that random manipulation by the operator of the distributed node is impossible.

In other words, the data to be managed is stored in a distributed data storage environment based on a'block' (chain of chains in which small data is created based on P2P method), and anyone can arbitrarily modify it and anyone can view the results of the changes. It is a ledger management technology based on computing technology.

On the other hand, there are various examples of implementations using Blockchain technology, such as Bitcoin and Ethereum.

After the blockchain technology was presented, the development of related technologies has spurred, and the implementation of the current blockchain technology has been generalized at a high level throughout the industry, and changes in the industrial field using related technologies are also rapidly occurring, and blocks in various parts of society Improvement techniques utilizing chains are active. In response to these changes in the environment, the request of society and market also naturally shifts the center of gravity depending on whether or not the blockchain technology itself is used or the complexity, rather than what technology is used to create a business model.

In other words, the recent blockchain technology has reached its maturity level, and how to create a business model rather than the complexity of the technology itself, and how to solve the governance problem that enables participants to use the technology smoothly within the ecosystem built with the business model. It can be said that it is converging for two key purposes of solving.

KR 10-2015-0055839 A KR 10-2019-0128309 A

The present invention is derived from such a technical background, and based on Hyperledger Fabric and INDY, a new Blockchain Network structure can be created to provide the overall process from issuance to utilization of DID as one network. The aim is to provide a blockchain-based identity authentication system and its driving method.

Particularly, among the various frameworks based on Blockchain, the purpose is to propose a blockchain network structure optimized for KISMI by utilizing Hyperledger Fabric suitable for enterprise and Hyperledger INDY specialized for DID. .

The present invention for achieving the above object includes the following configuration.

That is, the blockchain-based identity verification system according to an embodiment of the present invention blocks a distributed ID issuing unit that issues a distributed ID according to a request for issuing a distributed ID received from a user terminal and a distributed ID issued by the distributed ID issuing unit. It includes an identity authentication unit that stores chain data and, when an identity verification request is received, queries the stored blockchain data to perform identity authentication.

In one aspect, the identity authentication unit is characterized by performing communication with the user terminal via a Node SDK (Software Development Kit), and the distributed ID issuing unit is characterized by being a hyperledger INDY managing a decentralized ID. Shall be

Meanwhile, a method of driving a blockchain-based identity authentication system including a distributed ID issuing unit and an identity authentication unit includes: issuing a distributed ID according to a distributed ID issuance request received from a user terminal and the identity authentication unit is distributed And storing the distributed ID issued by the ID issuer as blockchain data, and when the identity verification request is received, querying the stored blockchain data to perform identity authentication.

In one aspect, the identity authentication unit is characterized by performing communication with the user terminal via a Node SDK (Software Development Kit), and the distributed ID issuing unit is characterized by being a hyperledger INDY managing a decentralized ID. Shall be

According to the present invention, based on the Hyperledger Fabric and INDY, a new Blockchain Network structure is created to provide an overall process from issuance to utilization of the DID as a single blockchain-based identity verification system and The effect that the driving method can be provided is derived.

In particular, among the various frameworks based on Blockchain, it is effective to propose a blockchain network structure optimized for KISMI by utilizing Hyperledger Fabric suitable for the enterprise and Hyperledger INDY specialized for DID. have.

1 is a block diagram showing the configuration of a blockchain-based identity authentication system according to an embodiment of the present invention,
Figure 2 is a block diagram showing the configuration of a blockchain-based identity authentication system according to another embodiment of the present invention,
3 is an exemplary view showing the configuration of an identity authentication unit according to another embodiment of the present invention;
4 is an exemplary view for explaining the operation in the identity authentication unit according to an embodiment of the present invention,
5 is a flowchart of a method of driving a blockchain-based identity verification system according to an embodiment of the present invention.

It should be noted that the technical terms used in the present invention are only used to describe specific embodiments, and are not intended to limit the present invention. In addition, technical terms used in the present invention should be interpreted as meanings generally understood by a person having ordinary knowledge in the technical field to which the present invention belongs, unless otherwise defined in the present invention. It should not be interpreted as a meaning or an excessively reduced meaning.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram showing the configuration of a blockchain-based identity authentication system according to an embodiment of the present invention.

