TWI724667B - System of identity management and authorization and method thereof - Google Patents

Abstract

The invention provides a system of identity management and authorization and method thereof applied to a blockchain network that executes smart contacts, which includes a manager end, at least one business end and at least one personal end. The manager end communicatively connects to the blockchain network and announces a renewal request. Each of the at least one business end communicatively connects to the blockchain network and provides a business smart contract. Each of the at least one personal end communicatively connects to the blockchain network and updates a personal information encrypted by a personal private key. Each of the at least one personal end then decrypts the business smart contract for signing thereon, and updates the business smart contract encrypted by the personal private key with a permission key attached. The business end gets the personal information through the permission key and handles the business content written in the business smart contract.

Description

Identity management and authorization system and method

The invention relates to an identity management and authorization system, in particular to an identity management and authorization system of a blockchain smart contract that can be jointly participated by supervisors.

Nowadays, customers with various financial needs, if they go to insurance, banks, or any institution with a membership system, when applying for financial services including deposits or loans, they often need to fill in many personal data forms or sign various paper contracts. . Therefore, in addition to wasting paper, complicated procedures, and difficult to save contracts, relevant business personnel must also type or scan the information provided and authorized by the customer into the computer system after the customer fills in the paper information or contract. The above-mentioned secondary actions will consume a lot of time and manpower to deal with unnecessary procedures, which invisibly increases manpower costs and program time.

Take a banking institution as an example. If a customer has accounts with 10 banks at the same time, when applying for related financial services, he must repeatedly fill in the various application forms and contracts of the above 10 banks, which is time-consuming and laborious.

At the same time, because of the constant updating of current fraud tactics, the "Know your customer (KYC)" related laws and policies emerged at the historic moment to protect the above-mentioned customers. Personal data (hereinafter referred to as personal information) authorized by the user and stored in the bank, such as contact number or password. These customers and banks need to update these personal information from time to time, preventively or irregularly, in order to meet the requirements of relevant laws and regulations, reduce customer investment risks, and achieve the purpose of preventing money laundering. In other words, if the bank does not fully understand or verify the customer's information, it will expose the bank or the customer to a great risk of loss, and even cause business difficulties for the financial institution or company.

As mentioned above, KYC may further require bank users to take preventive information updates in advance, including information such as personal ID number, contact information, credit history, income proof and other information. The collection and individual verification of such information itself has consumed a lot of time and manpower for customers or banks. In addition, when a customer has the latest information change in one of the 10 banks, the KYC data stored by the remaining 9 banks will lose their reference because they have become old and not updated KYC data. value.

At this time, the remaining 9 banks will once again notify the customer to update his KYC information, that is, to update the personal information form or contract procedures, which will actually cause unnecessary and huge waste of costs and time for the customer or financial institution. .

How to solve the frequent and unavoidable data filling and subsequent typing in the electronic system is a problem that any financial institution should solve at present, and there is an urgent need to find a corresponding solution.

In order to solve the above problems, the present invention develops an identity management and authorization system based on the concept of a Blockchain network. This system can provide customers (hereinafter referred to as personal terminals) to input personal information digitally and electronically, and then correspond to the personal information, such as through asymmetric Asymmetric cryptography, which encrypts its personal information with a unique and unique personal private key on the personal end. Therefore, through this encryption method of personal information, regardless of whether the individual chooses to upload the encrypted personal information to the blockchain network, any system user or organization in the blockchain network cannot identify or obtain any information. Encrypted customer information. In addition, when the government end (hereinafter referred to as the competent end) makes a request for updating KYC personal information in order to prevent fraud or money laundering, the personal end can use its personal private key to decrypt the personal information to update the personal information. , And then upload their personal information encrypted.

In addition, the financial institution side (hereinafter referred to as the business side) can develop a computerized transaction agreement, which is called a smart contract here. The business end uses this kind of smart contract to specify the business content that can be provided to the personal end in the contract, and upload the above-mentioned smart contract to the blockchain network in the form of code data. Therefore, this smart contract is different from the traditional paper contract or any electronic contract, and can execute the content of the contract in a digital and system-automated manner in the blockchain network.

When the personal end has its own business needs for the business end, and such business needs can be provided and undertaken by the business end, they can sign a smart contract with the business end through the blockchain network. The terminal encrypts and authorizes its personal assets with the corresponding license key, allowing the above-mentioned business terminal to use the personal assets of the personal terminal to undertake the business scope involved in the content of the signed contract.

