KR20200110118A - Method and server for managing user identity using blockchain network, and method and terminal for verifying user using user identity based on blockchain network - Google Patents

Abstract

The present invention relates to a method for managing identity of a user using a blockchain network. The method comprises: a step (a) in which at least one blockchain node executes a specific user smart contract to register a specific identity claim of a specific user in a distributed ledger when a second specific certificate authority signature value is valid by verifying the second specific certificate authority signature value; and a step (b) in which at least one blockchain node enables a specific user terminal to check an ID of the specific identity claim of the specific user registered in the distributed ledger by using the ID of the specific identity claim of the specific user.

Description

A method and a server for managing the user's identity using a blockchain network, and a method and a terminal for authenticating a user using a user identity based on a blockchain network (METHOD AND SERVER FOR MANAGING USER IDENTITY USING BLOCKCHAIN NETWORK, AND METHOD AND TERMINAL FOR VERIFYING USER USING USER IDENTITY BASED ON BLOCKCHAIN NETWORK}

The present invention relates to a method and a server for managing a user's identity using a blockchain network, and a method and a terminal for authenticating a user using a user identity based on a blockchain network, and more specifically, from a user terminal. When a user ID generation transaction including the user ID generation data using the user address of and the first user signature value signed with the user master private key is obtained, the first user signature value is verified and the first user signature value If this is confirmed to be valid, register the user smart contract on the distributed ledger to execute the ID management contract registered on the distributed ledger of the blockchain network to create claims for user identities, and register the user smart contract on the distributed ledger. By sending the user smart contract registration transaction ID corresponding to the user smart contract registration transaction to the user terminal, the user terminal uses the user smart contract registration transaction ID to convert the address of the user smart contract registered in the distributed ledger as the user ID. User self-claim data and user self-claim data including user ID, user-specific value processed with user identities, and a second user signature value signed with user ID and user-specific value with a user private key When the user self-claim registration request transaction including the third user signature value signed with the private key is obtained, the third user signature value is verified and the third user signature value is confirmed to be valid, and the user smart contract corresponding to the user ID is opened. Users using a blockchain network that allows user self-claims corresponding to user self-claim data to be registered on the distributed ledger, and user self-claim transaction IDs corresponding to user self-claims registered on the distributed ledger are transmitted to the user terminal. How to manage the identity of the server, and the blockchain network The present invention relates to a method and a terminal for authenticating a user by using the based user identity.

As the targets of transactions increase and the scope of transactions expands due to the development of production technology and transportation means from the general transaction structure, the transaction structure has gradually become complex and transaction costs have increased. In addition, as most transactions are conducted indirectly instead of direct transactions, a large amount of cost has been required to trust the parties and targets of the transaction.

For example, in order to trust the parties to the transaction, credit rating agencies are used to evaluate, and certificates, guarantees, and collateral by third parties are required to guarantee the quality or value of products. In addition, a myriad of intermediaries have appeared, such as financial institutions for the stability and trust of payment/settlement, and notary or trust institutions to guarantee contracts, and the cost of trust is incurred.

In particular, since information on personal certificates for user authentication is held by a certification authority, etc., there may be a risk of being exposed to hacking while checking the certificate information for user authentication. There is an inconvenience of having to use the program.

In addition, when a certification authority that stores information on a user's personal certificate is hacked, a large amount of personal information is hacked.

On the other hand, authentication information such as a personal certificate for user authentication in the prior art is stored in each authentication authority that has been authenticated, and the authentication information in which the user accesses each authentication information stored in a plurality of authentication institutions is stored. It is inconvenient to check the agency every time, and it is difficult for users to easily manage their own authentication information because each certification authority owns the authority for authentication information stored in each certification authority.

An object of the present invention is to solve all the above-described problems.

In addition, another object of the present invention is to allow the user to own the authority for each user identities for user authentication.

In addition, another object of the present invention is to facilitate management of each user identities for user authentication.

In addition, another object of the present invention is to allow the user to directly manage access rights to user identities.

According to an embodiment of the present invention for achieving the above object, in a method for managing user identities using a blockchain network, (a) a claim for creating a claim for the identities of users and certification authorities Smart contracts are registered in the distributed ledger of a blockchain network composed of a plurality of blockchain nodes as user smart contracts and certification authority smart contracts, respectively, in response to users and certification authorities, and the user smart contract And the addresses on the distributed ledger for the certification authority smart contracts are managed by the IDs of the users and the certification authorities, (i) a specific user ID from a specific user terminal, a specific user specific for authentication Responding to a request for registering a specific user-specific identity claim including an identity and a specific claim type corresponding to the specific user-specific identity, or (ii) corresponding to the specific user ID from the specific user terminal and the specific user-specific identity A specific user-specific identity claim from a specific certification authority server in response to the specific user-specific identity claim registration request including the specific claim type to be-The specific user-specific identity claim is generated by the specific certification authority server, (i) The specific certification authority server verifies the specific user specific identity, or (ii) the specific certification authority server checks the specific user specific identity corresponding to the specific claim type among the identities of the specific user previously stored, and then the specific certification authority A specific certification authority ID corresponding to the server, the specific claim type corresponding to the specific user specific identity, and a first specific certification authority signature value signed by the specific user ID and the specific claim type with the private key of the specific certification authority server -And the specific user-specific identity claim as the master private key of the specific certification authority When a specific user-specific identity claim registration request transaction including a signed second specific authentication authority signature value is obtained, the at least one blockchain node verifies the second specific authentication authority signature value, and the second specific authentication authority If the signature value is valid, executing the specific user smart contract so that the specific user specific identity claim is registered in the distributed ledger; And (b) the at least one blockchain node registers a specific user specific identity claim registration transaction ID corresponding to a specific user specific identity claim registration transaction in which the specific user specific identity claim is registered in the distributed ledger. By transmitting to the server, the specific certification authority server obtains a specific user specific identity claim ID corresponding to the specific user specific identity claim registered in the distributed ledger using the specific user specific identity claim registration transaction ID, and at least The specific claim signature value signed with the specific user specific identity with the private key of the specific certification authority and the specific user specific identity claim ID are transmitted to the specific user terminal, so that the specific user terminal determines the specific user specific identity claim ID. Making it possible to confirm the claim of the specific user-specific identity registered in the distributed ledger by using the distributed ledger; A method comprising a is provided.

According to an embodiment of the present invention, there is provided a block chain node of a block chain network that manages a user's identity using a block chain network, comprising: a memory storing instructions for managing a user identity; And a processor that manages the user identity according to the instructions stored in the memory. Including, wherein the processor, (i) Claims smart contracts that generate claims for the identities of users and certification authorities, respectively, in response to users and certification authorities, user smart contracts and certification authority smart Contracts are registered in a distributed ledger of a blockchain network constituted by a plurality of block chain nodes, and addresses on the distributed ledger for the user smart contracts and the authentication authority smart contracts are the users and the authentication authority. (I-1) a specific user ID from a specific user terminal, a specific user specific identity for authentication, and a specific user specific identity including a specific claim type corresponding to the specific user specific identity In response to a claim registration request, or (i-2) in response to the specific user-specific identity claim registration request including the specific user ID from the specific user terminal and the specific claim type corresponding to the specific user-specific identity A specific user specific identity claim from a specific certification authority server-The specific user specific identity claim is generated by the specific certification authority server, and (i-1) the specific certification authority server verifies the specific user specific identity or (i- 2) The specific certification authority server checks the specific user specific identity corresponding to the specific claim type among the identities of the specific user previously stored, and then the specific certification authority ID corresponding to the specific certification authority server, at least the specific user specific identity. The specific claim type corresponding to, and the specific user ID and the specific claim type are generated including a first specific certification authority signature value signed with the private key of the specific certification authority server-and the specific user specific identity claim A specific user-specific identity claim including a second specific certification authority signature value signed with the master private key of the specific certification authority When a lock request transaction is obtained, the second specific authentication authority signature value is verified, and if the second specific authentication authority signature value is valid, the specific user specific identity claim is registered in the distributed ledger by executing the specific user smart contract. And (ii) sending the specific user specific identity claim registration transaction ID corresponding to the specific user specific identity claim registration transaction to register the specific user specific identity claim on the distributed ledger to the specific certification authority server, The specific authentication authority server obtains a specific user specific identity claim ID corresponding to the specific user specific identity claim registered in the distributed ledger using the specific user specific identity claim registration transaction ID, and at least the specific user specific identity The distributed ledger by sending the specific claim signature value signed with the private key of the specific certification authority and the specific user specific identity claim ID to the specific user terminal, so that the specific user terminal uses the specific user specific identity claim ID. A blockchain node is provided, characterized in that it performs a process that enables the user to confirm the specific identity claim registered in the specific user.

In addition to this, a computer-readable recording medium for recording a computer program for executing the method of the present invention is further provided.

According to the present invention, the following effects are obtained.