The blockchain-based identity verification system 10 according to an embodiment creates a new Blockchain Network based on the Hyperledger Fabric and INDY to provide the overall process from issuance to utilization of the DID as one network.

In one embodiment, building a blockchain network is implemented by building an environment that can utilize Hyperledger Fabric and INDY in the Azure cloud. You can use linux ubuntu 1604 as an example.

Hyperledger Fabric (Hyperledger Fabric) can be configured as a raft network with 2 ca, 4 peers (2 org), 4 couchdb, and 5 orderers as shown in FIG. 1 based on Fabric 2.0.0. However, the present invention is not limited to this, and the number of peers can be adjusted in various ways through automation in the future.

Each VM connection of Hyperledger Fabric can utilize cloud peering and docker-swarm.

Hyperledger INDY may be, for example, indy-sdk 1.14.2 installed. Also, issuing DID can be implemented by modularizing (using Nodejs) the DID issuing part of INDY.

In addition, the DID issued by the blockchain-based identity verification system 10 according to an embodiment is implemented to be stored and utilized through the fabric chaincode. For example, it can be implemented using Go lang.

The blockchain-based identity authentication system 10 according to an embodiment retrieves and authenticates data through a fabric chaincode when identity authentication is required. For example, you can authenticate using Go lang.

And it is implemented to generate an express server by utilizing the Fabric Node SDK for communication with the user terminal 20.

In addition, Secure Sockets Layer (SSL) can be applied through nginx. Nginx is a web server software that aims for lightness and high performance. It has a web server, reverse proxy, and mail proxy functions.

SSL (Secure Sockets Layer) is a term that refers to a secure socket layer, and is an Internet communication protocol for safely transmitting data on the Internet. By applying SSL (Secure Sockets Layer), it is possible to overcome the problem that the Internet protocol does not maintain confidentiality in terms of security.

According to one embodiment, the blockchain-based identity verification system 10 has an effect of controlling access to the blockchain through JWT and enhancing security by APIizing the DID issuance, storage, and inquiry parts (using Nodejs). have.

Specifically, in one embodiment, the distributed ID issuing unit 12 of FIG. 1 issues a distributed ID according to the distributed ID issuance request received from the user terminal 20.

According to a characteristic aspect of the present invention, the distributed ID issuing unit 12 is characterized in that it is a Hyperledger INDY that manages the decentralized ID. According to an embodiment, a DID conforming to the World Wide Web Consortium (W3C) standard may be issued using Hyperledger INDY. However, it is not limited thereto.

Hyperledger INDY supports an independent identity for distributed ledgers. It is a platform that aims to provide identity without intermediaries in the Internet environment.

It provides reusable components, tools, and libraries to create and use independent digital IDs based on blockchain.

Decentralized Identifiers DID (Decentralized Identifiers) is a service that proves an individual's identity and manages personal information by himself through a distributed ledger that cannot be tampered with. The biggest feature of DID using blockchain is self-sovereignty identification.

For example, when a DID is issued from a user's personal wallet and recorded in a block, the fact that his DID has reliability through the immutability of the DID is disclosed to everyone in Consace. Therefore, outsiders can ask the wallet holder to verify the DID that contains the public key information of the blockchain, and the wallet holder can prove himself using the private key, and using the distributed ID, the wallet holder can send the personal information in the wallet to the outside. It can be provided selectively.

The identity authentication unit 14 stores the distributed ID issued by the distributed ID issuer 12 as blockchain data, and when an identity verification request is received, queries the stored blockchain data to perform identity authentication.

That is, the identity authentication unit 14 receives registration for a previously issued distributed ID. Blockchain-based distributed ID (DID) stores and distributes personal information for each institution and manages information necessary for identity verification. In the case of the existing distributed ID, it is necessary to hack several places at the same time and manipulate the information, so it is possible to secure the safety than to centrally manage it.

