TWI661331B - System and method for identity verification and privacy protection in public blockchain - Google Patents

Abstract

The invention proposes a system and method for verifying the identity of a blockchain and protecting privacy based on a credential trust architecture. The client device sends registration information. This registration information includes the certificate and the blockchain address, and the certificate records the identity information and the public key. The identity registration server verifies the registration information and verifies that the status of this certificate is normal through a public key certificate authority. If normal, the identity registration server registers the registration information with the blockchain smart contract to publish it to the public blockchain. In this way, the blockchain smart contract verifies the identity based on the voucher and the blockchain address, which can maintain the open and anonymous characteristics of the blockchain transaction information, and can also be associated with the user's real identity when necessary to prevent similar bits Financial regulatory issues arising from currency payments.

Description

System and method for verifying identity and protecting privacy in public anonymous environment

The present invention relates to an identity verification technology, and more particularly, to a system and method for verifying identity and protecting privacy in a publicly anonymous environment.

The authentication and privacy protection technologies used in blockchain systems are mostly based on the authority control method on the network architecture, that is, the establishment of private or alliance blockchains, and only nodes with specific permissions are allowed to connect, trade, Verification or mining operations. The closed chain structure can protect the privacy information of system users, and can also track the user's identity to meet the requirements of several regulations. Therefore, the financial industry in various countries tend to apply the structure of private or alliance chains. However, such a network structure that restricts access permissions not only sacrifices the open and transparent nature of the blockchain, but also makes it difficult for the system to expand its application range, and it cannot prevent users' privacy and confidential information from being leaked out by users in the chain. Not perfect.

US Patent Bulletin No. US9298806 B1 "System and method for analyzing transactions in a distributed ledger" is used to solve the problem of identity verification in public blockchains. This patent case applies the method of data mining and analyzes the big data of the user's identity in all the transaction records of the open blockchain. The group category is established by the correlation of the user address in various transaction behaviors. , And infer the user ’s possible identity to achieve verification. However, in addition to consuming a large amount of computing resources to analyze the transaction behavior of each address, the identity verification it can achieve is also a speculation of probability, and it is difficult to confirm the user's true identity.

And U.S. Patent Publication No. US9436923 B1 "Tracking unitization occurring in a supply chain" uses the key pair of asymmetric encryption algorithm to verify the identity of the blockchain user, and extends the application of digital signatures and data encryption to the resources of the supply chain Management to protect private information and authenticate identity in a decentralized network environment. However, this patent case is difficult to link to the true identity of the user, and the problem of identity verification has not been fully handled in the anonymous environment of the open blockchain.

It can be seen that there are still many shortcomings in the above-mentioned conventional techniques, and they are not a good designer, and need to be improved.

In view of this, the present invention provides a system and method for verifying identity and protecting privacy in a publicly anonymous environment, which can maintain the open and anonymous characteristics of the blockchain and also verify the user's true identity.

In order to achieve the above-mentioned object of the invention, the present invention proposes a method for verifying identity and protecting privacy in a public anonymous environment, which is suitable for an environment where a blockchain is public. This method includes the following steps. Obtain registration information and verify it. The registration information includes the certificate and the blockchain address, and the certificate records the identity information and the public key. Confirm whether the status of the voucher is normal. If the status of this certificate is normal, then this registration information is registered with the blockchain smart contract to be published to the public blockchain.

On the other hand, the present invention proposes a system for verifying identity and protecting privacy in a publicly anonymous environment, which is suitable for verifying identity in an environment of public blockchain. This system includes client devices, public key certificate authorities, blockchain smart contracts, and identity registration servers. The client device sends registration information. This registration information includes the certificate and the blockchain address, and the certificate records the identity information and the public key. Public key certificate authority provides certificate status information. The identity registration server verifies the registration information and verifies that the status of the certificate is normal through a public key certificate authority. If the status of the certificate is normal, the identity registration server registers the registration information with the blockchain smart contract to publish it to the public blockchain.

In this way, in the application phase, the application system can confirm the true identity of a user by using the query verification service provided by the embodiment of the invention in the open blockchain. Therefore, in an anonymous environment where the blockchain is disclosed, the embodiments of the present invention can perfectly handle the issue of identity verification.

