TWM596924U - Device of identity management and authorization - Google Patents

Abstract

The invention provides a device of identity management and authorization applied to a blockchain network that executes smart contacts, which includes a manager end, at least one business end and at least one personal end. The manager end communicatively connects to the blockchain network and announces a renewal request. Each of the at least one business end communicatively connects to the blockchain network and provides a business smart contract. Each of the at least one personal end communicatively connects to the blockchain network and updates a personal information encrypted by a personal private key. Each of the at least one personal end then decrypts the business smart contract for signing thereon, and updates the business smart contract encrypted by the personal private key with a permission key attached. The business end gets the personal information through the permission key and handles the business content written in the business smart contract.

Description

Identity management and authorization device

The present invention relates to an identity management and authorization device, especially an identity management and authorization device for a blockchain smart contract that can be jointly participated by supervisors.

Nowadays, customers with various financial needs need to fill out many personal information forms or sign various paper contracts when applying for insurance, bank or any organization with membership system, when applying for financial services including deposits or loans. . Therefore, in addition to wasting paper, complicated procedures and difficult to save contracts, relevant business personnel must also enter or scan the information provided and authorized by the customer into the computer device after the customer completes the paper information or contract. The above-mentioned secondary action will consume a lot of time and manpower in dealing with unnecessary procedures, which invisibly increases the manpower cost and the procedure time.

Taking a banking institution as an example, if a customer has accounts of 10 banks at the same time, when applying for related financial services, it is necessary to repeatedly fill out the various application forms and contracts of the above 10 banks, which is quite time-consuming and laborious.

At the same time, because of the continuous updating of fraud methods, the relevant laws and policies of "Know your customer (KYC)", which is in response, are protecting the personal data authorized by these customers and stored in the bank (hereinafter referred to as personal information). ), such as contact numbers or passwords. These clients and banks need to update these assets frequently or preventively, in order to meet the requirements of relevant laws and regulations, reduce the investment risk of customers and achieve the purpose of preventing money laundering. In other words, if the bank does not fully understand or verify the customer's information, it will expose the bank or the customer to a great risk of loss, and even cause financial difficulties for the financial institution or company.

As mentioned above, KYC may further require each bank user to take precautionary information updates in advance, including such information as personal ID number, contact information, credit history, income certificate, etc. The collection and individual verification of such data consumes a lot of time and manpower of customers or banks. In addition, when the customer has the latest information changes in one of the 10 banks, the KYC data stored in the remaining 9 banks will lose their reference because they have become old and have not been updated. value.

At this time, the remaining 9 banks will again notify customers to update his KYC information, that is, to renew the forms or contract procedures of personal assets, which will actually cause unnecessary and huge cost and time waste for both customers and financial institutions. .

How to solve such frequent and unavoidable data changes and subsequent input of electronic devices is a problem that any financial institution should solve at present, and it is urgent to find a corresponding solution.

In order to solve the above problems, the present invention has developed an identity management and authorization device based on the concept of Blockchain network. This device can provide customers (hereinafter referred to as the personal end) to enter personal data digitally, and then correspond to the personal data, for example, through asymmetric cryptography (Asymmetric cryptography), using the personal end unique and unique personal private key Encrypt its assets. Therefore, through this personal asset encryption method, no matter whether the personal end chooses to upload encrypted personal assets to the blockchain network, any device user or organization in the blockchain network cannot identify or obtain any Encrypted client assets. In addition, when the government side (hereinafter referred to as the supervisor side) proposes, for example, KYC personal information update request to prevent fraud or money laundering, the personal side can decrypt the belonging personal information through its personal private key for personal information update , And then upload their assets encrypted.

In addition, the financial institution side (hereinafter referred to as the business side) can develop a computerized transaction agreement, which is referred to herein as a smart contract. Through this kind of smart contract, the business end specifies the business content that can be provided to the personal end on the contract, and uploads the above smart contract in the form of code data to the blockchain network. Therefore, this kind of smart contract is different from the traditional paper contract, or any electronic form of contract, and can execute the contract content in a digital and automatic way in the blockchain network.