In the present invention, since the user himself can own the authority for each user identities for user authentication by using a highly secure blockchain technology, it is possible to prevent user information from being transacted regardless of the user's will. There will be.

In the present invention, since the user identities are stored by the user, it is possible to easily manage the respective user identities.

The present invention enables the user to directly manage access rights to user identities, thereby preventing user information from being exposed regardless of the user's will.

1 schematically shows a system for managing user identities using a blockchain network according to an embodiment of the present invention,
2A and 2B schematically illustrate a method of generating a user ID, etc. in a method of managing user identity using a block chain network according to an embodiment of the present invention,
3A and 3B schematically illustrate a method of registering a user self-claim in a method of managing user identity using a block chain network according to an embodiment of the present invention,
4A and 4B schematically illustrate a method of adding and deleting a user key in a method of managing user identity using a block chain network according to an embodiment of the present invention,
5A and 5B schematically illustrate a method of backing up user data in a method of managing user identity using a blockchain network according to an embodiment of the present invention,
6 schematically shows a method of recovering user data in a method of managing user identity using a block chain network according to an embodiment of the present invention.
7A and 7B schematically illustrate a method of registering a specific identity claim in a method of managing user identity using a block chain network according to an embodiment of the present invention,
8A and 8B schematically illustrate a method of deleting a specific identity claim in a method of managing user identity using a block chain network according to an embodiment of the present invention,
9A and 9B schematically illustrate another method of deleting a specific identity claim in a method of managing user identity using a block chain network according to an embodiment of the present invention.
10A and 10B schematically illustrate a method of authenticating a user using a user identity based on a blockchain network according to an embodiment of the present invention.

DETAILED DESCRIPTION OF THE INVENTION The detailed description of the present invention to be described below refers to the accompanying drawings, which illustrate specific embodiments in which the present invention may be practiced. These embodiments are described in detail sufficient to enable a person skilled in the art to practice the present invention. It is to be understood that the various embodiments of the present invention are different from each other but need not be mutually exclusive. For example, specific shapes, structures, and characteristics described herein may be implemented in other embodiments without departing from the spirit and scope of the present invention in relation to one embodiment. In addition, it is to be understood that the location or arrangement of individual components within each disclosed embodiment may be changed without departing from the spirit and scope of the present invention. Accordingly, the detailed description to be described below is not intended to be taken in a limiting sense, and the scope of the present invention, if properly described, is limited only by the appended claims, along with all scopes equivalent to those claimed by the claims. Like reference numerals in the drawings refer to the same or similar functions over several aspects.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings in order to enable those of ordinary skill in the art to easily implement the present invention.

1 is a system for managing user identities using a block chain network according to an embodiment of the present invention. The system includes a user terminal 100, an authentication authority server 200, and a block chain node 300. It may include.

First, the user terminal 100 is a subject that manages the user identity, and may include a personal computer (PC), a mobile computer, a PDA/EDA, a mobile phone, a smartphone, a tablet, an IoT device, and the like. Further, the user terminal 100 is not limited thereto, and may include all devices such as a portable game machine, a digital camera, and a personal navigation system having a wired/wireless communication function. In addition, the user terminal 100 includes a memory 110 that stores instructions for managing a user identity and a processor 120 that performs an operation for managing a user identity in response to instructions stored in the memory 110. can do. In this case, only one user terminal 100 is illustrated in FIG. 1, but this is for convenience of description, and the user terminal 100 may be formed of a plurality of pieces corresponding to each user.

Specifically, the user terminal 100 is typically a computing device (e.g., a device that may include components of a computer processor, memory, storage, input and output devices, and other existing computing devices; electronic devices such as routers, switches, etc. Communication device; desired system using a combination of electronic information storage systems such as network attached storage (NAS) and storage area networks (SAN)) and computer software (i.e., instructions that make the computing device function in a specific way) It may be to achieve performance.

In addition, the processor of the computing device may include a hardware configuration such as a micro processing unit (MPU) or a central processing unit (CPU), a cache memory, and a data bus. In addition, the computing device may further include an operating system and a software configuration of an application that performs a specific purpose.

Next, the authentication authority server 200 authenticates user identities, and authenticates the user identities in response to the instructions stored in the memory 210 and the memory 210 storing instructions for user identity authentication. It may include a processor 220 that performs an operation for. At this time, although only one certification authority server 200 is shown in FIG. 1, this is for convenience of explanation, and the certification authority server 200 is composed of a plurality of certification bodies corresponding to each certification authority that authenticates the user identity. I can.

Specifically, the certification authority server 200 is typically a computing device (e.g., a device that may include components of a computer processor, memory, storage, input and output devices, and other conventional computing devices; routers, switches, etc.). Electronic communication devices; electronic information storage systems such as network attached storage (NAS) and storage area networks (SAN)) and computer software (i.e., instructions that allow the computing device to function in a specific way). It may be to achieve system performance.

Next, the blockchain node 300 stores and manages claims corresponding to user identities or information related to claims, and may be a server constituting a blockchain network, and stores instructions for user identity management. It may include a memory 310 and a processor 320 that performs an operation for user identity management in response to instructions of the memory 310. In this case, although FIG. 1 shows the block chain nodes 300 as six, this is for convenience of description, and the number of the block chain nodes 300 is not limited thereto.

Specifically, the blockchain node 300 is specifically, the information management server 200 typically includes a computing device (e.g., a computer processor, memory, storage, input device and output device, other components of the existing computing device. Devices capable of; electronic communication devices such as routers, switches, etc.; electronic information storage systems such as network attached storage (NAS) and storage area networks (SAN)) and computer software (i.e., allowing computing devices to function in a specific way). It may be to achieve the desired system performance by using a combination of instructions).

In addition, the system for managing the user's identity using the blockchain network according to an embodiment of the present invention may further include a service providing server (not shown), and the service providing server may perform user authentication using the user identity, etc. Through the user terminal 100, a service desired by the user may be provided. In this case, the service providing server may typically achieve a desired system performance by using a combination of a computing device and computer software.

A method of managing user identities using a system for managing user identities using a block chain network according to an embodiment of the present invention configured as described above will be described as follows.

A method of generating a user ID, etc. in the method of managing user identity using a block chain network according to an embodiment of the present invention will be described with reference to FIG. 2A.

In the state in which the user runs the identity management app installed in the user terminal 100 to generate a user private key and a user public key, and generates a user address using the user public key, the user terminal (100), for example, by executing an identity management app installed in the user terminal 100 so that the user ID generation transaction is transmitted to the blockchain network (S1). In this case, the user ID generation transaction may include user ID generation data using a user address and a first user signature value in which the user ID generation data is signed with a user master private key. And, the user master private key may be a user private key.

Then, at least one block chain node 300 among a plurality of block chain nodes constituting the block chain network verifies (S2) the first user signature value included in the user ID generation transaction.

As an example, at least one blockchain node 300 executes a digital signature verification module registered in the distributed ledger on the blockchain network, and refers to the first user signature value and user ID generation data, and the user corresponding to the user master private key You can have them acquire the master public key. That is, at least one blockchain node 300 transmits the first user signature value and user ID generation data to the digital signature verification module registered in the distributed ledger on the blockchain network, and the digital signature verification module is A user master private key corresponding to the user master private key used for signing the first user signature value is obtained by using the user signature value and user ID generation data. In addition, the at least one blockchain node 300 checks whether the first comparison target data and the user ID generation data checked from the first user signature value match using the acquired user master public key Is verified to be valid.

As another example, the user terminal 100 further includes and transmits the user master public key corresponding to the user master private key in the user ID generation transaction, so that at least one blockchain node 100 uses the user master public key. It is verified whether the first user signature value is valid by checking whether the first comparison target data checked from the first user signature value and the user ID generation data match.

Thereafter, when it is confirmed that the first user signature value is valid, at least one blockchain node 300 executes an ID management contract registered in the distributed ledger of the blockchain network to create a claim for user identities. Register the contract on the distributed ledger (S3).

In addition, at least one blockchain node 300 transmits the user smart contract registration transaction ID corresponding to the user smart contract registration transaction for registering the user smart contract on the distributed ledger to the user terminal 100 (S4).

Then, the user terminal 100 checks whether the user smart contract is registered on the distributed ledger by using the user smart contract registration transaction ID (S5), and by agreement of the blockchain nodes 300 constituting the blockchain network, the user When a smart contract is registered in the distributed ledger, the user smart contract address, which is the location information of the user smart contract registered, is acquired (S6) in the distributed ledger, and the acquired user smart contract address is used as the user ID to the user terminal 100. You will register.

In FIG. 2A, the user terminal 100 must directly transmit a user ID generation transaction to the blockchain network, so that the user terminal 100 must pay the transaction fee on the blockchain network. However, in this case, the user terminal 100 may not directly pay the transaction blood, but may allow the user terminal 100 to pay the transaction blood through another device.