With the present invention, in addition to eliminating the need for complicated application or update procedures from each person to each business end, the supervisor can also announce the personal and business needs through the same simple and effective blockchain network method. Updating the personal information requirements can substantially prevent money laundering or fraud from happening.

Specifically, the present invention provides an identity management and authorization system, which is applied to a blockchain network that executes smart contracts. The above system includes a supervisor terminal, at least one business terminal, and at least one human terminal.

The above-mentioned supervisor terminal includes a supervisor block chain module and a supervisor announcement module. The above-mentioned supervisory blockchain module includes a supervisory database, and the above-mentioned supervisory blockchain module is used to communicate with the above-mentioned blockchain network, and update all the data of the above-mentioned blockchain network to the above-mentioned supervisory database; and The above-mentioned supervisor announcement module, through the above-mentioned supervisor blockchain module, announces an update request to the above-mentioned blockchain network.

Each of the above business ends includes: a business blockchain module, including a business database, the business blockchain module is used to communicate with the blockchain network, and update the blockchain network All data to the above-mentioned business database; a business contract module, which provides a business smart contract to the above-mentioned blockchain network through the above-mentioned business blockchain module; and a business decryption module.

The at least one human terminal is located on the blockchain network, and each of the personal terminals includes: a personal blockchain module, including a personal database, and the personal blockchain module is used to communicate with the blockchain network , And update all the data of the above-mentioned blockchain network to the above-mentioned personal database; the above-mentioned personal management module maintains an asset of the above-mentioned personal terminal; a personal encryption module, before uploading the above-mentioned personal information to the above-mentioned blockchain network, Encrypt the above-mentioned personal information; a person decrypting module, using a person’s private key to decrypt the personal information and the business smart contract that the business terminal transmits to the personal terminal through the personal blockchain module; and a personal contract module through The personal blockchain module signs the decrypted business smart contract, and provides a license key to the business decryption module of the business end to allow the business end to obtain the personal information.

According to an embodiment, in the above-mentioned identity management and authorization system, the above-mentioned update request requires the above-mentioned at least one terminal to update the above-mentioned personal information respectively.

According to another embodiment, in the above-mentioned identity management and authorization system, the above-mentioned business smart contract further includes a resource acquisition contract, and the above-mentioned individual resource acquisition contract stipulates that a range of the above-mentioned individual capital that can be used by the business end and 1. Access period.

According to another embodiment, in the above-mentioned identity management and authorization system, the above-mentioned business end uses the above-mentioned license key and obtains the above-mentioned scope and the above-mentioned access period of the above-mentioned personal assets through the above-mentioned individual asset acquisition contract.

According to another embodiment, in the above-mentioned identity management and authorization system, the above-mentioned personal blockchain module updates the above-mentioned personal information encrypted with the above-mentioned personal information encryption module, and connects to the above-mentioned blockchain network to ensure the above-mentioned supervisory data All the data in the database, the above-mentioned business database and the above-mentioned personal database contain the updated and encrypted above-mentioned personal information.

In addition to providing an identity management and authorization system, the present invention further provides an identity management and authorization method. The above method uses the above identity management and authorization system and includes the following steps: the supervisor terminal uploads the update request; the business terminal uploads The business smart contract is for the personal terminal to sign the business smart contract; and when the personal terminal updates the personal information according to the update request, the business terminal executes the business smart contract.

According to one embodiment, in the above-mentioned identity management and authorization method, the above-mentioned update request requires the above-mentioned at least one terminal to update the above-mentioned personal information respectively.

According to another embodiment, in the method for identity management and authorization, the business smart contract includes a resource acquisition contract, and the provisions of the individual resource acquisition contract include a range and a range of the individual assets that can be accessed by the business end. Access period.

According to another embodiment, in the above method for identity management and authorization, the business smart contract includes a resource access contract, wherein the business end uses the license key and obtains a range of the above personal assets through the individual resource access contract. 1. Access period.

According to another embodiment, in the above-mentioned identity management and authorization method, the above-mentioned personal data encrypted by the above-mentioned personal data encryption module is updated through the above-mentioned personal blockchain module and connected to the above-mentioned blockchain network to ensure All the data in the aforementioned supervisory database, the aforementioned business database, and the aforementioned personal database contain updated and encrypted personal information.

Through the above-mentioned data transmission and storage concepts of the blockchain network, the technical method of centralizing or storing traditional data in a single database or computer system can be transformed into a decentralized system or data management of a third-party system And information exchange methods. The above-mentioned traditional centralized data management methods have great security concerns. For example, the database system may be invaded or the risk of data damage is high. Therefore, the technology introduction of the blockchain network enables data to be stored in multiple nodes in the blockchain network, with unique features such as simultaneous multi-node data input at the user end, data multi-node location backup, and multi-node data retrieval. Therefore, it can improve the shortcomings that cannot be overcome by centralized management of data.