In FIG. 1, CC is Chaincode and L is ledger.

Referring to FIG. 1, an operation of a blockchain-based identity authentication system according to an embodiment will be described.

First, the distributed ID issuing unit 12 receives a DID issuing request received from the user terminal 20 (101). Then, the distributed ID issuing unit 12, or INDY, is stored in the identity authentication unit 14, that is, Fabric, after issuing the DID (102).

In addition, DID information issued to the user terminal 20 is provided (103).

Thereafter, when the user accesses the identity authentication unit 14 and receives a DID verification request or a chaincode function access request (201), in the case of Get stated, peers joined to the channel (peer1, peer2, peer3, peer4) After returning the ledger, the verification result is returned (202).

On the other hand, in the case of Put state, the result is recorded on the blockchain through orderers (orderer1, orderer2, orderer3, orderer4, orderer5) through the raft consensus algorithm (203).

In one embodiment, the identity authentication unit 14 may be implemented in the form of a hyperledger fabric including a virtual machine.

Hyperledger Fabric was developed in the form of an authorized private blockchain and only users registered in the Membership Services Provider (MSP) member authentication management system can participate in the Hyperledger Fabric blockchain.

In one embodiment, the identity authentication unit 14 may enhance the privacy between blockchain participants by introducing the concept of a channel on a blockchain implemented with a network hyperledger fabric. At this time, the transaction information can be made public or confidential. In other words, there is a channel, so there is privacy and confidentiality.

In addition, by using a blockchain network implemented with hyperledger fabric, channels can be set up according to specific business purposes to share information with each other. The transactions processed by multiple peers are different and work in distributed parallel processing.

Peer is a logical unit that represents the network nodes that make up the hyperledger fabric blockchain, and consists of Ledger (World state+Blockchain) and Chain Code (including business logic).

The types of peers are endorsing, sending and receiving communication between nodes, checking which nodes are alive and dead, and anchor peers, ordering peers, which play the role of throwing packets, general committing peers, and validation peers And so on. However, it is not limited thereto.

The network component peers forming the hyperledger can design the network by modularizing in a desired order. At this time, the consensus protocol uses the Raft algorithm.

In addition, by using a blockchain-based history management module, various information of users can be stored in the blockchain to secure the integrity of the history, and to provide a service that secures reliability to users for identity assurance. Is derived. At this time, whether to process the transaction is determined through the logic of the chain code.

2 is a block diagram showing the configuration of a blockchain-based identity authentication system according to another embodiment of the present invention.

As illustrated in FIG. 2, the identity authentication unit 14 may communicate with the user terminal 1 20a and the user terminal 2 20b via a Node SDK (Software Development Kit).

In this embodiment, the identity verification system 10 is implemented to generate an express server by utilizing the Fabric Node SDK for communication with user terminals 20a and 20b.

In one aspect, the identity authentication unit 14 is a raft including 2 ca, 4 peers (2 org), 4 couchDBs, and 5 orderers based on Fabric 2.0.0 as shown in FIGS. 1 and 2. It is built as a network (raft network).

At this time, 4 peers (2 org) and 5 orderers are implemented as a virtual machine and are characterized by being joined to and connected to a channel of a hyperledger fabric.

Fabric is the first distributed ledger platform to support smart contracts written in general-purpose programming languages such as Java, Go, and node.js. It uses open source to support the confidentiality and scalability of the business environment.

Couch DB is one of the “NoSQL” type databases developed by the Apache Foundation. NoSQL (Not Only SQL) manages data in the form of relational tables in the existing SQL, but supports various formats such as Document, Key-value, Column-family, Graph, etc. rather than relational tables.

3 is an exemplary view showing a configuration of an identity authentication unit according to another embodiment of the present invention.

As illustrated in FIG. 3, the identity authentication unit 14 may be constructed as a raft network including 3 ca, 7 peers (3 org), and 7 couchDBs. As described above, the identity authentication unit 14 may extend the Peer and add Org depending on the situation. That is, the blockchain-based identification system 10 according to an embodiment of the present invention can expand the network as necessary.