That is, referring to FIG. 2B, the user terminal 100 may not pay the transaction blood for the user ID generating transaction, but the proxy server 150 may be allowed to pay the transaction blood.

At this time, the user terminal 100 transmits a user ID generation transaction to the proxy server 150 (S1-1).

Then, the proxy server 150 transmits the first proxy server signature value signed by the proxy server master private key of the proxy server 150 and the user ID generation transaction to the blockchain network (S1-2). , Accordingly, at least one blockchain node 300 constituting the blockchain network verifies the first proxy server signature value (S1-3), and if the first proxy server signature value is valid, the first user signature value Is verified (S2). At this time, at least one blockchain node 300 has verified the first user verification value, but unlike this, the proxy server 150 may verify the first user verification value.

In addition, at least one blockchain server 300 transmits the user smart contract registration transaction ID to the proxy server 150 (S4-1), so that the proxy server 150 transmits the user smart contract registration transaction ID to the user terminal 100. It is transmitted to (S4-2).

In the above, a process of generating a user ID through the user terminal 100 has been described, but the authentication authority server, the service providing server, and the like can also generate each ID by the same method.

A method of registering a user self claim in a method of managing user identity using a blockchain network according to an embodiment of the present invention will be described with reference to FIG. 3A.

A user self-claim to be registered by the user using the user identity management app of the user terminal 100 is generated (S11).

In this case, the user self-claim may include a user ID, a user specific value obtained by processing the user identities, and a second user signature value in which the user ID and the user specific value are signed with a user private key. In this case, the user specific value may be a value obtained by processing each of specific identities for the user.

For example, a user self-claim can be created in the format of 1. topic, 2. scheme, 3. owner, 4, signature value, and 5. data. In this case, the topic may be a type of claim related to user identities, a scheme may be an encryption algorithm to be used, an owner may be a subject generating the claim, a signature value may be a signature value of the subject, and data may be the content of the claim.

Meanwhile, the user identities include feature information for identifying a user, and the feature information may be stored in the user terminal. In addition, the user identities may include all characteristic information related to the user such as the user's name, date of birth, gender, nickname, phone number, email address, biometric information, behavioral characteristics, hobbies, physical characteristics, and life patterns, and each The characteristic information of can be classified by claim type, and topics can be added or deleted as needed. In addition, the owner may be a user ID generated by the method of FIG. 2A or 2B. In addition, the data may be identity information for a claim, and in the user self-claim, it is a user-specific value obtained by processing all the identities of the user, and in the identity claim, it may be a claim type corresponding to at least one specific identity, that is, the type of topic. . Further, the data may include a time stamp, but is not limited thereto, and may include various authentication verification data. In this case, the authentication confirmation data is not a user's identities and values obtained by processing them, and may include arbitrary data such as nonce for confirming evidence that each user's identities are authenticated. In addition, security can be improved by adding a user ID to the data.

In addition, the user specific value may be a root hash value of a Merkletree in which hash values for each of the user identities are allocated to at least some of each leaf node. In this case, the user specific value may be a hash value for one user identity.

Thereafter, the user terminal 100 transmits a user self-claim registration request transaction for registering the generated user self-claim to the blockchain network (S12). At this time, the user self-claim registration request transaction includes user self-claim data, that is, a user ID, a user-specific value processed with user identities, and a second user signature value that signs the user ID and user-specific value with the user private key. It may include a self-claim and a third user signature value of signing the user self-claim data with the user master private key.

Then, at least one block chain node 300 among a plurality of block chain nodes constituting the block chain network verifies the third user signature value (S13). In this case, the verification of the third user signature value may be performed in the same manner as described with reference to FIG. 2A, and a detailed method for verifying the signature value will be omitted in the following description.

Thereafter, when it is confirmed that the third user signature value is valid, at least one blockchain node 300 verifies the second user signature value included in the user self-claim (S14).

And, when it is confirmed that the second user signature value is valid, at least one blockchain node 300 executes a user smart contract corresponding to the user ID registered in the distributed ledger of the blockchain network to correspond to the user self-claim data. The user self-claim is registered in the distributed ledger (S15), and the user self-claim transaction ID corresponding to the transaction for registering the user self-claim in the distributed ledger is transmitted to the user terminal 100 (S18).

Then, the user terminal 100 checks whether the user self-claim has been registered on the distributed ledger by using the user self-claim transaction ID, and the user self-claim is distributed by the agreement of the blockchain nodes 300 constituting the blockchain network. When registered in the ledger, the user self-claim address, that is, the user self-claim ID, which is the location information where the user self-claim is registered in the distributed ledger, is obtained.

Meanwhile, referring to FIG. 3B, the user terminal 100 transmits a user self claim registration request transaction to the proxy server 150 (S12-1), and the proxy server 150 transmits a user self claim registration request transaction The self-claim registration request transaction is transmitted to the blockchain network (S12-2) with the second proxy server signature value signed with the proxy server master private key. Then, at least one of the plurality of blockchain nodes constituting the blockchain network, at least one blockchain node 300 verifies the second proxy server signature value (S13-1), and if the second proxy server signature value is valid, 2 The user signature value is verified (S14). At this time, at least one block chain node 300 has verified the second user signature value, but unlike this, the proxy server 150 may verify the second user signature value.

In addition, at least one blockchain node 300 transmits the user self-claim transaction ID to the proxy server 150 (S16-1), and the proxy server 150 transmits the user self-claim transaction ID to the user terminal 100. By transmitting to (S16-2), the user terminal 100 may obtain a user self-claim ID.

In this way, in FIG. 3A, the user terminal 100 pays the transaction blood, but in FIG. 3B, the proxy server 150 may pay the transaction blood on behalf of the user terminal 100.

A method of adding and deleting a user key in a method of managing user identities using a block chain network according to an embodiment of the present invention will be described with reference to FIG. 4A.

In the method of managing user identity using a blockchain network according to an embodiment of the present invention, a user private key is generated using a user address, and each user key can be added or deleted according to the purpose of use of the key. . In addition, it is possible to perform an operation for a corresponding purpose only for a user key corresponding to each purpose.

A user key addition or deletion request transaction including the user key addition or deletion request data including the user address and key purpose through the user identity management app of the user terminal 100 and the user signature value signed with the user master private key When transmitting (S21), at least one blockchain node 300 verifies the user signature value (S22).

At this time, if it is confirmed that the user signature value is valid, the at least one blockchain node 300 adds a user key according to the key purpose from the user key list on the distributed ledger or deletes the user key registered in the key list (S23). ).

In addition, at least one blockchain node 300 transmits (S24) a transaction ID for registering a user key addition or deletion request transaction to the distributed ledger to the user terminal 100 (S24).

Then, the user terminal 100 checks whether the requested user key has been added or deleted from the distributed ledger using the transaction ID (S25), and receives result information from the distributed ledger of the blockchain network (S26). You can check the result of whether the user key requested in is added or deleted. In this case, the user address may be initially registered in the key list for all purposes by default, and different user addresses for the corresponding purpose may be registered in the key list for each purpose according to the addition of the user key.

In addition, referring to FIG. 4B, when the user terminal 100 transmits a user key addition or deletion request transaction to the proxy server 150 (S21-1), the proxy server proxies the user key addition or deletion request transaction. The proxy server signature value signed with the server master private key is transmitted to the blockchain network (S21-2), and at least one blockchain node 300 among a plurality of blockchain nodes constituting the blockchain network signs the proxy server. If it is determined that the value is valid by verifying the value (S21-3), the user key is added or deleted (S23). In this case, the user signature value included in the user key addition or deletion request transaction may be verified by the proxy server 150 or at least one blockchain node 300 may verify.

In addition, at least one blockchain node 300 transmits the transaction ID to the proxy server 150 (S24-1), and the proxy server 150 transmits the transaction ID to the user terminal 100 (S24-2). ) So that the user terminal 100 can check the result of adding or deleting the user key using the transaction ID.

In this way, in FIG. 4A, the user terminal 100 pays the transaction blood, but in FIG. 4B, the proxy server 150 may allow the proxy server 150 to pay the transaction blood on behalf of the user terminal 100.

A method of backing up user data in a method of managing user identity using a block chain network according to an embodiment of the present invention will be described with reference to FIG. 5A.

User data backup includes user identities and user keys, such as IPFS (InterPlanetary File System), etc., in order to enable the user to recover verified data when the user identity management app installed in the user terminal 100 is deleted or cannot be managed. It can be stored in the same distributed storage system, email, or personal storage space.

The user generates encrypted user data by encrypting user data to be backed up through the user identity app of the user terminal 100, for example, user identities and user keys with a user public key (S31).

And, the user terminal 100 transmits the generated encrypted user data to the distributed storage system to request the registration of encrypted user data (S32), and accordingly, at least one of a plurality of distributed storage servers constituting the distributed storage system The distributed storage server 400 registers the encrypted user data in the distributed storage system (S33).