When the personal end has its intended business needs for the above-mentioned business end, and such business needs can be provided and undertaken by the above-mentioned business end, the smart contract can be signed with the above-mentioned business end through the above-mentioned blockchain network. The client end encrypts and authorizes its personal assets with the corresponding license key, allowing the above-mentioned business end to use the personal assets to which the personal end belongs to undertake the business scope involved in the content of the contract signed.

With this new model, in addition to eliminating the need for individual end-to-end business, and making complicated application or update procedures, the supervisor can also publish the personal and business needs through the same simple and effective blockchain network. Updating the requirements of the individual’s assets can substantially prevent money laundering or fraud.

Specifically, the present invention provides an identity management and authorization device, which is applied to a blockchain network that executes smart contracts. The device includes a supervisor terminal, at least one business terminal, and at least one personal terminal.

The above supervisor includes a supervisor blockchain module and a supervisor announcement module. The above-mentioned supervisor blockchain module includes a supervisor database, and the supervisor blockchain module is used for communicating with the blockchain network and updating all the data of the blockchain network to the supervisor database; and The above supervisor announcement module, through the above supervisor blockchain module, announces an update request to the above blockchain network.

Each of these services includes: a business blockchain module, including a business database, and the business blockchain module is used to communicate with the blockchain network and update the blockchain network All data to the above-mentioned business database; a business contract module, providing a business smart contract to the above-mentioned blockchain network through the above-mentioned business blockchain module; and a business decryption module.

The at least one personal end is located on the blockchain network, and each of the personal ends includes: a personal blockchain module, including a personal database, and the personal blockchain module is used to communicate with the blockchain network , And update all the data of the above-mentioned blockchain network to the above-mentioned personal database; the above-mentioned personal management module, maintain one asset of the above-mentioned personal end; one-person encryption module, before uploading the above-mentioned asset to the above-mentioned blockchain network, Encrypt the above assets; a person decryption module, use a person's private key to decrypt the asset and the business smart contract that the business end passed to the individual end through the personal blockchain module; and a person contract module, through The personal blockchain module signs the decrypted business smart contract, and provides a license key to the business decryption module of the business end, so as to permit the business end to obtain the personal resources.

According to an embodiment, in the above-mentioned identity management and authorization device, the above-mentioned update request requires the at least one personal terminal to update the above-mentioned individual assets respectively.

According to another embodiment, in the above-mentioned identity management and authorization device, the above-mentioned business smart contract further includes a capital withdrawal contract, and the above-mentioned individual capital withdrawal contract stipulates to include a range of the above-mentioned individual capital available to the business end and One access period.

According to yet another embodiment, in the above-mentioned identity management and authorization device, the business end uses the license key and obtains the above-mentioned range of the above-mentioned individual assets and the above-mentioned withdrawal period through the individual asset withdrawal contract.

According to yet another embodiment, in the identity management and authorization device, the personal blockchain module updates the individual assets encrypted with the individual asset encryption module and connects to the blockchain network to ensure the supervisor data All the data in the database, the above-mentioned business databases and the above-mentioned personal databases contain the updated and encrypted assets.

In addition to providing an identity management and authorization device, the present invention further provides an identity management and authorization method. The above method uses the above identity management and authorization device and includes the following steps: the above-mentioned supervisor uploads the above-mentioned update request; the above-mentioned business uploads The above-mentioned business intelligence contract is for the above-mentioned personal end to sign the above-mentioned business intelligence contract; and when the above-mentioned personal end updates the above-mentioned personal assets according to the above-mentioned update request, the above-mentioned business end executes the above-mentioned business intelligence contract.

According to an embodiment, in the method of identity management and authorization, the update request requires the at least one personal terminal to update the personal assets to which it belongs. .

According to another embodiment, in the above-mentioned identity management and authorization method, the business intelligence contract includes a capital withdrawal contract, and the provisions of the individual capital withdrawal contract include a range and a portion of the individual capital available to the business end Access period.

According to yet another embodiment, in the above-mentioned identity management and authorization method, the business smart contract includes a capital acquisition contract, wherein the business end uses the license key and obtains a range of the individual capital through the capital acquisition contract. One access period.

According to yet another embodiment, in the above-mentioned identity management and authorization method, through the personal blockchain module, the individual assets encrypted by the individual asset encryption module are updated and connected to the blockchain network to ensure All the data in the above-mentioned competent database, the above-mentioned business databases and the above-mentioned personal databases contain the updated and encrypted assets.