10: Identity management and authorization system

20: Blockchain network

30: Supervisor

31: Supervise the blockchain module

32: Supervisor announces the module

33: Update requirements

40: business side

41: Business Blockchain Module

42: Business Contract Module

43: Business decryption module

44: Business Smart Contract

50: personal end

51: Personal Blockchain Module

52: Personal Management Module

53: Personal encryption module

54: Personal Decryption Module

55: Personal Contract Module

56: Personal private key

57: Personality

58: License key

60: Methods of Identity Management and Authorization

S61-S67: steps

In order to make the above and other objectives, features, advantages and embodiments of the present invention more comprehensible, the accompanying drawings are described as follows: Figure 1 is a schematic diagram of the architecture of the identity management and authorization system.

Figure 2 depicts a schematic diagram of the business end and personal end of the identity management and authorization system.

Figure 3 is a flowchart of the steps of the identity management and authorization method.

In view of the above-mentioned problems to be overcome, the present invention provides an identity management and authorization system applied to the blockchain smart contract. Through the above-mentioned system, the personal end (such as the customer) can be established at any time, or the required personal information can be updated at one time when necessary. Data, and encrypt the above-mentioned personal data with the corresponding personal private key. Anyone who wants to inquire or use the above-mentioned encrypted personal data can only inquire or use the above-mentioned personal data with a license key authorized by the corresponding personal terminal, which does indeed achieve the security, anonymity and confidentiality claimed by the invention. System characteristics.

Furthermore, the competent end (such as government agencies) can also issue KYC or update personal information requirements to prevent the society from being flooded with various financial chaos, such as money laundering, fraud, suspicious transactions, and financing of terrorism (abbreviated as capital terrorism). . At this time, the personal terminal can also update and encrypt personal information through the above-mentioned blockchain network system platform, and quickly complete the published content required by the supervisor, so that the personal terminal can handle subsequent applications for other business needs.

Moreover, the personal information uploaded by the personal terminal through the above system can sign corresponding contracts with various business terminals (such as banking institutions, securities institutions, or insurance institutions) according to the business content they want to handle. The above-mentioned contract content will be written as a smart contract with computer code. After signing the above-mentioned smart contract on the personal side, it needs to be encrypted with a dedicated license key, and the business side can obtain personal information from the personal side only when holding the above-mentioned license key to execute related business content. The signing of the above-mentioned smart contract is to use the anonymity and immediacy of the personal information in the blockchain to avoid unnecessary complicated procedures such as filling in, updating or verifying the personal information during the process of updating the personal information. Therefore, this system can quickly and accurately meet the business needs of the personal end, and increase the economic benefits created by the reduction of the procedure time on each end.

To illustrate the implementation of the present invention more clearly, please refer to FIG. 1, which is a schematic diagram of the architecture of the identity management and authorization system. The present invention provides an identity management and authorization system 10, which is applied to a blockchain network 20 that executes smart contracts. The system 10 includes: a supervisor terminal 30, at least one business terminal 40, and at least one human terminal 50.

Regarding the above-mentioned main end 30, further description is as follows. Still referring to Figure 1, the above-mentioned competent terminal 30 is a unit node in the above-mentioned blockchain network 20, and the operation authority can be granted to government agencies that supervise or supervise related businesses, such as the Financial Supervision and Administration Commission (hereinafter referred to as the Financial Regulatory Commission) and the Ministry of Justice Institutions such as the Bureau of Investigation or the Joint Solicitation Center.

Still referring to FIG. 1, the above-mentioned supervisor terminal 30 further includes a supervisor blockchain module 31 and a supervisor publishing module 32. The above-mentioned supervisory blockchain module 31 includes a supervisory database, and the above-mentioned supervisory blockchain module 31 is used to communicate with the above-mentioned blockchain network 20, so that the above-mentioned supervisory terminal 30 becomes one of the above-mentioned blockchain networks 20 The unit node updates all the data in the above-mentioned blockchain network 20 to the above-mentioned supervisory database. That is, the above-mentioned supervisory end 30, through the above-mentioned supervisory blockchain module 31, can ensure that the system 10 currently operated is based on all the synchronized and up-to-date data in the above-mentioned blockchain network 20.