In order to make the above features and advantages of the present invention more comprehensible, embodiments are hereinafter described in detail with reference to the accompanying drawings.

FIG. 1 is a schematic diagram illustrating a system for verifying identity and protecting privacy in a public anonymous environment according to an embodiment of the present invention. The identity verification system 1 includes one or more client devices 100, a public key certificate authority 200, an identity registration server 300, a blockchain application system 400, and a blockchain smart contract 503.

The client device 100 may be various types of networkable electronic devices such as a desktop computer, a notebook computer, a smart phone, and a tablet computer. The client device 100 records related files or information such as an identity registration client module 104 program, a certificate 501, and a shared key.

The public key certificate authority 200 is an organization that issues and verifies certificates. The certificate status check module 322 uses online certificate status protocol (OCSP) or certificate revocation list (CRL) provided by the public key infrastructure (PKI) as the certificate Status check operation. The public key certificate authority 200 issues and advertises the certificate 501, in which the public key is linked to the personal identification information (ie, the certificate 501 records the identity information and the public key).

The identity registration server 300 may be a server, a workstation, a desktop computer, a notebook computer, or any other type of networkable electronic device. The identity registration server 300 includes programs such as an identity registration server-side module 321, a certificate status check module 322, a blockchain interface module 323, a regularly updated status module 324, certificate registration data, a shared key, and a blockchain Account information and other related files or information. It should be noted that the operation of each module will be described in detail in the subsequent embodiments.

The blockchain application system 400 belongs to a system using a decentralized blockchain network, and the public blockchain 502 means that all participant terminals can access all data and issue transactions. The embodiment of the present invention provides functions such as identity registration, status update, and identity verification on the open blockchain 502 through the blockchain smart contract 503.

In order to facilitate the understanding of the operation flow of the embodiments of the present invention, a number of embodiments will be described in detail below to describe the method of verifying identity in an environment where the blockchain 502 is disclosed in the embodiments of the present invention. FIG. 2 is a flowchart illustrating a registration phase according to an embodiment of the present invention. Referring to FIG. 2, the method in this embodiment is applicable to each device in the identity verification system 1 in FIG. 1. In the following, the method according to the embodiment of the present invention will be described with the components and modules of the client device 100 and the identity registration server 300. Each process of the method can be adjusted according to the implementation situation, and is not limited to this.

The identity registration client module 104 of the client device 100 first forms the information required for the registration request with the blockchain address to be registered, and then transmits the registration request to the identity registration server 300 via the Internet 504 (step S201). The identity registration client module 104 needs to include a trusted network element, such as a properly signed Java applet or ActiveX element. During registration, the identity registration server module 321 and the identity registration client module 104 perform related procedures of the Challenge-response protocol. After the identity registration server module 321 receives this registration request (step S202), it generates a random random number (code) R and calculates the server response code (step S203), and then responds to the registration request (this response includes the server response code) (Step S204). The calculation method of the server response code SR is: SR = Hash (Address, Key) . The identity registration server module 321 is obtained by performing a hash calculation using the received blockchain address Address plus the shared key Key . Key The value is a shared key built in the identity registration server and the client modules 321, 104.

After the identity registration client module 104 obtains the response, it needs to verify the response information (step S205). It calculates whether the server-side response code SR is equal to Hash (Address, Key) to verify the server-side response code. After the server response code is verified, the user is allowed to select the certificate 501 to be registered (for example, conforming to the X.509 standard) and activate his private key (step S206), then assemble the registration information of the certificate 501 and perform digital signature (Step S207). The registration information of this certificate 501 includes, but is not limited to, a blockchain address, a certificate 501, a client response code, and a digital signature. The algorithm of the client response code CR is: CR = Hash (R, Key) , which is obtained by using the random random number R received plus the shared key for hash calculation. The client device 100 then transmits the registration information of the certificate 501 to the identity registration server 300. After the identity registration server module 321 receives the registration information of the certificate 501, it needs to verify the client response code and digital signature in the registration information (step S209) (for example, the client response code CR must be equal to Hash (R, Key) ), And the digital signature is verified with the public key in certificate 501. Both of these checks pass the verification process of entering the voucher status later (step S210), otherwise an error message is returned (to the client device 100) and the registration process is ended (step S213). The certificate status check module 322 is connected to the public key certificate authority 200 to confirm whether the status of the certificate 501 is normal.