Thereafter, the distributed storage server 400 transmits (S34) the file ID, which is the location information of the encrypted user data registered in the distributed storage system, to the user terminal 100.

On the contrary, the user can generate encrypted user data by encrypting user data to be backed up through the user identity app of the user terminal 100 with a user public key, and store the encrypted user data in email, personal storage space, etc. In this case, the personal storage space may include a web hard drive, a cloud hard drive, a memory card, a storage space of a user terminal, etc., but is not limited thereto, and may include all storage spaces accessible to a user.

Then, the user terminal 100 generates a user self-claim including a user ID and a file ID (S35).

And, by the same method as in Fig. 3a, the user terminal 100 makes a user self-claim registration request (S36) to the blockchain network, and at least one blockchain node 300 constituting the blockchain network is a file ID The user self-claim for is registered in the distributed ledger (S37). Thereafter, the user terminal 100 can check the registration result by checking the user self-claim ID (S38).

Further, referring to FIG. 5B, the user terminal 100 makes a request for registering user data encrypted with the proxy server 150 (S32-1), and the proxy server 15 requests for registering user data encrypted with a distributed storage system. (S32-2), and accordingly, at least one distributed storage server 400 among a plurality of distributed storage servers constituting the distributed storage system registers encrypted user data in the distributed storage system (S33).

Then, the distributed storage server 400 transmits the file ID, which is the location information of the encrypted user data registered in the distributed storage system, to the proxy server 150 (S34-1), and the proxy server 150 sends the file ID to the user. It transmits to the terminal 100 (S34-2).

On the contrary, the user can generate encrypted user data by encrypting user data to be backed up through the user identity app of the user terminal 100 with a user public key, and store the encrypted user data in email, personal storage space, etc. In this case, the personal storage space may include a web hard drive, a cloud hard drive, a memory card, a storage space of a user terminal, etc., but is not limited thereto, and may include all storage spaces accessible to a user.

In addition, by the same method as in FIG. 3B, the user terminal 100 requests the user self-claim registration to the proxy server 150 (S36-1), and the proxy server 150 requests the user self-claim registration to the blockchain network. Do (S36-2).

In this way, in FIG. 5A, the user terminal 100 pays the transaction blood, but in FIG. 5B, the proxy server 150 may pay the transaction blood on behalf of the user terminal 100.

A method of recovering user data in a method of managing user identity using a block chain network according to an embodiment of the present invention will be described with reference to FIG. 6.

In order to recover user data for user identities, the user makes a user self-claim ID confirmation request (S41) to the blockchain network through the user identity management app of the user terminal 100. In this case, the user self-claim to be checked may be a user self-claim corresponding to the file ID registered by the method as in FIG. 5A.

Then, at least one blockchain server 300 constituting the blockchain network executes the user smart contract to check the user self-claim ID registered in relation to the file ID among the user claims registered in the distributed ledger, and the user terminal The user self-claim ID is transmitted to (100) (S42).

Then, the user terminal 100 makes a confirmation request (S43) for the user self-claim to the blockchain network using the verified user self-claim ID, and accordingly, at least one blockchain node 300 constituting the blockchain network. ) Executes the user smart contract and transmits the file ID included in the user self-claim to the user terminal 100 (S44).

Then, the user terminal 100 requests encrypted user data corresponding to the file ID to the distributed storage system using the obtained file ID (S45), and at least one distributed storage server 400 of the distributed storage system The encrypted user data corresponding to the ID is checked, and the verified encrypted user data is transmitted to the user terminal 100 (S46).

On the contrary, when the encrypted user data is stored in an e-mail or personal storage space, the user can obtain the encrypted user data directly from the e-mail or personal storage space through the user terminal 100.

Then, the user terminal 100 decrypts the obtained encrypted user data with a user private key to obtain user data, thereby recovering the user data (S47).

In the above, the user terminal 100 directly communicates with the distributed storage system and the blockchain network, but, unlike this, communication may be mediated through the proxy server by the method as described above.

A method of registering a specific identity claim in a user identity management method using a block chain network according to an embodiment of the present invention will be described with reference to FIG. 7A.

Claims smart contract that generates claims for the identities of users and certification authorities by the same method as in FIGS. 2A and 3A corresponds to users and certification authorities, respectively, user smart contracts and certification authority smart Contracts are registered in the distributed ledger of the blockchain network composed of multiple blockchain nodes, and the addresses on the distributed ledger for user smart contracts and certification authority smart contracts are managed by the IDs of users and certification authorities. In this state, when a request for a list of certification authorities (S51) is obtained from a specific user terminal 100, at least one blockchain node 300 transfers the list of certification authorities registered in the distributed ledger to the specific user terminal 100. It transmits (S52). Then, the specific user terminal 100 allows the user to select a specific certification authority to perform authentication for a specific user identity from the certification authority list. When a specific certification authority is selected by the user, the selected specific certification authority server 200 ) To request information on a specific certification authority (S53).

In addition, the specific certification authority server 200 transmits its own information, that is, specific certification authority information, to the user terminal 100 in response to an information request from the user terminal 100 (S54). In this case, specific authentication The authority server 200 transmits the authentication authority information stored in the server, or transmits the access key for specific authentication authority information registered in the blockchain network or distributed storage system, so that the user terminal 100 receives the access key. Through this, it is possible to obtain specific certification authority information from a blockchain network or a distributed storage system. Further, the specific certification authority information may include information on the certification authority and information on user identities that can be authenticated, but is not limited thereto.

Then, the specific user terminal 100 transmits a specific user specific identity claim registration request to the specific authentication authority server 200 in order to authenticate the specific identity selected by the specific user (S55). In this case, the request for registering a specific user specific identity claim may include a specific user ID, a specific user specific identity for authentication among specific user identities, and a specific claim type corresponding to the specific user specific identity. Contrary to this, a specific user-specific identity claim registration request may include a specific user ID and a specific claim type corresponding to a specific user specific identity, and in this case, a specific user specific identity corresponding to a specific claim type is a specific certification authority server 200 May be stored in

In addition, the request for registering a specific user-specific identity claim may include authentication confirmation data, for example, a time stamp, a nonce, and the like.

Then, the specific certification authority server 200 verifies the specific user specific identity (S56).

In this case, verification of a specific identity is performed by the specific certification authority server 200, and authentication may be performed by checking whether the specific user specific identity matches the characteristic information of the specific user. For example, when a specific identity is a phone number, general phone number authentication is performed to check whether the corresponding phone number matches the phone number of a specific user.

Meanwhile, the specific certification authority server 200 may check a specific user specific identity corresponding to the specific claim type requested for authentication among the identities of the specific user previously stored. At this time, the identities of a specific user previously stored in the specific certification authority server 200 may have already been verified in the specific certification authority server 200, but in the case of not being verified, the identities are verified by the above method. Can be done.

Then, when the specific user specific identity is verified, the specific authentication authority server 200 generates a specific user specific identity claim (S57).

At this time, the specific user-specific identity claim is a specific certification authority ID corresponding to the specific certification authority server 200, a specific claim type corresponding to a specific user specific identity, and a specific user ID and specific claim type as the private key of the specific certification authority server. It may include a signed value of the first specific certification authority signed. In addition, the specific user-specific identity claim may include authentication verification data, for example, a time stamp, nonce, and the like, and the first specific authentication authority signature value may be signed by adding authentication verification data.

As an example, a specific user-specific identity claim may be generated in the format of 1. topic, 2. scheme, 3. owner, 4, signature value, and 5. data. In this case, the topic may be a type of claim related to user identities, a scheme may be an encryption algorithm used, an owner may be a subject generating the claim, a signature value may be a signature value of the subject, and data may be authentication verification data.

Thereafter, the specific certification authority server 200 transmits a specific user specific identity claim registration request transaction for registering the generated specific user specific identity claim to the blockchain network (S58). In this case, the specific user-specific identity claim registration request transaction may include a specific user-specific identity claim and a second specific certification authority signature value in which the specific user-specific identity claim is signed with a master private key of a specific certification authority.

Then, at least one blockchain node 300 of the blockchain network verifies the signature value of the second specific authentication authority. In addition, at least one blockchain node 300 may verify the signature value of the second specific authentication authority included in the specific user-specific identity claim when the second specific authentication authority signature value is valid.

And, at least one blockchain node 300 executes a specific user smart contract registered in the distributed ledger so that a specific user-specific identity claim is registered in the distributed ledger (S59), and a specific user-specific identity claim is registered in the distributed ledger. A specific user specific identity claim registration transaction ID corresponding to the specific user specific identity claim registration transaction to be performed is transmitted to the specific certification authority server 200 (S60).