Still referring to Figure 1, the supervisor announcement module 32 connects to the blockchain network 20 through the supervisor blockchain module 31, keeps all data synchronized and up-to-date, and announces an update request 33 to On the above-mentioned blockchain network 20. The content of the above-mentioned update request 33 may further include that the above-mentioned supervisory terminal 30 announces and requires the institutional units and their customers under the supervision or supervision of the above-mentioned supervisory terminal 30 to update relevant information or its format, such as filling in the personal information of the above-mentioned at least one human terminal 50. , Or use the latest template published by the competent authority to update the above-mentioned personal qualification requirements of at least one person 50.

In addition, please refer to Figure 1. If the institution and its customers under the supervision or supervision of the above-mentioned supervisory terminal 30 do not update the information or the format required by the above-mentioned supervisory terminal 30 according to the above-mentioned update requirement 33, they will not be able to continue to use the above-mentioned system 10 Carrying out follow-up business operations, and even system operation procedures violation mechanisms such as violations of relevant laws and regulations or the obligation to compensate for damages.

Still referring to Figure 1, the aforementioned update request 33 needs to be coded in a programming language to form a language that can be recognized, read, calculated or executed by the aforementioned blockchain network 20, stored in the aforementioned supervisory database, and uploaded to the aforementioned area Block chain network 20. Among them, the aforementioned programming language includes any contract-oriented language, such as Solidity, Serpent, Lisp Like Language (LLL), or Viper.

Regarding the above-mentioned at least one service terminal 40, it is further described as follows. Still referring to Figure 1, each of the above-mentioned business ends 40 is a unit node in the above-mentioned blockchain network 20, and the operation authority can be granted to any institution that has the ability to undertake related businesses. For example, in the case of a financial institution, it can be Banking units, securities units, insurance units, other corporate units engaged in financial business, or any institutional unit with a membership system. The above-mentioned financial institutions shall also be subject to and fulfill the obligations of relevant regulations promulgated by their competent or supervisory authorities.

Still referring to FIG. 1, each of the above-mentioned business terminals 40 further includes a business blockchain module 41, a business contract module 42, and a business decryption module 43. The business block chain module 41 includes a business database. The business block chain module 41 is used to communicate with the block chain network 20, so that each of the business ends 40 becomes the block chain network. A unit node in the road 20 to update all the data in the blockchain network 20 to the business database. That is, each of the above-mentioned business terminals 40 can ensure that the current operating system 10 is based on all the synchronized and up-to-date data in the above-mentioned blockchain network 20 through the above-mentioned business blockchain module 41.

Still referring to Figure 1, the business contract module 42 is connected to the blockchain network 20 through the business blockchain module 41, keeping all data synchronized and up-to-date, and providing a business smart contract 44 To the aforementioned blockchain network 20. The content of the business smart contract 44 can further include any business content that any of the business terminals 40 can provide. For example, for financial institutions, it can be deposits, transfers, loans, cross-bank remittances, fund investments, or cross-border remittances. And other business content.

According to some embodiments, the business smart contract 44 further includes an asset drawing contract, and the individual asset drawing contract stipulates a range and a drawing period of the asset 57 that the business end 40 can draw. . Among them, the above-mentioned scope clearly includes the scope of the personal information that the above-mentioned personal terminal 50 can use when the above-mentioned business terminal 40 undertakes the contract content that has been authorized and agreed by the above-mentioned personal terminal 50. It can be all personal data authorization or only Part of the personal authorization. For example, in all the personal information authorized by the personal terminal 50, only the information obtained by the personal terminal 50 or the ID number, etc. can be used.

The above-mentioned access period clearly includes the access period for the above-mentioned personal terminal 50 when the business terminal 40 undertakes the contract content authorized and agreed by the above-mentioned personal terminal 50. For example, in the Money Laundering Prevention Law, financial institutions should keep the customer’s income data for 5 years after the termination of the business relationship with the customer; however, if the above-mentioned personal capital 57 is signed, the period of access is 1 year, even if it is still The above-mentioned personal assets will no longer be available for use within 5 years of preservation by financial institutions.

Still referring to Figure 1, the business smart contract 44 needs to be coded in any programming language through the business contract module 42 to form a language that can be recognized, read, calculated, or executed by the blockchain network 20, and stored in the above The business database is uploaded to the aforementioned blockchain network 20. Among them, the aforementioned programming language includes any contract-oriented language, such as Solidity, Serpent, Lisp Like Language (LLL), or Viper.