If the digital signature passes the inspection and the status of the certificate 501 is normal, the identity registration server module 321 records the registration information of the certificate 501 (including the certificate hash message authentication code, the certificate issuer, the certificate expiration date, the certificate status, and the corresponding User address and other information) and call the smart contract 503 through the blockchain interface module 323 to register the registration information to the public blockchain 502. The identity registration server module 321 first analyzes the certificate 501 and records the relevant registration information to the database, and then sends the message authentication code such as the certificate 501, the certificate issuer, the certificate expiration date, the certificate status and the corresponding user address When the registration information is used as an input parameter, the registration function of the blockchain smart contract 503 is called through the blockchain interface module 323. Here, in order to further protect the privacy of the user, the certificate hash message authentication code uses a keyed-hash message authentication code (HMAC) to prevent the query function of the registration information of the certificate 501 on the blockchain smart contract 503. Is used to brute force searches for related credentials. When the registration function of the blockchain smart contract 503 receives this registration information, it uses the hash message authentication code of the certificate 501, the certificate issuer, the certificate expiration date, the certificate status, the user address, etc. as registration information and publishes it to the public block. Chain 502. At the same time, the blockchain smart contract 503 also needs to establish a correspondence (e.g., a search key) corresponding to the user's blockchain address and the credential information, and a certificate hash code corresponding to the user's blockchain address. Search key. If the status check of the certificate 501 (step S210) fails or the operation of registering to the open blockchain 502 with the blockchain smart contract 503 fails (step S211), an error message is returned and the registration process is ended (step S213). The identity registration server 300 waits for the registration transaction of the blockchain smart contract 503 to be confirmed by mining on the open blockchain 502, and then returns a successful registration message (step S212) to the client device 100. The client device 100 may display the registration result message through a display unit (for example, a display screen such as an LCD, an LED, etc.) and end the registration process (step S214).

If the signature in the registration information fails the verification or the status of the certificate 501 is invalid or expired, the identity registration server module 321 returns a registration failure message to the client device 100 and ends. Registration procedure (step S213).

On the other hand, the timing update status module 324 of the identity registration server 300 regularly executes the procedure of updating the certificate status, which connects to the public key certificate authority 200 at the time set by the system to query the latest status of the registered certificate 501. This query The operation of confirming the status of the certificate 501 is achieved by using a certificate status agreement (OCSP) or a certificate revocation list (CRL) provided by the public key certificate structure. When a change in the status of the registered certificate 501 is detected, the certificate status check module 322 updates the status information of the certificate 501 to the public blockchain through the blockchain interface module 323 and the blockchain smart contract 503. Among 502.

After the registration process is successfully completed, the blockchain address is associated with the voucher, making it possible for both parties to verify the true identity in subsequent applications. For example, through the identity verification function of the blockchain smart contract 503, in response to a query operation request (e.g., application such as transaction, voting, etc.) that takes a blockchain address as a parameter, the certificate registered at this blockchain address is verified 501.

For example, FIG. 3 is a flowchart illustrating an application example of verifying identity and protecting privacy in a public anonymous environment according to an embodiment of the present invention. Suppose a scenario is an electronic voting system (i.e., a blockchain application system 400) that discloses the blockchain 502. Voters call the blockchain smart contract 503 for processing votes through the client device 100 and the blockchain application system 400. In the voting operation, the voting smart contract 503 accepts the voting request (step S301), and then calls the identity of the blockchain smart contract 503 with the voter's blockchain address 103. The identity blockchain smart contract 503 uses this blockchain address 103 to query the related information of the registered certificate 501 and returns the query result (step S303). After receiving the returned result, the voting smart contract 503 checks the registration information of the certificate 501 (step S304), and the blockchain application system 400 verifies that the information such as the issuer, expiration date, and status of the certificate 501 meets the requirements of the voting system. Identity verification requirements (for example, whether the issuer is correct, whether it has exceeded the expiration date of the certificate 501, whether the status of the certificate 501 is normally available, etc.), after the verification of the registration information is passed, check the voter's certificate hash message authentication code to confirm Whether or not the voucher 501 has been voted (step S305) can avoid the situation of multi-address invoicing. Afterwards, the voting smart contract 503 records the key hash message authentication code (HMAC) value of this certificate 501 (step S306) and registers the number of votes (step S307), and then returns a success message to complete the voting operation. On the contrary, if the verification of the registration information fails or the voucher 501 has been voted, an error message is returned and the voting process is ended (step S308).