Then, the specific certification authority server 200 checks whether a specific user specific identity claim has been registered in the distributed ledger by using the specific user specific identity claim registration transaction Aadi (S61), and a block chain node ( 300), when a specific user-specific identity claim is registered in the distributed ledger, a specific user-specific identity claim ID, which is the location information on which a specific user-specific identity claim is registered in the distributed ledger (S62), and a specific user-specific identity The specific claim signature value signed with the private key of a specific certification authority and the obtained specific user specific identity claim ID are transmitted to the user terminal 100 (S63). In this case, the specific claim signature value may be signed by further including authentication verification data such as time stamp and nonce.

In addition, in order for the user to approve a specific user-specific identity claim registered by a specific certification authority server 200, a specific user-specific identity claim approval transaction is transmitted to the blockchain network through a specific user terminal 100 ( S64).

*At this time, the specific user specific identity claim approval transaction may include a specific user specific identity approval data and a third specific user signature value signed by a specific user specific identity approval data with a specific user master private key, and specific user specific identity approval data May include a specific user specific identity claim ID and approval information for a specific user specific identity claim.

Then, at least one block chain node 300 of the blockchain network verifies the third specific user signature value and, if the third specific user signature value is valid, executes a specific user smart contract and executes a specific user specific identity claim approval transaction. Be registered in the distributed ledger (S65).

And, at least one block chain node 300 transmits (S66) a specific user specific identity claim approval transaction ID to a specific user terminal 100 for registering a specific user specific identity claim approval transaction on the distributed ledger. The user terminal 100 checks whether a specific user-specific identity claim approval transaction is registered in the distributed ledger by using a specific user-specific identity claim approval transaction ID (S67) (S68).

Meanwhile, referring to FIG. 7B, the specific certification authority server 200 transmits a specific user specific identity claim registration request transaction for registering the generated specific user specific identity claim to the proxy server 150 (S58-1), The proxy server 150 transmits a specific user-specific identity claim registration request transaction and a second proxy server signature value signed with the proxy server master private key to the blockchain network (S58-2). Then, at least one blockchain node 300 of the blockchain network verifies the second proxy server signature value, and if the second proxy server signature value is valid, registers a specific user-specific identity claim on the distributed ledger (S59). . In addition, at least one blockchain node 300 of the blockchain network transmits a specific user specific identity claim registration transaction ID to the proxy server 150 (S60-1), and the proxy server 150 transmits a specific user specific identity. The claim registration transaction ID is transmitted to the specific certification authority server 200 (S60-2).

In addition, a specific user-specific identity claim approval transaction is transmitted to the proxy server 150 (S64-1) through a specific user terminal 100, and the proxy server 150 transmits a specific user-specific identity claim approval transaction and the proxy server. The first proxy server signature value signed with the master private key is transmitted (S64-2). Then, at least one blockchain node 300 of the blockchain network verifies the first proxy server signature value, and if the first proxy server signature value is valid, executes a specific user smart contract to distribute a specific user-specific identity claim approval transaction. Be registered in the ledger (S65). And, at least one block chain node 300 of the blockchain network transmits a specific user-specific identity claim approval transaction ID to the proxy server 150 (S66-1), and the proxy server 150 transmits a specific user-specific identity. The claim approval transaction ID is transmitted to the specific user terminal 100 (S66-2).

Through this, in FIG. 7A, the specific user terminal 100 and the specific authentication authority server 200 paid the transaction blood, but in FIG. 7B, the proxy server 150 provides the user terminal 100 and the specific authentication authority server 200. Instead, it can be made to pay transaction blood.

In the above, the operation of registering a new specific user specific identity claim has been described, but a specific user specific identity claim previously registered can be updated by the same method. That is, if there is a previous identity claim corresponding to the specific identity to be registered, if there is a registration request for the same specific identity claim, it is registered in the distributed ledger, and the newly registered specific identity claim is transferred to the specific identity of a specific user. Update with the corresponding claim. In this case, a predetermined topic may be used to confirm a claim corresponding to a specific identity, and when a new claim is registered for the same topic, it may be recognized that the user identity claim is updated. However, the present invention is not limited thereto, and a claim may be performed by defining a function of each claim, such as a registration claim, an update claim, and a deletion claim.

A method of deleting a specific identity claim in a method of managing user identity using a block chain network according to an embodiment of the present invention will be described with reference to FIG. 8A.

In a state in which a specific user-specific identity claim is registered by the method as in FIG. 7A, the specific user terminal 100 deletes a specific user-specific identity claim to the blockchain network in order to delete a specific user-specific identity claim according to the user's selection. The request transaction is transmitted (S81). At this time, the specific user-specific identity claim deletion request transaction includes the specific user-specific identity deletion claim data using the specific user-specific identity claim ID, and the first specific user signature value signed by the specific user-specific identity deletion claim data with a specific user master private key. Can include.

Then, at least one blockchain node 300 of the blockchain network verifies the first specific user signature value and, if the first specific user signature value is valid, executes a specific user smart contract to respond to a specific user specific identity claim ID. A transaction for deleting a specific user specific identity claim to delete a specific user specific identity claim to be registered in the distributed ledger (S82) is made.

In addition, at least one blockchain node 300 of the blockchain network transmits (S83) a transaction ID for deleting a specific user specific identity claim to a specific user terminal 100, and the specific user terminal 100 has a specific user specific identity. Using the claim deletion transaction ID, it is checked whether a specific user-specific identity claim to be deleted has been deleted from the distributed ledger (S84) (S85).

In addition, referring to FIG. 8B, the specific user terminal 100 transmits a transaction requesting deletion of a specific user-specific identity claim to the proxy server 150 (S81-1), and the proxy server 150 deletes a specific user-specific identity claim. The request transaction and the proxy server signature value signed with the proxy server master private key are transmitted to the blockchain network (S81-2).

Then, at least one blockchain node 300 of the blockchain network verifies the proxy server signature value (S81-3), and if the proxy server signature value is valid, the first specific identity claim included in the transaction requesting deletion of a specific user-specific identity After verifying the user signature value, a transaction for deleting a specific user specific identity claim to delete a specific user specific identity claim is registered in the distributed ledger (S82).

In addition, at least one block chain node 300 of the blockchain network transmits a specific user specific identity claim deletion transaction ID to the proxy server 150 (S83-1), and the proxy server 150 makes a specific user specific identity claim. The deletion transaction ID is transmitted to the specific user terminal 100 (S83-2).

As a result, in FIG. 8A, the user terminal 100 pays the transaction blood, but in FIG. 8B, the proxy server 150 may pay the transaction blood on behalf of the user terminal 100.

Another method of deleting a specific identity claim in the method of managing user identity using a blockchain network according to an embodiment of the present invention will be described with reference to FIG. 9A.

In a state in which a specific user-specific identity claim is registered by the method as in Fig. 7a, the specific certification authority server 200 transmits a specific user-specific identity claim deletion request transaction to the blockchain network in order to delete the specific user-specific identity claim. (S91) Do it. At this time, the transaction requesting deletion of a specific user-specific identity claim is signed by a third specific certification authority that signs the specific user-specific identity deletion claim data and the specific user-specific identity deletion claim data with a specific certification authority master private key using a specific user-specific identity claim ID. May contain values.

Then, at least one block chain node 300 of the blockchain network verifies the signature value of the third specific authentication authority, and if the signature value of the third specific authentication authority is valid, executes a specific user smart contract and executes a specific user specific identity claim ID. A specific user-specific identity claim deletion transaction to delete a specific user-specific identity claim corresponding to is registered in the distributed ledger.

And, at least one block chain node 300 of the blockchain network transmits (S92) a transaction ID for deleting a specific user specific identity claim to a specific certification authority server 200, and the specific certification authority server 200 is a specific user Using the specific identity claim deletion transaction ID, a specific user specific identity deletion claim ID, which is the ID of the specific user specific identity deletion claim registered in the distributed ledger, is checked (S93) (S94).

Thereafter, the specific certification authority server 200 transmits the specific user specific identity deletion claim ID to the specific user terminal 100 (S95).

Then, the specific user terminal 100 transmits the specific user specific identity claim deletion approval transaction to the blockchain network (S96). At this time, the specific user-specific identity claim deletion approval transaction may include specific user-specific identity claim deletion approval data and a second specific user signature value signed with a specific user master private key, and the specific user-specific identity claim deletion approval data It may include the user-specific identity deletion claim ID and approval information for the specific user-specific identity deletion claim.

And, at least one block chain node 300 of the blockchain network verifies the second specific user signature value and, if the second specific user signature value is valid, executes a specific user smart contract to delete a specific user specific identity claim. It is deleted (S97) from this distributed ledger.

Thereafter, at least one block chain node 300 of the blockchain network transmits (S98) the transaction ID for approval to delete a specific user specific identity claim to the specific user terminal 100, and the specific user terminal 100 Using the identity claim deletion approval transaction ID, it is checked whether the specific user-specific identity claim to be deleted has been deleted from the distributed ledger (S99) (S100).