The business contract module 42 may further encrypt the business smart contract 44 and then upload the business smart contract 44 to the blockchain network 20. Among them, the above-mentioned encryption method can be any of the above-mentioned programming languages including hash function, asymmetric encryption, or any digital data that can be changed to change the above-mentioned digital data into hard-to-read ciphertext content, which requires a decryption process , In order to restore the ciphertext to various methods of readable content. The above hash functions include Digest Algorithm (Message-Digest-Algorithm 5, MD5) or Secure Hash Algorithm (SHA, such as SHA-1, SHA-224, SHA-256, SHA-384 or SHA-512) . The aforementioned asymmetric encryption includes the RSA algorithm (Rivest-Shamir-Adleman Algorithm).

Still referring to FIG. 1, the above-mentioned service decryption module 43 can be used to decrypt all the data in the above-mentioned service database, because all the above-mentioned data has been encrypted by any user.

According to some embodiments, the business smart contract 44 signed and encrypted by the personal terminal 50 is encrypted through asymmetric encryption. Among them, the above-mentioned asymmetric encryption can provide any of the above-mentioned supervisor terminal 30, each of the above-mentioned business terminals 40, and any of the above-mentioned personal terminals 50 (hereinafter collectively referred to as the user terminal) that can be connected to the above-mentioned blockchain network 20 A public key and a private key. The business contract module 42 encrypts the business smart contract 44 through the business end and the personal end using their respective exclusive public keys.

According to some embodiments, the business smart contract 44 further includes a resource acquisition contract, and the individual resource acquisition contract stipulates that the business terminal 40 can acquire a range and a resource of the personal terminal 50. the term. Therefore, after the above-mentioned personal terminal 50 is sent back by asymmetric addition After the business smart contract 44 is encrypted, the business decryption module 43 then uses the exclusive private key corresponding to the business end 40, or supplemented by the corresponding public key (or signature and seal) of the personal end 50 provided by the user end. Public key), decrypt the personal assets of the personal terminal 50, and use the above-mentioned range of the personal assets and the above-mentioned access period. For example, please refer to Figure 2. Figure 2 is a schematic diagram of the personal data acquisition of the business end and the personal end of the identity management and authorization system. The above-mentioned business decryption module 43 uses a business private key and the following personal contract module 55 A license key 58 mentioned in the above decrypts the business smart contract 44 and one of its assets 57 signed and encrypted by the personal terminal 50, and accesses the above-mentioned scope of the authorized assets within the above-mentioned access period, Perform related services undertaken by the above-mentioned business end 40.

Regarding the aforementioned at least one human terminal 50, further description is as follows. Still referring to Fig. 1, each of the aforementioned human terminals 50 is a unit node in the aforementioned blockchain network 20, and the operation authority can be granted to any legal or natural person. The above-mentioned legal person or natural person may further be a person who has a need for the business content undertaken by any of the above-mentioned business terminals 40, such as the legal representative of a municipal government, a legal entity of a consortium, a natural person, or other persons that meet the requirements of the Civil Law of the People’s Republic of China. Natural person or legal person qualification. Each of the above-mentioned legal persons or natural persons shall also be obliged to have and perform the relevant regulations promulgated by its competent or supervisory authority.

Still referring to FIG. 1, each of the personal terminals 50 described above further includes a personal blockchain module 51, a personal management module 52, a personal encryption module 53, a personal decryption module 54, and a personal contract module 55. The personal block chain module 51 includes a personal database, and the personal block chain module 51 is used to communicate with the block chain network 20, so that each of the personal terminals 50 becomes the block chain network. A unit node in 20 to update all the data in the above-mentioned blockchain network 20 to the above-mentioned personal database. That is to say, each of these personal terminals 50, through the above The personal blockchain module 51 can ensure that the above-mentioned system 10 currently operated is based on all the synchronized and up-to-date data in the above-mentioned blockchain network 20.

According to some embodiments, the aforementioned personal blockchain module 51 can further actively update an encrypted asset 57 regardless of the aforementioned update request 33 of the aforementioned supervisor 30, and connect it to the aforementioned blockchain network 20, so that the All the data in the supervisor database, the business database, and the personal database can contain the updated and encrypted personal information 57.

Still referring to FIG. 1, the personal management module 52 is used to maintain the personal assets 57 to which the personal terminal 50 belongs. For example, the personal terminal 50 is connected to the blockchain network 20 through the personal blockchain module 51, and then the personal asset 57 is created, updated or changed. The above-mentioned personal information 57 needs to be coded in any programming language through the above-mentioned personal management module 52 to form a language that can be recognized, read, calculated or executed by the above-mentioned blockchain network 20, so as to be stored in the above-mentioned personal database, and then uploaded To the aforementioned blockchain network 20. Any of the above programming languages include hash functions, such as Digest Algorithm (Message-Digest-Algorithm 5, MD5) or Secure Hash Algorithm (SHA, such as SHA-1, SHA-224, SHA-256) , SHA-384 or SHA-512) etc.