Through the above-mentioned concept of data transmission and storage on the blockchain network, the traditional data technology can be centralized or stored in a single database or computer device, and it can be transferred to a decentralized device or third-party device for data management. And information exchange methods. The above-mentioned traditional centralized data management method has great security concerns, for example, the risk that the database device may be invaded or the data is damaged is high. Therefore, the introduction of the technology of the blockchain network enables data to be stored in multiple nodes in the blockchain network, with unique multi-node data input at the user end, data multi-node location backup, and multi-node data retrieval. It can improve the shortcomings that the centralized management of data cannot overcome.

In view of the above-mentioned problems to be overcome, the present invention provides an identity management and authorization device applied to blockchain smart contracts. Through the above-mentioned device, an individual (such as a customer) can be established at any time, or update the required individual at a time if necessary Data, and encrypt the personal data with the corresponding private key. Anyone who wants to query or use the above encrypted personal data can only query or use the above personal data while holding the license key authorized by the corresponding personal end. Device characteristics.

Furthermore, competent authorities (such as government agencies) can also issue KYC or update personal capital requirements to prevent society from being flooded with various financial chaos, such as money laundering, fraud, suspicious transactions, and terrorist financing (referred to as capital terrorism). . At this time, the personal end can also update and encrypt the personal assets through the above-mentioned blockchain network device platform, and quickly complete the announcement content required by the supervisor side, so that the personal end can handle subsequent applications for other business needs.

Furthermore, the personal data uploaded by the personal end through the above-mentioned device can sign corresponding contracts with various business ends (such as banking institutions, securities institutions or insurance institutions) according to the business content they want to handle. The content of the above contract will be written into a smart contract with computer program code. After the above-mentioned smart contract is signed on the personal side, it needs to be encrypted with a dedicated license key, and the business side can only obtain the personal resources of the personal side to carry out relevant business content when holding the above-mentioned license key. The signing of the above-mentioned smart contract is to use the anonymity and immediacy of personal assets in the blockchain to avoid unnecessary complicated procedures such as re-filling, updating or verifying personal assets in the process of updating personal assets. Therefore, this device can quickly and accurately meet the business needs of the personal end, and improve the economic benefits created by reducing the time of procedures at each end.

To more clearly illustrate the implementation of the present invention, please refer to FIG. 1, which is a schematic diagram of the identity management and authorization device. The present invention provides an identity management and authorization device 10, which is applied to a blockchain network 20 that executes smart contracts. The device 10 includes: a supervisor terminal 30, at least one service terminal 40, and at least one personal terminal 50.

The above-mentioned main tube end 30 is further described as follows. Still referring to FIG. 1, the above-mentioned supervisor terminal 30 is a unit node in the above-mentioned blockchain network 20, and the operation authority may be granted to the supervisory or government agency that supervises related businesses, such as the Financial Supervisory Commission (referred to as the Financial Management Commission), the Legal Department Bureaus of investigation or joint collection centers.

Still referring to FIG. 1, the above-mentioned supervisor terminal 30 further includes a supervisor blockchain module 31 and a supervisor announcement module 32. The supervisor blockchain module 31 includes a supervisor database. The supervisor blockchain module 31 is used to communicate with the blockchain network 20 so that the supervisor terminal 30 becomes one of the blockchain networks 20. The unit node updates all the data in the blockchain network 20 to the supervisor database. That is, the master terminal 30, through the master blockchain module 31, can ensure that the currently operated device 10 is based on all the latest and synchronized data in the blockchain network 20.

Still referring to FIG. 1, the above-mentioned supervisor announcement module 32 communicates with the above-mentioned blockchain network 20 through the above-mentioned supervisor blockchain module 31, keeps all data synchronized and up-to-date, and publishes an update request 33 to On the aforementioned blockchain network 20. The content of the above update request 33 may further include the institutional units and their clients announced by the above-mentioned competent terminal 30 and required to be supervised or supervised by the above-mentioned competent terminal 30, to update relevant materials or their formats, for example, to fill in the above-mentioned personal information of at least one personal terminal 50 , Or use the latest template published by the competent authority to update the requirements of at least one personal terminal 50.