In addition, referring to FIG. 9B, a specific certification authority server 200 transmits a request transaction for deleting a specific user-specific identity claim to the proxy server 150 (S91-1), and the proxy server 150 deletes a specific user-specific identity. The request transaction and the proxy server signature value signed with the proxy server master private key are transmitted to the blockchain network (S91-2).

Then, at least one blockchain node 300 of the blockchain network verifies the proxy server signature value and, if the proxy server signature value is valid, executes a specific user smart contract to specify a specific user corresponding to a specific user specific identity claim ID. A specific user-specific identity claim deletion transaction to delete an identity claim is registered in the distributed ledger.

In addition, at least one block chain node 300 of the blockchain network transmits a specific user specific identity claim deletion transaction ID to the proxy server 150 (S92-1), and the proxy server 150 makes a specific user specific identity claim. The deletion transaction ID is transmitted to the specific certification authority server 200 (S92-2).

In addition, the specific user terminal 100 transmits a specific user-specific identity deletion approval transaction to the proxy server 150 (S96-1), and the proxy server 150 transmits a specific user-specific identity claim deletion approval transaction to the blockchain network. Send to (S96-2).

In addition, at least one block chain node 300 of the blockchain network transmits a specific user-specific identity claim deletion approval transaction ID to the proxy server 150 (S98-1), and the proxy server 150 is The identity claim deletion approval transaction ID is transmitted to the specific user terminal 100 (S98-2).

Through this, in FIG. 9A, the specific user terminal 100 and the specific authentication authority server 200 paid the transaction blood, but in FIG. 9B, the proxy server 150 provides the user terminal 100 and the specific authentication authority server 200. Instead, it can be made to pay transaction blood.

In the case of creating self-claims and identity claims by the above method, the achievement level corresponding to each claim can be provided to the subject creating the claim, the owner of the claim, the subject using the claim, etc., and compensation corresponding to the achievement level Can provide. At this time, the achievement status and reward payment status can be managed through the blockchain network by a method similar to that described above. In other words, each achievement obtained by the subject is registered in the blockchain network in a manner similar to self-claim, and specific rewards desired for compensation among achievements can be registered and managed in the blockchain network in a manner similar to the identity claim.

A method of authenticating a user using a user identity based on a blockchain network according to an embodiment of the present invention will be described with reference to FIGS. 10A and 10B.

First, a method of performing sign up using a user identity based on a blockchain network will be described with reference to FIG. 10A.

Claims to create claims for users' identities Smart contracts are registered in the distributed ledger of the blockchain network composed of multiple blockchain nodes as user smart contracts in response to each user. Addresses on the distributed ledger for contracts are managed as IDs of users, and at least one user self-claims and user identities that contain user-specific values that process user identities corresponding to each of the users. In a state in which user identity claims authenticated and registered by the certification authority and user addresses corresponding to the user key are registered and managed on the distributed ledger, the user signs up to the service providing server 500 through the service using terminal 110 Upon requesting (S111), the service providing server 500 requests user specific information necessary for sign-up to the service using terminal 110 (S112). At this time, the service using terminal 110 can access the service providing server 500 through an application or the web, and the service providing server 500 is a callback URL or URL to request for user specific information. By adding a scheme, access information to the service providing server 500 may be provided.

Then, the service using terminal 110 transmits a request for user specific information from the service providing server 500 to the user terminal 100 (S113). In this case, the service using terminal 110 may be the same terminal as the user terminal 100 or different terminals.

Then, the user terminal 100 checks the user specific information requested from the service providing server 500 through the user identity management app (S114). At this time, the user terminal 100 checks whether user-specific identity claims of user-specific identities corresponding to the requested user-specific information are registered on the distributed ledger of the blockchain network.

Then, the user terminal 100 provides the requested user specific information to the service providing terminal 500 (S115).

In this case, when the user-specific identity claims corresponding to the requested user-specific information are registered in the distributed ledger, the user terminal 100 may have a specific user ID, user-specific identities corresponding to specific user-specific information, and , To the service providing server 500, specific user claim information including specific claim signature values signed by each user specific identities with a private key of a specific certification authority may be provided.

Then, the service providing server 500 checks the specific user specific identity claim registered in the distributed ledger in response to the claim types of the user specific identities by referring to the specific user ID (S116) (S117), and The information is authenticated (S118).

In this case, the service providing server 500 may verify a specific user specific identity using a specific user specific identity claim. In other words, it is checked whether a specific certification authority has authenticated a specific claim type corresponding to a specific user specific identity through a specific user specific identity claim obtained from the distributed ledger, and a specific certification authority authenticated by referring to a specific claim signature value. Identify a specific user-specific identity corresponding to the claim.

Meanwhile, the service providing server 500 executes a digital signature verification module registered in the distributed ledger to obtain a specific certification authority public key corresponding to a specific certification authority private key by referring to a specific claim signature value and a specific user specific identity, or It is possible to obtain a specific certification authority public key corresponding to a specific certification authority private key from a specific certification authority server, and use the specific certification authority public key to check whether the data to be compared and the specific user specific identity matched from the specific claim signature value. By verifying, a specific user-specific identity can be authenticated as valid.

In addition, the service providing server 500 verifies a specific user specific value and a specific user specific identity, and then checks the certification authority that generated a specific user specific identity claim. If the certification authority is determined to be reliable, the specific user specific identity Can be authenticated as valid.

Thereafter, when the specific user claim information is authenticated, the service providing server 500 allows a specific user to sign up (S119). For example, the service providing server 500 may register a specific user ID as the user ID of the service providing server 500.

On the other hand, when the user-specific identity claims corresponding to the requested user-specific information are not registered in the distributed ledger, the user terminal 100 is a specific user ID, a specific user specific identity, a specific user self-claim ID, and a specific user. By providing the service providing server 500 with specific user claim information including a specific value, specific user specific value generation information using a specific user specific identity, and a specific user signature value signed by a specific user specific value with a specific user private key Can give.

Then, the service providing server 500 checks the user signature value, and then checks the specific user self claim registered in the distributed ledger by referring to the specific user self claim ID (S116) (S117), and makes the confirmed specific user self claim. With reference, the specific user claim information may be authenticated, and authentication (S118) by checking whether the specific user specific identity matches the characteristic information of a specific user, and then sign-up of a specific user may be allowed (S1119). In this case, verifying and authenticating whether a specific user specific identity matches the characteristic information of a specific user may be authenticating a specific user specific identity in the service providing server 500 itself. For example, if a specific identity is a phone number, general phone number authentication can be performed to check whether the corresponding phone number matches the phone number of a specific user.

In addition, the service providing server 500 may register (S120) a specific user specific identity claim for a specific identity authenticated by the method as in FIG. 7A in the distributed ledger of the blockchain network.

That is, the service providing server 500 refers to the authenticated specific user-specific identity, the service providing server ID corresponding to the service providing server, at least a specific claim type corresponding to a specific user-specific identity, and a specific user ID and specific claim. Provides a second service in which a specific user-specific identity claim including the first service providing server signature value signed with the type of the private key of the service providing server 500 is created, and a specific user-specific identity claim is signed with the private key of the service providing server Sends a transaction requesting registration of a specific user-specific identity claim including the server signature value to the blockchain network. In this case, the specific user-specific identity claim may include authentication verification data such as a time stamp, and the first service providing server signature value may be signed by adding authentication verification data such as a time stamp. Then, at least one blockchain node 300 of the blockchain network verifies the second service providing server signature value and, if the second service providing server signature value is valid, executes a specific user smart contract to claim a specific user specific identity claim. You will be registered on the distributed ledger. In addition, a specific claim signature value signed by a specific user specific identity with the private key of the service providing server may be transmitted to and stored in the user terminal 100.

Next, a method of using a service using a user identity based on a blockchain network will be described with reference to FIG. 10B.

Claims to create claims for users' identities Smart contracts are registered in the distributed ledger of the blockchain network composed of multiple blockchain nodes as user smart contracts in response to each user. Addresses on the distributed ledger for contracts are managed as IDs of users, and at least one user self-claims and user identities that contain user-specific values that process user identities corresponding to each of the users. In a state in which user identity claims authenticated and registered by the certification authority and user addresses corresponding to the user key are registered and managed on the distributed ledger, the user requests a service to the service providing server 500 through the service using terminal 110 In S131, the service providing server 500 requests a specific user signature value for providing a service to the service using terminal 110 (S132). At this time, the service using terminal 110 may access the service providing server 500 through an application or web, and the service providing server 500 may respond to a request for a specific user's signature value with a callback URL or By adding a URL scheme, access information to the service providing server 500 may be provided.

In addition, the service using terminal 110 transmits a request for a user signature value from the service providing server 500 to the user terminal 100 (S133). In this case, the service using terminal 110 may be the same terminal as the user terminal 100 or different terminals.

Then, the user terminal 100 generates a specific user signature value through the user identity management app (S134).

In this case, the user terminal 100 checks data corresponding to a request for a specific user signature value, and may generate a specific user signature value that signs the data with a specific user private key.