Still referring to FIG. 1, the personal encryption module 53 needs to encrypt the personal information 57 before uploading the personal information 57 to the blockchain network 20 on the personal terminal 50. The above encryption method can be asymmetric encryption, or any other method that can change the digital data, change the above digital data into hard-to-read ciphertext content, and must undergo a decryption process to restore the ciphertext to readable content. . The aforementioned asymmetric encryption includes the RSA algorithm (Rivest-Shamir-Adleman Algorithm).

According to some embodiments, when the personal terminal 50 encrypts the personal data 57 through the personal encryption module 53, it is encrypted by the exclusive public key of the user who wants to receive the personal data 57. Taking the above-mentioned personal information 57 as an example, the above-mentioned personal terminal 50 encrypts the above-mentioned personal information 57 through the exclusive public key corresponding to the business terminal 40 that it wants to handle.

According to some embodiments, please refer to FIG. 2. When the personal terminal 50 encrypts the personal data 57 through the personal encryption module 53, in addition to the exclusive public key of the user who wants to receive the personal data 57, it is further encrypted with a digital signature. In this way, the aforementioned personal assets 57 are encrypted asymmetrically, and the encrypted personal assets 57 are uploaded to the aforementioned blockchain network 20 through the aforementioned personal blockchain module 51. Among them, the asymmetric encryption can provide a dedicated public key and a dedicated private key for any user end that can be connected to the blockchain network 20.

Please refer to Figure 2. For example, any of the above-mentioned personal terminals 50 have their own public key and private key 56, and the plaintext is encrypted with the RSA algorithm through a unique and unique digital signature (that is, the above-mentioned personal private key 56). For example, the above-mentioned individual assets 57). Any user connected to the above-mentioned blockchain network 20 can decrypt the encrypted plaintext (for example, the above-mentioned personal data 57) through the corresponding public key of the above-mentioned user.

Still referring to Fig. 2, taking the aforementioned personal data 57 as an example, since the aforementioned personal data 57 is encrypted with the aforementioned personal private key 56 exclusive to the aforementioned personal terminal 50, that is, the aforementioned personal private key 56 will only uniquely correspond to the aforementioned personal terminal 50. Therefore, it has the above-mentioned digital signature function, which can be used to identify the user end of the encrypted plaintext (the above-mentioned individual asset 57), and directly correspond to the signed user end to achieve the function of identity verification.

According to some embodiments, please refer to FIG. 1 again. When the personal terminal 50 wants to use the personal management module 52 to further maintain the personal assets 57 to which the personal terminal 50 belongs, it needs to pass through The above-mentioned personal decryption module 54 uses the above-mentioned personal private key 56 for decryption, and then the above-mentioned personal information 57 can be edited by the above-mentioned personal management module 52.

Referring to FIG. 1 again, the personal decryption module 54 uses the personal private key 56 to decrypt the business smart contract 44 that the business terminal 40 transmits to the personal terminal 50 through the personal blockchain module 51. Since the business smart contract 44 is also encrypted through asymmetric encryption, and the personal public key of the personal terminal 50 is used to encrypt the business smart contract 44, the personal terminal 50 can decrypt the business smart contract 44 through its exclusive personal private key 56 The above-mentioned business smart contract 44.

Still referring to Figure 1, the personal contract module 55, through the personal blockchain module 51, signs the decrypted business smart contract 44, encrypts the business contract 44 by asymmetric encryption and provides a license The key 58 is given to the service decryption module 43 of the service terminal 40 to authorize the service terminal 40 to obtain all or part of the personal assets 57.

According to some embodiments, the aforementioned asymmetric encryption method is that the personal terminal 50 only uses the exclusive public key corresponding to the business terminal 40, or supplemented by the personal private key 56, to encrypt the business smart contract 44 that has been agreed to be signed. In addition, the above-mentioned license key 58 is attached to the above-mentioned business performance contract 44. The business terminal 40 can open the business smart contract 44 agreed to and signed by the personal terminal 50 through the exclusive private key corresponding to the business terminal 40. In addition, the above-mentioned service terminal 40 can obtain all or part of the corresponding personal information 57 through the above-mentioned license key 58 provided by the above-mentioned personal terminal 50.