In addition, please refer to FIG. 1, if the institutions or their clients supervised or supervised by the above-mentioned terminal 30 do not update the data or the format required by the above-mentioned terminal 30 in accordance with the above-mentioned update request 33, they will not be able to continue through the above-mentioned device 10 Follow-up business operations, even there are violations of device operation procedures due to violations of relevant laws and regulations or due to damage compensation obligations.

Still referring to FIG. 1, the above update request 33 needs to be coded in programming language to form a language that can be recognized, read, calculated or executed by the above-mentioned blockchain network 20, and stored in the above-mentioned supervisor database for upload to the above-mentioned area Blockchain network 20. Among them, the above programming languages include any contract-oriented languages, such as Solidity, Serpent, Lisp Like Language (LLL) or Viper.

The at least one service terminal 40 is further described as follows. Still referring to FIG. 1, each of the above-mentioned business ends 40 is a unit node in the above-mentioned blockchain network 20, and the operation authority can be granted to any institution with the ability to undertake related business, for example, for financial institutions, it can be Banking unit, securities unit, insurance unit, other company units engaged in financial business, or any institutional unit with membership system. The above-mentioned financial institutions shall also be subject to and fulfill the obligations of relevant regulations promulgated by their supervisors or regulatory authorities.

Still referring to FIG. 1, each of the above-mentioned business terminals 40 further includes a business blockchain module 41, a business contract module 42, and a business decryption module 43. The business blockchain module 41 includes a business database, and the business blockchain module 41 is used to communicate with the blockchain network 20 so that each of the business terminals 40 becomes the blockchain network. A unit node in the way 20 to update all the data in the blockchain network 20 to the business database. That is, each of the service terminals 40, through the service blockchain module 41, can ensure that the currently operated device 10 is based on all data synchronized and up-to-date in the blockchain network 20.

Still referring to FIG. 1, the above-mentioned business contract module 42 is connected to the above-mentioned blockchain network 20 through the above-mentioned business blockchain module 41, keeping all data synchronized and up-to-date, and providing a business smart contract 44 To the aforementioned blockchain network 20. The content of the above business smart contract 44 may further include any business content that any of these business terminals 40 can provide, for example, for financial institutions, it can be deposits, transfers, loans, cross-bank remittances, fund investments or cross-border remittances And other business content.

According to some embodiments, the business intelligence contract 44 further includes a capital withdrawal contract, and the individual capital withdrawal contract specifies a range and a withdrawal period including the individual capital 57 that the business terminal 40 can access. . Among them, the above-mentioned range is defined to include the above-mentioned business end 40 because it has undertaken the contract content that has been authorized and agreed by the above-mentioned personal end 50. Some personal authorization. For example, in all the personal funds authorized by the personal terminal 50, only the data or ID number of the personal terminal 50 can be used.

The above-mentioned withdrawal period clearly specifies the withdrawal period that the above-mentioned business terminal 40 can withdraw the personal resources of the above-mentioned personal terminal 50 when undertaking the contract content authorized by the above-mentioned personal terminal 50. For example, in the money laundering prevention law, after the business relationship between the financial institution and the client is terminated, the client’s information should still be kept for 5 years; but if the signature of the above-mentioned capital 57 is used, the withdrawal period is 1 year, even if it is still in Within 5 years of being kept by a financial institution, the above-mentioned personal resources can no longer be used57.

Still referring to FIG. 1, the business smart contract 44 needs to be encoded in any programming language through the business contract module 42 to form a language that the blockchain network 20 can recognize, read, calculate, or execute, and store it in the above Business database to upload to the above-mentioned blockchain network 20. Among them, the above programming languages include any contract-oriented languages, such as Solidity, Serpent, Lisp Like Language (LLL) or Viper.

The business contract module 42 may further encrypt the business smart contract 44 before uploading the business smart contract 44 to the blockchain network 20. Among them, the above-mentioned encryption method can be any of the above-mentioned programming languages including Hash function, asymmetric encryption, or any digital data that can be changed, and the above-mentioned digital data is changed into ciphertext content that is difficult to read without going through the decryption process , In order to restore the ciphertext to various methods of readable content. The above hash functions include a digest algorithm (Message-Digest-Algorithm 5, MD5) or a secure hash algorithm (Secure Hash Algorithm, SHA, such as SHA-1, SHA-224, SHA-256, SHA-384, or SHA-512) . The asymmetric encryption includes the RSA algorithm (Rivest-Shamir-Adleman Algorithm).