In addition, the data is generated by the service providing server 500 and may be included in the request information for a specific user signature value, data on transaction information, data on information that the user must confirm in order to provide the service, and signature values The nonce data for confirmation may be included, but the present disclosure is not limited thereto, and all data generated by the service providing server 500 in connection with service provision may be included.

In addition, the data may be generated by the user terminal 100 in response to information requested from the service providing server 500, and data on transaction information required for service use, a specific user identity for login, a password, etc. The data on the nonce for use in verifying the signature value, and the like may be included, but the present invention is not limited thereto, and all data generated by the user terminal 100 in connection with service use may be included.

Thereafter, the user terminal 100 transmits a specific user ID, a specific user address, data, and a specific user signature value to the service providing server 500 (S135).

Then, the service providing server 500 checks whether the specific user signature value is valid (S136), and if the specific user signature value is valid, checks the comparison target user address registered in the distributed ledger of the blockchain network by referring to the specific user ID. After performing (S137) (S138) and checking whether a specific user address is valid by referring to the comparison target user address (S139), the requested service may be provided to the service requesting terminal 100 (S140).

At this time, when the data transmitted from the user terminal 100 includes a specific user specific identity and a specific user specific identity claim ID, the service providing server 500 refers to the specific user specific identity claim ID, and the distributed ledger of the blockchain network In order to obtain a specific user-specific identity claim, you can verify a specific user-specific identity by referring to the specific user-specific identity claim.

In addition, the service providing server 500 executes a digital signature verification module registered in the distributed ledger to obtain a specific user public key corresponding to a specific user private key by referring to a specific user signature value and data, or the user terminal 100 A specific user public key can be obtained by adding and transmitting a specific user public key corresponding to this specific user private key, and using a specific user public key, it is checked whether the data to be compared and the data to be compared from the specific user signature value match. By doing so, you can check whether a specific user signature value is valid.

Further, the embodiments according to the present invention described above may be implemented in the form of program instructions that can be executed through various computer components and recorded in a computer-readable recording medium. The computer-readable recording medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded in the computer-readable recording medium may be specially designed and configured for the present invention, or may be known and usable to those skilled in the computer software field. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical recording media such as CD-ROMs and DVDs, magnetic-optical media such as floptical disks. media), and a hardware device specially configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of the program instructions include not only machine language codes such as those produced by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like. The hardware device may be configured to operate as one or more software modules to perform processing according to the present invention, and vice versa.

In the above, the present invention has been described by specific matters such as specific elements and limited embodiments and drawings, but this is provided only to help a more general understanding of the present invention, and the present invention is not limited to the above embodiments. , Anyone with ordinary knowledge in the technical field to which the present invention pertains can make various modifications and variations from these descriptions.

Therefore, the spirit of the present invention is limited to the above-described embodiments and should not be defined, and all modifications that are equally or equivalent to the claims as well as the claims to be described later fall within the scope of the spirit of the present invention. I would say.

100: user terminal,
150: proxy server,
200: certification authority server,
300: Blockchain node,
500: service providing server

Claims (22)