In addition, please refer to FIG. 3, which is a flowchart of the steps of the identity management and authorization method. Corresponding to the aforementioned identity management and authorization system, the present invention reveals another identity Management and authorization method 60. The above-mentioned identity management and authorization method 60 uses the above-mentioned identity management and authorization system 10 and includes the following steps: First, referring to FIG. 3, in step S63, the above-mentioned supervisor 30 uploads the above-mentioned update request 33. The content of the above-mentioned update request 33 may further include that the above-mentioned supervisory terminal 30 announces and requires the institutional units and their customers under the supervision or supervision of the above-mentioned supervisory terminal 30 to update relevant information or its format, such as filling in the personal information of the above-mentioned at least one human terminal 50. 57, or update the personal data 57 requirements of at least one person 50, etc., based on the latest template published by the above-mentioned supervisor terminal 30.

Still referring to FIG. 3, in step S62, the business terminal 40 uploads the business smart contract 44 to provide the personal terminal 50 to sign the business smart contract 44. It is worth mentioning that the business end 40 can upload the business smart contract 44 at any time, which means that the step sequence is different from the time point of step S63 (the supervisor 30 uploads the update request 33). Associated without prioritization, and can even be uploaded at the same time.

According to some embodiments, the content of the business smart contract 44 may further include any business content that can be provided by any of the business terminals 40, for example, for financial institutions, it may be deposits, transfers, loans, inter-bank remittances, Business content such as fund investment or cross-border remittance.

Still referring to Fig. 3, in step S64, the personal terminal 50 confirms whether the update request 33 uploaded by the supervisor 30 is completed. If the update is not completed, other business content to be processed cannot be carried out, and the process is directly led to Step S67, the process of the above-mentioned method 60 of identity management and authorization is ended. If the update is completed, the flow continues to step S65.

Still referring to Figure 3, in step S65, if the personal terminal 50 completes the update, it will obtain the business smart contract 44 corresponding to the business to be handled. If the content of the business smart contract 44 is not agreed or signed, the follow-up will not be possible Other business content you want to handle, directly stream The process leads to step S67, the process of the above-mentioned method 60 of identity management and authorization is ended. If the content of the aforementioned business smart contract 44 is agreed and signed, the process continues to step S66.

According to some embodiments, in step S65, if the personal terminal 50 agrees to and signs the business smart contract 44, the signing will be further performed through asymmetric encryption, so that the personal terminal 50 only uses the exclusive public address corresponding to the business terminal 40. The key, or supplemented by the personal private key 56, encrypts the above-mentioned business smart contract 44 that has been agreed to be signed, and the above-mentioned license key 58 is attached to the above-mentioned business function contract 44.

Still referring to Fig. 3, in step S66, if the personal terminal 50 agrees and signs the business smart contract 44, the business terminal 40 can obtain the personal information 57 of the personal terminal 50 according to the authorized business smart contract 44. , To handle the business content related to the above-mentioned personal terminal 50, and lead the process to S67, to end the above-mentioned method 60 process of identity management and authorization.

According to some embodiments, the business smart contract 44 may further include the above-mentioned individual asset acquisition contract, and the above-mentioned individual asset acquisition contract stipulates that the above-mentioned individual asset 57 can be accessed by the business end 40 within a range and an access the term. The above-mentioned scope clearly includes the scope of personal data of the above-mentioned personal terminal 50 that can be used by the above-mentioned business terminal 40 when it undertakes the contract content authorized and agreed by the above-mentioned personal terminal 50. It can be all personal data authorized or only part of it. Individual capital authorization. The aforementioned access period clearly includes the access period for the personal assets of the aforementioned personal end 50 that the business end 40 can use when it undertakes the contract content authorized and agreed by the aforementioned personal end 50, and the process is directed to S67 to end The above-mentioned method 60 for identity management and authorization is a procedure.

According to some embodiments, due to the contract content specification of the above-mentioned resource access contract, the above-mentioned service decryption module 43 uses the above-mentioned service private key and the above-mentioned license key 58 to respectively decrypt the above-mentioned service signed and encrypted by the above-mentioned personal terminal 50 The smart contract 44 and the above-mentioned individual assets 57, and in the above-mentioned Within the time limit, use the above-mentioned range of authorized personal assets to carry out the relevant business undertaken by the above-mentioned business terminal 40, and lead the process to S67 to end the above-mentioned method 60 process of identity management and authorization.

Combining the above identity authorization and management system and identity authorization and management methods, due to the technology of the blockchain network, data can be written continuously, decentralized (ie decentralized), and updated in real time, and the data is based on The data history is recorded with features such as traceability and non-repudiation. Then through the establishment and signing of related smart contracts, it can solve the problems that customers have to update their personal funds frequently and consume the manpower of the business organization.