Still referring to FIG. 1, the above-mentioned business decryption module 43 can be used to decrypt all the data in the above-mentioned business database, because all the above-mentioned data has been encrypted by any user end.

According to some embodiments, the business intelligence contract 44 signed and encrypted by the personal terminal 50 is encrypted by asymmetric encryption. Among them, the asymmetric encryption can provide any of the master terminal 30, each of the service terminals 40, and any of the personal terminals 50 (hereinafter collectively referred to as user terminals) that can be connected to the blockchain network 20. A private key (Public key) and a private key (Private key). The business contract module 42 encrypts the business smart contract 44 through the business end and the personal end using their respective exclusive public keys.

According to some embodiments, the business intelligence contract 44 further includes a capital withdrawal contract, and the individual capital withdrawal contract specifies a range and a withdrawal including the capital of the personal terminal 50 that the business terminal 40 can access. the term. Therefore, after the personal terminal 50 returns the asymmetrically encrypted business smart contract 44, the business decryption module 43 then uses the private key corresponding to the business terminal 40 or supplemented by the user terminal. The corresponding public key (or signature public key) of the personal terminal 50 decrypts the personal assets of the personal terminal 50, and uses the above range and the withdrawal period of the personal assets. For example, please refer to FIG. 2. FIG. 2 is a schematic diagram of the personal and business use of the identity management and authorization device. The business decryption module 43 uses a business private key and a personal contract module 55 as described below A license key 58 mentioned in the above decrypts the business smart contract 44 and one of its assets 57 signed and encrypted by the personal terminal 50, and within the above-mentioned access period, accesses the above-mentioned range of authorized assets, Carry out the relevant business undertaken by the above-mentioned business terminal 40.

The at least one personal terminal 50 described above is further described as follows. Still referring to FIG. 1, each of the above-mentioned personal terminals 50 is a unit node in the above-mentioned blockchain network 20, and the operation authority can be granted to any legal or natural person. The above-mentioned legal person or natural person may further have a need for the business content undertaken by any of these business units 40, such as the legal representative of a municipal government, a legal person of a consortium, a natural person, or other such as Natural person or legal person. Each of the above legal or natural persons shall also be subject to and fulfill the obligations of the relevant regulations promulgated by its supervisor or supervisory authority.

Still referring to FIG. 1, each of the above-mentioned personal terminals 50 further includes a personal blockchain module 51, a personal management module 52, a personal encryption module 53, a personal decryption module 54, and a personal contract module 55. The personal blockchain module 51 includes a personal database. The personal blockchain module 51 is used to communicate with the blockchain network 20 so that each of the personal terminals 50 becomes the blockchain network. A unit node in 20 to update all the data in the blockchain network 20 to the personal database. That is, each of the personal terminals 50, through the personal blockchain module 51, can ensure that the currently operated device 10 is based on all data synchronized and up-to-date in the blockchain network 20.

According to some embodiments, the personal blockchain module 51 may further actively encrypt and update a resource 57 with or without the update request 33 of the supervisor 30, and connect to the blockchain network 20 to make the All data in the supervisor database, the business databases, and the personal databases can contain the above-mentioned assets that are updated and encrypted57.

Still referring to FIG. 1, the personal management module 52 is used to maintain the personal assets 57 to which the personal terminal 50 belongs. For example, the personal terminal 50 is connected to the blockchain network 20 through the personal blockchain module 51, and then the personal resource 57 is created, updated, or changed. The above-mentioned personal resources 57 need to be encoded in any programming language through the above-mentioned personal management module 52 to form a language that can be recognized, read, calculated or executed by the above-mentioned blockchain network 20 to be stored in the above-mentioned personal database and then uploaded To the aforementioned blockchain network 20. Any of the above programming languages include Hash functions, such as Digest Algorithm (Message-Digest-Algorithm 5, MD5) or Secure Hash Algorithm (SHA, such as SHA-1, SHA-224, SHA-256 , SHA-384 or SHA-512), etc.