4 is an exemplary view for explaining the operation in the identity authentication unit according to an embodiment of the present invention.

The orderer creates a block by sorting transactions that have been validated in chronological order, and then transfers the generated blocks to related nodes.

As shown in FIG. 4, the hyperledger fabric can select a leader among orderers and guarantee fault-tolerance through a Raft consensus algorithm.

The consensus algorithm is an algorithm used by nodes that do not trust each other on the blockchain network to make decisions.

The types of consensus algorithms include POW, POS, DPOS, etc., and the Raft algorithm is used in the present invention.

5 is a flowchart of a method of driving a blockchain-based identity verification system according to an embodiment of the present invention.

A method of driving a blockchain-based identity authentication system including a distributed ID issuing unit and an identity authentication unit according to an embodiment issues a distributed ID according to a distributed ID issuance request received from a user terminal (S500).

According to an aspect of the present invention, the distributed ID issuing unit is characterized by being a hyperledger INDY that manages a decentralized ID. According to an embodiment, a DID conforming to the World Wide Web Consortium (W3C) standard may be issued using Hyperledger INDY. However, it is not limited thereto.

Hyperledger INDY supports an independent identity for distributed ledgers. It is a platform that aims to provide identity without intermediaries in the Internet environment.

It provides reusable components, tools, and libraries to create and use independent digital IDs based on blockchain.

Decentralized Identifiers DID (Decentralized Identifiers) is a service that proves an individual's identity through a distributed ledger that cannot be forged/modified and manages personal information by himself. The biggest feature of DID using blockchain is self-sovereignty identification.

For example, when a DID is issued from a user's personal wallet and recorded in a block, the fact that his DID has reliability through the immutability of the DID is disclosed to everyone. Therefore, outsiders can ask the wallet holder to verify the DID that contains the public key information of the blockchain, and the wallet holder can prove himself using the private key, and using the distributed ID, the wallet holder can send the personal information in the wallet to the outside. It can be provided selectively.

Then, the identity authentication unit stores the distributed ID issued by the distributed ID issuer as blockchain data (S510), and when an identity verification request is received (S520), the stored blockchain data is retrieved to perform identity authentication (S530).

In one aspect of the present invention, the step of performing identity authentication is characterized by performing communication with the user terminal via a Node SDK (Software Development Kit).

The method of driving the identity verification system according to an embodiment is implemented to generate an express server by utilizing a Fabric Node SDK for communication with user terminals 20a and 20b.

In addition, the identity authentication unit according to an embodiment of the fabric 2.0.0 based on 2 ca, 4 peer (2 org), 4 couchdb, 5 orderers (raft network) including a built-in (raft network) including that It is characterized by.

At this time, the 4peer (2 org) and 5 orderers of the identity authentication unit are implemented as a virtual machine and are joined to and joined to a channel of a hyperledger fabric.

According to an exemplary embodiment, a method of driving an identity verification system receives a DID issuance request from a user terminal by a distributed ID issuer. And the distributed ID issuing unit, or INDY, is stored in the identity authentication unit, or fabric, after issuing the DID.

In addition, DID information issued to the user terminal 20 is provided.

How to operate the identity verification system When a DID verification request or chaincode function access request is received from the user, in the case of Get stated, search and verify the ledger of peers (peer1, peer2, peer3, peer4) connected to the channel. Returns the result.

On the other hand, in the case of Put state, the result is recorded on the blockchain through orderers (orderer1, orderer2, orderer3, orderer4, orderer5) through the raft consensus algorithm (203).

In one embodiment, the identity authentication unit may be implemented in the form of a hyperledger fabric including a virtual machine.

Hyperledger Fabric was developed in the form of an authorized private blockchain and only users registered in the Membership Services Provider (MSP) member authentication management system can participate in the Hyperledger Fabric blockchain.

In one embodiment, the identity authentication unit may strengthen the privacy between blockchain participants by introducing the concept of a channel on a blockchain implemented with a network hyperledger fabric. At this time, the transaction information can be made public or confidential. In other words, there is a channel, so there is privacy and confidentiality.