For another example, when the blockchain application system 400 discloses financial transactions on the blockchain 502, it can use the query service of the blockchain smart contract 503 to verify that both parties to the transaction have the true identity represented by the certificate 501, so that the financial industry knows your Customer (KYC) requirements to confirm customer identity. In addition, the embodiment of the present invention can also provide verification services after the two parties of the transaction exchange the voucher 501 using other channels. Enter the hash value of the voucher 501 and the corresponding blockchain address of the user can be found out by the blockchain smart contract 503. The chain application system 400 can combine cryptographic technologies such as digital signatures and envelopes in the open blockchain 502 for more secure online transactions.

It should be noted that the certificate 501 and the blockchain address 103 registered in the embodiment of the present invention belong to a many-to-many relationship, that is, one certificate can register multiple blockchain addresses, and one blockchain Addresses can also register multiple certificates for different issuing systems. The identity verification system 1 needs to set an upper limit of the number of registrable addresses or certificates, which is checked and restricted in the process of recording certificate registration information (step S211).

Regarding the design of the blockchain smart contract 503, its authority management mechanism must ensure that the functions of registering and updating the voucher status are only performed by the contract manager, but the query function does not need to be restricted. When registering, the blockchain smart contract 503 establishes the correspondence between the registration information of the certificate 501 and the user's blockchain address, and establishes the correspondence between the certificate hash message identification code and the user's blockchain address. The blockchain smart contract 503 queries the user's blockchain address function based on the hash value of the voucher. When receiving the input parameters of the hash value of the voucher, it first calculates the key hash message authentication code (HMAC) of the voucher based on the hash value. It uses the same HMAC calculation method as the identity registration server, and then finds the corresponding blockchain address through the search key established during registration. In order to avoid the function of querying the address by the hash value of the certificate in the blockchain smart contract 503, the corresponding addresses of all the certificates are improperly queried by brute force search, which may damage the privacy of the blockchain user. The blockchain This query function of the smart contract 503 should be added with restrictions, such as: the address of the searcher must have passed the certificate registration process, the number of times that the query is allowed within a certain period of time, etc. to prevent the above-mentioned inappropriate query situation.

Features and effects

Compared with other conventional technologies, the system and method for verifying identity and protecting privacy in a public anonymous environment provided by the embodiments of the present invention have the following advantages:

Conventional technology often adopts permission control in the network architecture to build private or alliance blockchains. This sacrifices the openness, transparency, and anonymity of the blockchain. The system is not easy to expand its application scope, and it cannot prevent users' privacy and privacy. Confidential information was leaked by users in the chain. In contrast, the embodiments of the present invention can verify the true identity and protect confidentiality while maintaining the open and anonymous characteristics of the blockchain.

Compared with the technology that uses big data analysis to derive the possible identity of the user, the embodiment of the present invention does not need to consume a large amount of computing resources for transaction analysis, and can confirm the user's true identity.

The embodiment of the present invention utilizes a credential trust architecture based on the public key infrastructure to verify the user's true identity, and allows the application system to combine cryptographic technologies such as digital signatures and envelopes in the public blockchain for more secure network transactions.

Although the present invention has been disclosed as above with the examples, it is not intended to limit the present invention. Any person with ordinary knowledge in the technical field can make some modifications and retouching without departing from the spirit and scope of the present invention. The protection scope of the present invention shall be determined by the scope of the attached patent application.