Still referring to FIG. 1, the personal encryption module 53 needs to encrypt the personal assets 57 before uploading the personal assets 57 to the blockchain network 20 on the personal terminal 50. The above encryption method can be asymmetric encryption, or any other method that can change the digital data and change the digital data into ciphertext content that is difficult to read, and the decryption process is required to restore the ciphertext to readable content. . The asymmetric encryption includes the RSA algorithm (Rivest-Shamir-Adleman Algorithm).

According to some embodiments, when the personal terminal 50 encrypts the personal asset 57 through the personal encryption module 53, it is encrypted by the exclusive public key of the user terminal that wants to receive the personal asset 57. Taking the above-mentioned personal asset 57 as an example, the personal terminal 50 encrypts the personal asset 57 through the exclusive public key corresponding to the business terminal 40 of the business to which it intends to conduct business.

According to some embodiments, please refer to FIG. 2. When the personal terminal 50 encrypts the personal asset 57 through the personal encryption module 53, in addition to encrypting with the exclusive public key of the user terminal that wants to receive the personal asset 57, it is further a digital signature (Digital signature) Asymmetric encryption is performed on the individual assets 57 in a manner, and then the encrypted individual assets 57 are uploaded to the blockchain network 20 through the personal blockchain module 51. Among them, the asymmetric encryption can provide an exclusive public key and an exclusive private key for any user end that can be connected to the blockchain network 20.

Still referring to FIG. 2, for example, any one of the above personal terminals 50, which has an exclusive one public key and one private key 56, through the personal exclusive and unique digital signature (that is, the above private key 56) encrypts the plain text with the RSA algorithm ( For example, the above mentioned assets 57). Any user end connected to the above-mentioned blockchain network 20 can decrypt the encrypted plaintext (for example, the above-mentioned individual 57) through the corresponding public key to which the user end belongs.

Still referring to FIG. 2, taking the above-mentioned personal asset 57 as an example, since the personal asset 57 is encrypted by the personal private key 56 exclusive to the personal terminal 50, that is, the personal private key 56 only corresponds to the personal terminal 50, Therefore, it has the digital signature function mentioned above, which can be used to identify the user end of the encrypted plaintext (the above-mentioned personal resource 57), and directly correspond to the signed user end, so as to achieve the effect of identity confirmation.

According to some embodiments, please refer to FIG. 1 again, when the personal terminal 50 wants to further maintain the personal assets 57 to which the personal terminal 50 belongs by using the personal management module 52, the personal decryption module 54 needs to be Only after the personal secret key 56 is decrypted can the personal asset 57 be edited by the personal management module 52.

Referring again to FIG. 1, the personal decryption module 54 decrypts the business smart contract 44 that the business terminal 40 transmits to the personal terminal 50 through the personal blockchain module 51 through the personal private key 56. Since the business smart contract 44 is also asymmetrically encrypted and uses the personal public key of the personal terminal 50 to encrypt the business smart contract 44, the personal terminal 50 can decrypt it through its private personal key 56. The above business smart contract 44.

Still referring to FIG. 1, the personal contract module 55, through the personal blockchain module 51, signs the decrypted business smart contract 44 and encrypts the business contract 44 with asymmetric encryption and provides a license The key 58 is given to the business decryption module 43 of the business terminal 40 to authorize the business terminal 40 to obtain all or part of the personal assets 57.

According to some embodiments, the asymmetric encryption method described above is that the personal terminal 50 only encrypts the business smart contract 44 that has been signed with the private public key corresponding to the business terminal 40, or supplemented with a personal private key 56, In the above-mentioned business capability contract 44, the above-mentioned license key 58 is attached. The business terminal 40 can open the business smart contract 44 signed by the personal terminal 50 through the private key corresponding to the business terminal 40. In addition, the service terminal 40 can access all or part of the corresponding personal resources 57 through the license key 58 provided by the personal terminal 50.