In addition, if the data uploaded to the blockchain network, such as the customer’s personal information, is asymmetrically encrypted, the encrypted data history can have an unchangeable characteristic. Compared with paper customer data in traditional banking institutions, or electronic customer data that has been unified managed by a central system, it is more efficient and relatively safe for data storage. In addition, government agencies can also participate in and become unit nodes in the blockchain network. Through the real-time nature of the blockchain network and the compulsion of smart contracts, they can effectively and comprehensively achieve targeted prevention and create a security And reliable smart financial operation platform.

The present invention is only disclosed in the preferred embodiments herein. However, anyone familiar with the technical field should understand that the above-mentioned embodiments are only used to describe the present invention and are not used to limit the scope of the patent rights claimed by the present invention. Any changes or substitutions equivalent or equivalent to the above-mentioned embodiments should be construed as being covered by the spirit or scope of the present invention. Therefore, the protection scope of the present invention shall be defined by the following patent application scope.

10: Identity management and authorization system

20: Blockchain network

30: Supervisor

31: Supervise the blockchain module

32: Supervisor announces the module

33: Update requirements

40: business side

41: Business Blockchain Module

42: Business Contract Module

43: Business decryption module

44: Business Smart Contract

50: personal end

51: Personal Blockchain Module

52: Personal Management Module

53: Personal encryption module

54: Personal Decryption Module

55: Personal Contract Module

57: Personality

58: License key

Claims (10)

An identity management and authorization system is applied to a blockchain network that executes smart contracts. The system includes: a supervisor terminal, including: a supervisor blockchain module, including a supervisor database, the supervisor blockchain module The group is used to communicate with the blockchain network and update all the data of the blockchain network to the supervisor database; and a supervisor announcement module, through which the supervisor blockchain module announces an update request to On the blockchain network; at least one business end, each of the business ends includes: a business block chain module, including a business database, the business block chain module is used to communicate with the block chain network And update all the data of the blockchain network to the business database; a business contract module that provides a business smart contract to the blockchain network through the business blockchain module; and a business decryption The module decrypts the encrypted business smart contract, receives a license key and the encrypted data through the business block chain module, and decrypts the data with the license key; and at least one human terminal located in the block On the chain network, each of these personal terminals includes: a person blockchain module, including a person database, the personal blockchain module is used to communicate with the blockchain network and update the blockchain network All data of to the personal database; One person manages the module and maintains the personal data; one person encrypts the module and encrypts the personal data before uploading the personal data to the blockchain network; one person decrypts the module and uses one person’s private key to decrypt the personal data. Personal information and the business smart contract that the business end transmits to the personal end through the personal blockchain module; and a personal contract module that signs the decrypted business smart contract through the personal blockchain module and provides The license key is given to the service decryption module of the service end to allow the service end to obtain the information. For example, the identity management and authorization system of claim 1, wherein the update request requires the at least one terminal to update the personal information to which it belongs. For example, the identity management and authorization system of claim 1, in which the business smart contract further includes a resource acquisition contract, and the resource acquisition contract stipulates that it includes a range and a withdrawal of the resource that the business end can use Use time limit. For example, the identity management and authorization system of claim 3, in which the business end uses the license key and obtains the scope and the access period of the asset through the asset access contract. For example, the identity management and authorization system of claim 1, in which the personal blockchain module updates the information encrypted with the data encryption module, and connects to the blockchain network to ensure that the supervisory database, All the data in the business database and the personal database contains the updated and encrypted data. A method for identity management and authorization, which uses the identity management and authorization system such as request item 1. The method includes: the supervisor uploads the update request; The business terminal uploads the business smart contract for the personal terminal to sign the business smart contract; and when the personal terminal updates the personal data according to the update request, the business terminal executes the business smart contract. For example, in the method for identity management and authorization of claim 6, wherein the update request is to require the at least one terminal to update the personal information to which it belongs. For example, the method of identity management and authorization of claim 6, wherein the business smart contract includes a resource acquisition contract, and the provisions of the resource acquisition contract include a range of the asset that can be accessed by the business end and an access the term. For example, the method for identity management and authorization of claim 6, wherein the business smart contract includes a resource access contract, wherein the business end uses the license key and obtains a range and access to the resource through the resource access contract. Use time limit. For example, the identity management and authorization method of claim 6, wherein the personal blockchain module is used to update the personal information encrypted with the personal encryption module, and link to the blockchain network to ensure that the supervisor All data in the database, the business database, and the personal database contain the updated and encrypted data.

Images