1‧‧‧ Identity Verification System

100‧‧‧client device

104‧‧‧Identity Registration Client Module

200‧‧‧ Public Key Certificate Authority

300‧‧‧ Identity Registration Server

321‧‧‧ Identity Registration Server Module

322‧‧‧Voucher status check module

323‧‧‧blockchain interface module

324‧‧‧Timely update status module

400‧‧‧blockchain application system

501‧‧‧Voucher

502‧‧‧Open Blockchain

503‧‧‧blockchain smart contract

504‧‧‧Internet

S201 ~ S214, S301 ~ S308‧‧‧step

FIG. 1 is a schematic diagram illustrating a system for verifying identity and protecting privacy in a public anonymous environment according to an embodiment of the present invention; FIG. 2 is a flowchart illustrating a registration phase according to an embodiment of the present invention; FIG. 3 is an implementation according to an embodiment of the present invention The example illustrates a flow chart of an example application for verifying identity and protecting privacy in a public and anonymous environment.

Claims (10)

A method for verifying identity and protecting privacy using a public key infrastructure-based credential trust structure in a public and anonymous environment, applicable to the environment of a public blockchain, the method includes: obtaining a registration information and verifying the registration information, wherein the The registration information includes a certificate and a blockchain address, and the certificate records an identity information and a public key; confirm with a public key certificate authority whether the status of the certificate is normal; and if the status of the certificate is normal , The registration information is registered with a blockchain smart contract to be published to a public blockchain. The method according to item 1 of the scope of patent application, wherein after the step of registering the registration information to the blockchain smart contract for publishing to the public blockchain, the method further includes: when a status change of the certificate is detected , Using the blockchain smart contract to update the status of the voucher to the public blockchain. The method according to item 1 of the scope of patent application, wherein after the step of registering the registration information with the blockchain smart contract for publishing to the open blockchain, the method further includes: the blockchain smart contract establishing the registration information A correspondence relationship with the blockchain address; and in response to a query operation request using the blockchain address, verifying a certificate registered with the blockchain address. The method according to item 1 of the scope of patent application, wherein after the step of registering the registration information to the blockchain smart contract for publishing to the open blockchain, the method further includes: establishing the registered smart contract The correspondence between the key hash message authentication code of the certificate and the blockchain address; and in response to a query operation request using the hash value of the certificate, verifying the blockchain address registered in the certificate. The method according to item 1 of the scope of patent application, wherein after the step of registering the registration information with the blockchain smart contract for publishing to the open blockchain, it further comprises: checking the registered address of the blockchain address Whether the certificate-related information meets the requirements for identity verification, the request is about the issuer, expiration date, and status of the certificate; if the requirement is met, the transaction or service process continues; and if the requirement is not met, an error is returned message. A system for verifying identity and protecting privacy in a public and anonymous environment using a credential trust structure based on a public key infrastructure. The system is suitable for verifying identity in a public blockchain environment. The system includes: a client device, sending registration information, The registration information includes a certificate and a blockchain address, and the certificate records an identity information and a public key; a public key certificate authority for checking the certificate; a blockchain smart contract; and a The identity registration server verifies the registration information and verifies whether the status of the certificate is normal through the status information provided by the public key certificate authority. If the status of the certificate is normal, the registration information is for the blockchain smart contract. Register to post to a public blockchain. The system described in item 6 of the scope of patent application, wherein the identity registration server periodically checks the status information provided by the public key certificate authority through a certain time update status module, and detects the status of the registered certificate When the transaction is changed, the status of the voucher is updated to the open blockchain using the blockchain smart contract. The system described in item 6 of the scope of patent application, wherein the blockchain smart contract establishes a correspondence between the registration information and the blockchain address, and responds to a query operation request with the blockchain address to verify The certificate registered with the blockchain address. The system described in item 6 of the scope of patent application, wherein the blockchain smart contract establishes a correspondence between the key hash message authentication code of the certificate and the blockchain address, and responds with the certificate The query operation request of the hash value verifies the blockchain address registered in the certificate. The system described in item 6 of the scope of patent application, further includes: a blockchain application system that checks whether the information related to the certificate registered at the blockchain address meets the requirements for identity verification, which is related to the issue of the certificate If the requirements are met, the transaction or service process is continued; if the requirements are not met, an error message is returned.