In addition, please refer to FIG. 3, which depicts a flowchart of steps of the identity management and authorization method. Corresponding to the above-mentioned identity management and authorization device, the present invention further discloses another identity management and authorization method 60. The above-mentioned identity management and authorization method 60 uses the above-mentioned identity management and authorization device 10 and includes the following steps:

First, please still refer to FIG. 3, in step S63, the above-mentioned supervisor 30 uploads the above-mentioned update request 33. The content of the above update request 33 may further include the institutional units and their clients announced by the above-mentioned competent terminal 30 and required to be supervised or supervised by the above-mentioned competent terminal 30, to update relevant materials or their formats, for example, to fill in the above-mentioned personal information of at least one personal terminal 50 57, or update the above requirements of at least one personal terminal 50 with the latest template published by the above-mentioned supervisor terminal 30.

Still referring to FIG. 3, in step S62, the business terminal 40 uploads the business smart contract 44 to provide the personal terminal 50 to sign the business smart contract 44. It is worth mentioning that the above-mentioned business terminal 40 can upload the above-mentioned business smart contract 44 at any time, which means that the step sequence and step S63 (the above-mentioned supervisor terminal 30 uploads the above-mentioned update request 33) are not Related, without any order, even uploading at the same time.

According to some embodiments, the content of the above-mentioned business smart contract 44 may further include any business content that any of the above-mentioned business terminals 40 can provide, for example, for financial institutions, deposits, transfers, loans, cross-bank remittances, Fund investment or cross-border remittance and other business content.

Still referring to FIG. 3, in step S64, the personal terminal 50 confirms whether the update request 33 uploaded by the supervisor terminal 30 is completed. If the update is not completed, the follow-up other business content cannot be processed, and the process is directly directed to Step S67, the process of the method 60 of identity management and authorization described above ends. If the update is completed, the flow continues to step S65.

Still referring to FIG. 3, in step S65, if the personal terminal 50 completes the update, the business smart contract 44 corresponding to the business to be processed is obtained. If the content of the business smart contract 44 is not agreed or not signed, the follow-up cannot be performed For other business content to be handled, the process is directly directed to step S67, and the process of the above-mentioned method 60 of identity management and authorization is ended. If the content of the above-mentioned business smart contract 44 is agreed and signed, the flow continues to step S66.

According to some embodiments, in step S65, if the personal terminal 50 agrees and signs the business smart contract 44, the signing will be further through an asymmetric encryption method, and the personal terminal 50 only uses the exclusive public corresponding to the business terminal 40 The key, or supplemented with a personal private key 56, encrypts the above-mentioned business smart contract 44 that has been agreed to be signed, and the above-mentioned permission key 58 is attached to the above-mentioned business capability contract 44.

Still referring to FIG. 3, in step S66, if the personal terminal 50 agrees and signs the business smart contract 44, the business terminal 40 can obtain the personal assets of the personal terminal 50 according to the authorized business smart contract 44 In order to handle the business content related to the above personal terminal 50, and guide the flow to S67, the above method 60 of identity management and authorization is ended.

According to some embodiments, the business smart contract 44 may further include the individual asset withdrawal contract, and the individual asset withdrawal contract stipulates to include a range and an withdrawal of the individual asset 57 that the business terminal 40 can access. the term. The above scope is defined to include the scope of the personal resources of the personal terminal 50 that can be used when the business terminal 40 has undertaken the contract content that has been authorized by the personal terminal 50. Personal authorization. The above-mentioned withdrawal period clearly specifies the withdrawal period that the above-mentioned business terminal 40 can withdraw the personal funds of the above-mentioned personal terminal 50 because it undertakes the contract content that has been authorized and agreed by the above-mentioned personal terminal 50, and leads the process to S67, ending The above method 60 of identity management and authorization.

According to some embodiments, due to the contract content specification of the individual capital use contract, the business decryption module 43 decrypts the business signed and encrypted by the personal terminal 50 through the business private key and the license key 58, respectively. Smart contract 44 and the above-mentioned personal assets 57, and within the above-mentioned withdrawal period, withdraw the above-mentioned range of authorized personal assets, carry out the related business undertaken by the above-mentioned business end 40, and guide the process to S67, ending the above-mentioned identity management and Authorized method 60 flow.

Combining the above identity authorization and management devices and identity authorization and management methods, due to the inherent technology of the blockchain network, data can be continuously written, decentralized (that is, decentralized), and updated in real time, and the data is The data history record has the characteristics of traceability and non-repudiation. Then through the establishment and signing of relevant smart contracts, it can solve the problems that customers have to repeatedly update their capital and consume the manpower of the undertaking business organization.