In the method of managing the user's identity using a blockchain network,
(a) Claims smart contracts that create claims for the identities of users and certification authorities. Multiple blockchain nodes with user smart contracts and certification authority smart contracts, respectively, in response to users and certification authorities. Registered in the distributed ledger of the blockchain network configured by the user, and the addresses on the distributed ledger for the user smart contracts and the authentication authority smart contracts are managed by the IDs of the users and the authentication authorities. , (i-1) a specific user ID from a specific user terminal, a specific user specific identity for authentication, and a specific user specific identity claim registration request including a specific claim type corresponding to the specific user specific identity, or ( ii-1) In response to a request for registering a specific user specific identity claim including the specific user ID from the specific user terminal and the specific claim type corresponding to the specific user specific identity, a specific user from a specific certification authority server Specific identity claim-The specific user specific identity claim is generated by the specific certification authority server, and (i-2) the specific certification authority server verifies the specific user specific identity or (ii-2) the specific certification authority server After checking the specific user specific identity corresponding to the specific claim type among the identities of the specific user previously stored, the specific certification authority ID corresponding to the specific certification authority server, the specific claim type corresponding to the specific user specific identity, And a first specific certification authority signature value signed with the specific user ID and the specific claim type with the private key of the specific certification authority server-and the specific user-specific identity claim to the master private of the specific certification authority When a specific user-specific identity claim registration request transaction including a second specific certification authority signature value signed with a key is obtained, the At least one blockchain node verifies the second specific authentication authority signature value and, if the second specific authentication authority signature value is valid, executes the specific user smart contract and sends the specific user specific identity claim to the distributed ledger. Allowing registration; And
(b) The at least one blockchain node registers the specific user specific identity claim registration transaction ID corresponding to the specific user specific identity claim registration transaction in the distributed ledger to register the specific user specific identity claim to the specific certification authority server By transmitting to, the specific certification authority server uses the specific user specific identity claim registration transaction ID to obtain a specific user specific identity claim ID corresponding to the specific user specific identity claim registered in the distributed ledger, and at least the Send a specific claim signature value signed with a specific user specific identity with the private key of the specific certification authority and the specific user specific identity claim ID to the specific user terminal, so that the specific user terminal uses the specific user specific identity claim ID Allowing confirmation of the specific user-specific identity claim registered in the distributed ledger;
How to include. The method of claim 1,
(c) The specific user-specific identity deletion claim data and the specific user-specific identity deletion claim data using the specific user-specific identity claim ID from the specific user terminal are signed with the specific user master private key. When a transaction requesting deletion of a specific user-specific identity claim, including, is obtained, the at least one blockchain node verifies the first specific user signature value and, if the first specific user signature value is valid, establishes the specific user smart contract. Executing a specific user specific identity claim deletion transaction for deleting the specific user specific identity claim corresponding to the specific user specific identity claim ID registered in the distributed ledger;
The method further comprising a. The method of claim 1,
(d) a third specific certification authority that signs the specific user specific identity deletion claim data and the specific user specific identity deletion claim data using the specific user specific identity claim ID from the specific certification authority server with the specific certification authority master private key When a specific user-specific identity claim deletion request transaction including a signature value is obtained, the at least one blockchain node verifies the third specific authentication authority signature value and the third specific authentication authority signature value is valid, the Executing a specific user smart contract so that a specific user specific identity claim deletion transaction for deleting the specific user specific identity claim corresponding to the specific user specific identity claim ID is registered in the distributed ledger;
The method further comprising a. The method of claim 3,
The at least one blockchain node transmits a specific user specific identity deletion claim ID, which is the ID of the specific user specific identity deletion claim registered in the distributed ledger, to the specific certification authority server in response to a user specific identity claim deletion transaction. , Causes the specific certification authority server to transmit the specific user-specific identity deletion claim ID to the specific user terminal, and approve the specific user-specific identity deletion claim ID and the specific user-specific identity deletion claim from the specific user terminal A specific user-specific identity claim deletion approval transaction is obtained that includes a specific user-specific identity deletion approval data including information and a second specific user signature value signed by the specific user-specific identity claim deletion approval data with the specific user master private key If so, the second specific user signature value is verified, and if the second specific user signature value is valid, the specific user smart contract is executed so that the specific user specific identity claim is deleted from the distributed ledger. . The method of claim 1,
(e) The specific user specific identity claim ID and the specific user from the specific user terminal by referring to the specific user specific identity claim ID corresponding to the specific user specific identity claim registered in the distributed ledger from the specific certification authority server A specific user-specific identity claim approval transaction including specific user-specific identity approval data including approval information for a specific identity claim, and a third specific user signature value that signs the specific user-specific identity approval data with the specific user master private key When is obtained, the at least one blockchain node verifies the third specific user signature value and, when the third specific user signature value is valid, executes the specific user smart contract to approve the specific user specific identity claim transaction Allowing this to be registered in the distributed ledger;
The method further comprising a. The method of claim 5,
In step (e),
The at least one blockchain node obtains the specific user-specific identity claim approval transaction from a proxy server, and performs the specific user-specific identity claim approval transaction and the specific user-specific identity claim approval transaction from the proxy server by the proxy server. A method comprising: acquiring a first proxy server signature value signed with a proxy server master private key, verifying the first proxy server signature value, and executing the specific user smart contract when the first proxy server signature value is valid . The method of claim 1,
In step (a),
The at least one blockchain node transmits a list of the authentication authorities registered in the distributed ledger to the specific user terminal in response to a list request of the authentication authorities from the specific user terminal, so that the specific user terminal authenticates A method, characterized in that it is possible to select a specific certification authority to perform authentication for the specific user specific identity among institutions. The method of claim 1,
In step (b),
The at least one blockchain node executes a digital signature verification module registered in the distributed ledger, and refers to the second specific certification authority signature value and the specific user specific identity claim to correspond to the specific certification authority master private key. The second is to obtain a specific certification authority master public key, and by using the specific certification authority master public key, it is checked whether the comparison target data checked from the second specific certification authority signature value and the specific user specific identity claim match. A method comprising verifying whether a signature value of a specific certification authority is valid. The method of claim 1,
In step (b),
The specific user specific identity claim registration request transaction includes a specific certification authority master public key corresponding to the specific certification authority master private key,
The at least one blockchain node uses the specific certification authority master public key to check whether the comparison target data checked from the second specific certification authority signature value and the specific user specific identity claim match the second specific authentication. A method, characterized in that it verifies whether the agency signature value is valid. The method of claim 1,
In step (b),
The at least one blockchain node, (i) obtains the specific user specific identity claim registration request transaction from a proxy server, but the specific user specific identity claim registration request transaction and the specific user specific identity claim registration request from the proxy server Obtaining a second proxy server signature value that signed the transaction with the proxy server master private key, and verifying the second proxy server signature value to execute the specific user smart contract if the second proxy server signature value is valid, (ii ) By transmitting the specific user specific identity claim registration transaction ID to the proxy server, the proxy server transmits the specific user specific identity claim registration transaction ID to the specific authentication authority server. The method of claim 1,
In step (a),
The specific user-specific identity claim registration request further includes a time stamp,
In step (b),
The specific user-specific identity claim further includes the time stamp,
The first specific certification authority signature value and the specific claim signature value are signed further including the time stamp. In the blockchain node of the blockchain network that manages the user's identity using the blockchain network,
A memory in which instructions for managing user identity are stored; And
A processor that manages the user identity according to the instructions stored in the memory;
Including,
The processor,
(i) Claims smart contracts that create claims for the identities of users and certification authorities are a number of blockchain nodes with user smart contracts and certification authority smart contracts, respectively, in response to users and certification authorities. Registered in the distributed ledger of the blockchain network configured by the user, and the addresses on the distributed ledger for the user smart contracts and the authentication authority smart contracts are managed by the IDs of the users and the authentication authorities. , (1-1) Respond to a request for registering a specific user specific identity claim including a specific user ID from a specific user terminal, a specific user specific identity for authentication, and a specific claim type corresponding to the specific user specific identity, or ( 2-1) In response to the specific user specific identity claim registration request including the specific user ID from the specific user terminal and the specific claim type corresponding to the specific user specific identity, a specific user is specified by a specific certification authority server Identity claim-The specific user specific identity claim is generated by the specific certification authority server, and (1-2) the specific certification authority server verifies the specific user specific identity, or (2-2) the specific certification authority server After checking a specific user specific identity corresponding to the specific claim type among the identities of a specific user previously stored, a specific certification authority ID corresponding to the specific certification authority server, at least the specific claim type corresponding to the specific user specific identity, And a first specific certification authority signature value signed with the specific user ID and the specific claim type with the private key of the specific certification authority server-and the specific user-specific identity claim to the master private of the specific certification authority When a specific user-specific identity claim registration request transaction including a second specific certification authority signature value signed with a key is obtained, The process of verifying the signature value of the second specific authentication authority and, if the signature value of the second specific authentication authority is valid, executing the specific user smart contract so that the specific user specific identity claim is registered in the distributed ledger, and (ii ) By sending the specific user specific identity claim registration transaction ID corresponding to the specific user specific identity claim registration transaction to register the specific user specific identity claim on the distributed ledger to the specific certification authority server, the specific certification authority server Using the specific user specific identity claim registration transaction ID, a specific user specific identity claim ID corresponding to the specific user specific identity claim registered in the distributed ledger is obtained, and at least the specific user specific identity is private to the specific authentication authority. The specific claim signature value signed with a key and the specific user-specific identity claim ID are transmitted to the specific user terminal, so that the specific user terminal uses the specific user-specific identity claim ID to specify the specific user registered in the distributed ledger. Blockchain node, characterized in that it performs a process that enables identification claims. The method of claim 12,
The above process,
(iii) The specific user-specific identity deletion claim data and the specific user-specific identity deletion claim data using the specific user-specific identity claim ID from the specific user terminal are signed with the specific user master private key. When a transaction for requesting deletion of a specific user-specific identity claim, including, is obtained, the first specific user signature value is verified, and if the first specific user signature value is valid, the specific user specific identity claim ID is executed by executing the specific user smart contract Blockchain node, characterized in that further performing a process of registering a specific user specific identity claim deletion transaction for deleting the specific user specific identity claim corresponding to the distributed ledger. The method of claim 12,
The processor,
(iv) A third specific certification authority that signs the specific user specific identity deletion claim data and the specific user specific identity deletion claim data using the specific user specific identity claim ID from the specific certification authority server with the specific certification authority master private key When a specific user-specific identity claim deletion request transaction including a signature value is obtained, the third specific authentication authority signature value is verified, and if the third specific authentication authority signature value is valid, the specific user smart contract is executed and the specified A blockchain node, characterized in that further performing a process of registering a specific user specific identity claim deletion transaction in the distributed ledger to delete the specific user specific identity claim corresponding to the user specific identity claim ID. The method of claim 14,
The process includes transmitting a specific user specific identity deletion claim ID, which is the ID of the specific user specific identity deletion claim registered in the distributed ledger, to the specific certification authority server in response to a user specific identity claim deletion transaction. Specifies that the server transmits the specific user-specific identity deletion claim ID to the specific user terminal, and includes approval information for the specific user-specific identity deletion claim ID and the specific user-specific identity deletion claim from the specific user terminal. When a specific user-specific identity claim deletion approval transaction including user-specific identity deletion approval data and a second specific user signature value signed with the specific user-specific identity claim deletion approval data with the specific user master private key is obtained, the second A blockchain node, characterized in that when the second specific user signature value is valid by verifying a specific user signature value, the specific user specific identity claim is deleted from the distributed ledger by executing the specific user smart contract. The method of claim 12,
The processor,
(v) The specific user specific identity claim ID and the specific user from the specific user terminal by referring to the specific user specific identity claim ID corresponding to the specific user specific identity claim registered in the distributed ledger from the specific certification authority server A specific user-specific identity claim approval transaction including specific user-specific identity approval data including approval information for a specific identity claim, and a third specific user signature value that signs the specific user-specific identity approval data with the specific user master private key When is obtained, the process of verifying the third specific user signature value and, if the third specific user signature value is valid, executing the specific user smart contract so that the specific user specific identity claim approval transaction is registered in the distributed ledger Blockchain node, characterized in that to further perform. The method of claim 16,
The processor,
In the (v) process, the specific user-specific identity claim approval transaction is obtained from a proxy server, and the specific user-specific identity claim approval transaction and the specific user-specific identity claim approval transaction are transferred from the proxy server to the proxy server of the proxy server. A blockchain node, comprising: acquiring a first proxy server signature value signed with a master private key, verifying the first proxy server signature value, and executing the specific user smart contract when the first proxy server signature value is valid . The method of claim 12,
The processor,
In the process (i), the specific user terminal transmits a list of the authentication authorities registered in the distributed ledger to the specific user terminal in response to a list request of the authentication authorities from the specific user terminal. Blockchain node, characterized in that it is possible to select a specific certification authority to perform authentication for the specific user specific identity. The method of claim 12,
The processor,
In the process (ii), by executing the digital signature verification module registered in the distributed ledger, a specific authentication corresponding to the specific authentication authority master private key by referring to the second specific authentication authority signature value and the specific user specific identity claim The second specific authentication is performed by acquiring an authority master public key, and checking whether the comparison target data checked from the second specific certificate authority signature value and the specific user specific identity claim match using the specific certificate authority master public key. Blockchain node, characterized in that it verifies whether the agency signature value is valid. The method of claim 12,
The processor,
In the above (ii) process,
The specific user specific identity claim registration request transaction includes a specific certification authority master public key corresponding to the specific certification authority master private key,
Verifying whether the second specific certification authority signature value is valid by checking whether the comparison target data checked from the second specific certification authority signature value and the specific user specific identity claim match using the specific certification authority master public key Blockchain node characterized by. The method of claim 12,
The processor,
In the (ii) process, (ii-1) the specific user specific identity claim registration request transaction is obtained from a proxy server, but the specific user specific identity claim registration request transaction and the specific user specific identity claim registration request from the proxy server Obtaining a second proxy server signature value that signed the transaction with the proxy server master private key, and verifying the second proxy server signature value to execute the specific user smart contract if the second proxy server signature value is valid, (ii -2) By transmitting the specific user-specific identity claim registration transaction ID to the proxy server, the proxy server transmits the specific user-specific identity claim registration transaction ID to the specific authentication authority server. The method of claim 12,
In the above (i) process,
The specific user-specific identity claim registration request further includes a time stamp,
In step (ii),
The specific user-specific identity claim further includes the time stamp,
The first specific certification authority signature value and the specific claim signature value are signed by further including the time stamp.

Images