In addition, by using a blockchain network implemented with hyperledger fabric, channels can be set up according to specific business purposes to share information with each other. The transactions processed by multiple peers are different and work in distributed parallel processing.

Peer is a logical unit that represents the network nodes that make up the hyperledger fabric blockchain, and consists of Ledger (World state+Blockchain) and Chain Code (including business logic).

The types of peers are endorsing, sending and receiving communication between nodes, checking which node is alive and dead, and anchor peer, ordering peer, which plays a role of throwing packets, general committing peer, validation peer And so on. However, it is not limited thereto.

The network component peers forming the hyperledger can design the network by modularizing in a desired order. At this time, the replaceable consensus protocol uses the Raft algorithm.

In addition, by using a blockchain-based history management module, various information of users can be stored in the blockchain to secure the integrity of the history, and to provide a service that secures reliability to users for identity assurance. Is derived. At this time, it is possible to determine whether to process the transaction through the logic of the chain code.

The above-described method may be implemented as an application or in the form of program instructions that can be executed through various computer components to be recorded on a computer-readable recording medium. The computer-readable recording medium may include program instructions, data files, data structures, or the like alone or in combination.

The program instructions recorded on the computer-readable recording medium are specially designed and configured for the present invention, and may be known and available to those skilled in the computer software field.

Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical recording media such as CD-ROMs, DVDs, and magneto-optical media such as floptical disks. media), and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like.

Examples of program instructions include not only machine language codes produced by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like. The hardware device may be configured to operate as one or more software modules to perform processing according to the present invention, and vice versa.

Although described above with reference to embodiments, those skilled in the art understand that various modifications and changes can be made to the present invention without departing from the spirit and scope of the present invention as set forth in the claims below. Will be able to.

10: identification system 20: user terminal
12: distributed ID issuing unit 14: identity authentication unit

Claims (10)

A distributed ID issuing unit that issues a distributed ID according to a request for issuing a distributed ID received from a user terminal; And
And an identity authentication unit that stores the distributed ID issued by the distributed ID issuance unit as blockchain data, and performs identity authentication by querying the stored blockchain data when an identity verification request is received,
The identity authentication unit, based on Fabric 2.0.0, is a blockchain-based identity authentication built with a raft network including 2 ca, 4 peers (2 org), 4 couchdbs, and 5 orderers. system.
According to claim 1,
The identity authentication unit is a blockchain-based identity verification system, characterized in that for communicating with the user terminal via a Node SDK (Software Development Kit).
delete According to claim 1,
The 4 peers (2 org) and 5 orderers are implemented as a virtual machine, and the block is characterized by being joined to and linked to a channel of a hyperledger fabric. Chain-based identification system.
According to claim 1,
The distributed ID issuing unit is a hyperledger (Hyperledger) INDY that manages the decentralized ID is a blockchain-based identity authentication system, characterized in that.
In the method of driving a blockchain-based identity authentication system including a distributed ID issuing unit and an identity authentication unit,
Issuing a distributed ID according to a distributed ID issuance request received from the user terminal; And
The identity authentication unit includes the step of storing the distributed ID issued by the distributed ID issuance unit as blockchain data, and when an identity verification request is received, querying the stored blockchain data to perform identity authentication.
The identity authentication unit, based on Fabric 2.0.0, is a blockchain-based identity proof built with a raft network including 2 ca, 4 peers (2 org), 4 couchdbs, and 5 orderers. How the system works.
The method of claim 6,
The step of performing the identity authentication is a method of driving a blockchain-based identity verification system, characterized in that communication with the user terminal is performed through a Node SDK (Software Development Kit).
delete The method of claim 6,
The 4 peers (2 org) and 5 orderers are implemented as a virtual machine, and the block is characterized by being joined to and linked to a channel of a hyperledger fabric. A method of driving a chain-based identification system.
The method of claim 6,
The distributed ID issuing unit is a hyperledger (Hyperledger) INDY to manage the decentralized ID Blockchain-based identity verification system driving method.

Images