In addition, the data uploaded to the blockchain network, such as the customer's personal data, if asymmetrically encrypted, the encrypted data history can have unchangeable characteristics. Compared with paper customer data in traditional banking institutions, or electronic customer data that has been managed by a central device, it is more efficient and has relatively safe data storage. In addition, government agencies can also participate and become unit nodes in the blockchain network. Through the immediacy of the blockchain network and the compulsion of smart contracts, the purposeful prevention can be effectively and comprehensively achieved, creating a security And reliable smart financial operation platform.

The present invention is disclosed in the preferred embodiments herein. However, any person skilled in the art should understand that the above embodiments are only used to describe the present invention and are not intended to limit the scope of the patent rights claimed by the present invention. Any changes or replacements that are equivalent or equivalent to the above embodiments should be interpreted as being covered within the spirit or scope of the present invention. Therefore, the scope of protection of this new model shall be subject to the scope defined in the following patent application.

10: Identity management and authorization device 20: Blockchain network 30: supervisor 31: Competent blockchain module 32: Supervisor announces the module 33: Update requirements 40: Business side 41: Business Blockchain Module 42: Business contract module 43: Business decryption module 44: Business Smart Contract 50: Personal side 51: Personal blockchain module 52: Personal management module 53: Personal encryption module 54: Personal decryption module 55: Personal contract module 56: personal private key 57: Personal 58: License key 60: Methods of identity management and authorization S61-S67: Step

In order to make the above and other objects, features, advantages and embodiments of the present invention more obvious and understandable, the attached drawings are described as follows: FIG. 1 is a schematic structural diagram of an identity management and authorization device. FIG. 2 is a schematic diagram of individual resource access of the business end and personal end of the identity management and authorization device. Figure 3 depicts a flowchart of the steps of the identity management and authorization method.

10: Identity management and authorization device

20: Blockchain network

30: supervisor

31: Competent blockchain module

32: Supervisor announces the module

33: Update requirements

40: Business side

41: Business Blockchain Module

42: Business contract module

43: Business decryption module

44: Business Smart Contract

50: Personal side

51: Personal blockchain module

Claims (5)

An identity management and authorization device applied to a blockchain network that executes smart contracts. The device includes: A supervisor, including: A supervisor blockchain module, including a supervisor database, the supervisor blockchain module is used to communicate with the blockchain network and update all data of the blockchain network to the supervisor database; and A supervisor announces the module, and through the supervisor blockchain module, announces an update request to the blockchain network; At least one service end, each of these service ends includes: A business blockchain module, including a business database, the business blockchain module is used to communicate with the blockchain network and update all data of the blockchain network to the business database; A business contract module, providing a business smart contract to the blockchain network through the business blockchain module; and A business decryption module; and At least one personal end is located on the blockchain network, and each of the personal ends includes: A personal blockchain module, including a personal database, the personal blockchain module is used to communicate with the blockchain network and update all data of the blockchain network to the personal database; A person management module to maintain a resource on the personal side; A person encryption module encrypts the asset before uploading it to the blockchain network; A person decryption module uses a person's private key to decrypt the asset and the business smart contract that the business side passed to the individual side through the personal blockchain module; and A person contract module signs the decrypted business smart contract through the personal blockchain module, and provides a license key to the business decryption module of the business end to permit the business end to obtain the capital. For example, the identity management and authorization device of claim 1, wherein the update request requires the at least one personal terminal to update the asset to which it belongs. For example, the identity management and authorization device of claim 1, wherein the business smart contract further includes a capital withdrawal contract, and the capital withdrawal contract stipulates to include a range and a withdrawal of the capital available to the business end Expiry date. For example, the identity management and authorization device of claim 3, wherein the business end uses the license key and obtains the range and the withdrawal period of the asset through the asset withdrawal contract. For example, the identity management and authorization device of claim 1, wherein the personal blockchain module updates the asset encrypted with the asset encryption module and connects to the blockchain network to ensure that the supervisor database, All the data in the business databases and the personal databases contain the updated and encrypted assets.

Images