WO2022149816A1

WO2022149816A1 - System and method for providing blockchain-based corporate did service

Info

Publication number: WO2022149816A1
Application number: PCT/KR2022/000038
Authority: WO
Inventors: 채상미; 박민정; 김종현; 이명준
Original assignee: 이화여자대학교 산학협력단
Priority date: 2021-01-06
Filing date: 2022-01-04
Publication date: 2022-07-14
Also published as: KR102302097B1

Abstract

The present invention provides a system for providing a corporate decentralized identity (DID) service. More specifically, the present invention relates to a system and a method for providing a blockchain-based corporate DID service, the system and the method providing an electronic corporate authentication means through the distributed DID on the basis of a blockchain technology. According to one embodiment of the present invention, the self-sovereign identity (SSI), which is the conventional development purpose of DID, having been mainly developed for individuals, and data ownership can be extended up to the corporation, and, currently, various problems such as the presence of security vulnerabilities accompanying electronic contracts, electronic registrations, electronic financial transactions and the like, low trust between transaction parties, the inability to guarantee transaction safety, the abuse of personal information, and complicated and cumbersome paperwork required to perform the electronic transaction can be solved.

Description

Blockchain-based corporate DID service providing system and method

The present invention relates to a corporate DID (Decentralized Identity) service providing system, and in particular, to a blockchain-based corporate DID service providing system and method that provides an electronic corporate authentication means through decentralized, decentralized identification based on blockchain technology. it's about

In general, a corporation often needs to prove its corporate seal for various tasks that the corporation has to handle.

In particular, in order for a corporation to conclude a contract with a government institution or process a business for a financial institution such as a bank, a certified copy of the corporate register, corporate seal seal, user registration certificate, power of attorney when signing an agent (representative, proxy’s corporate seal seal, seal certificate) Required), etc., require considerable required documents, which reduces convenience and causes a lack of reliability and stability of the contract.

Among the required documents, a corporate seal card is required to prove that it is a corporation in order to issue a corporate seal certificate and a certified copy of corporation registration. The above corporate seal card is a physical card, introduced for the purpose of convenient business processing, and has an advantage in that electronic registration and unmanned document issuance are possible. As such, if the person in charge of the company abuses it without the approval of the representative of the corporation, there is a risk that it can be abused by issuing corporate documents.

In addition, as it can be easily copied and stored on public certificates, personal computers, USB devices, etc. required for corporate financial business processing, there is a possibility of misuse, and there is always a risk of leakage or loss due to hacking.

The corporate seal card has a limitation that the company representative cannot substantially handle all the procedures such as issuance and submission of documents necessary for business operation, such as accredited certificates and corporate seal cards. However, it is not free from low security and safety problems caused by employee abuse and hacking.

On the other hand, publicly-known public certificates are issued through a trusted approval authority (CA), and individual self-sovereignty and security are not guaranteed in that the identity information in the issuing authority is collectively stored.

In addition, the electronic signature was developed for the use of electronic contracts and e-commerce transactions, and the purpose is to provide integrity and non-repudiation functions so that it is impossible to change or delete the contents of the signed document and to deny the fact of the signature. , there is a problem that anyone can verify the signature as the verification key uses the public key method. It is impossible to verify whether the sender's public key is correct, and there is a possibility that a problem may occur if a hacker deceives himself as the sender and sends it.

Therefore, it can be said that there is no effective means for securing the reliability and integrity of various legal entity authentication technologies, including the electronic signature, which is a requirement for electronic contract conclusion, in corporations to date.

[Prior art literature]

Korean Patent Publication No. 10-2131206 (Announcement Date: 2020.08.05.)

The present invention has been devised to solve the above problems, and the present invention provides a corporate DID, a new concept authentication means based on a decentralized identity (DID) technology that can replace the existing corporate seal card. There is a task to do.

In order to solve the above problems, the blockchain-based corporate DID service providing system according to an embodiment of the present invention uses a blockchain network that stores the issued DID, and a first personal DID that certifies the identity of the person in charge of the company. A person in charge terminal requesting issuance of the corporate DID of the company to which the person in charge belongs, a representative terminal that approves the use of the corporate DID using a second personal DID that certifies the identity of the corporate representative in response to the request for issuance of the corporate DID; and , in response to a corporate DID issuance request approved for use by the representative terminal, a corporate DID is issued by combining the first and second personal DIDs with corporate-related data, and the issued corporate DID is registered in the blockchain network and the person in charge It may include a DID issuer server distributed to the terminal.

The terminal in charge requests issuance of the first personal DID to the DID issuer server, a personal DID management unit receiving the issued first personal DID, and the DID issuer server to request issuance of the corporate DID, and the corporation A corporate DID management unit that receives related data and submits it to the DID issuer server, receives the issued corporate DID, a corporate DID submitter that submits the distributed corporate DID to the service provider server according to the purpose of use, and the first personal DID and a storage for storing the corporate DID.

The representative terminal requests issuance of the second personal DID from the DID issuer server, a personal DID management unit receiving the issued second personal DID, and a corporate representative authority to receive approval for use of the corporate DID issuance request. and a storage for storing the use approval unit provided to the DID issuer server and the second personal DID.

The DID issuer server includes an issuance reception unit that receives a request for issuance of a DID from the person in charge terminal and the representative terminal, an identity verification unit that verifies the identity of the person in charge of the company and the company representative using the first and second personal DIDs, and identity verification Approval request unit that requests approval of use from the representative terminal of the company representative for the requested corporate DID issuance, and a DID generator that generates and registers corporate DIDs for corporate DID issuance requests that have been verified and approved for use in the blockchain network and a DID distribution unit distributing the generated DID to a terminal in charge or a representative terminal.

The DID generating unit may generate corporate-related data by processing the corporate seal image file and purpose of use provided from the terminal in charge, and reflect the corporation-related data in the DID document of the corporation DID.

The corporation-related data may include data obtained by hashing the corporate seal image file through a predetermined hash function.

The DID issuer server, when a usage history including a usage period occurs for the corporate DID, hashes the usage history, adds it to the DID document of the corporate DID, registers it in the blockchain network, and when the usage period elapses, the It may further include a DID management unit that discards the corporate DID and registers it in the blockchain network.

In addition, in order to solve the above problem, a corporate DID service providing method using a block chain network according to an embodiment of another aspect of the present invention is a corporate DID service providing method using a block chain network storing the issued DID, , requesting, by the person in charge terminal, to the DID issuer server for issuance of a corporate DID of the company to which the person in charge belongs by using the first personal DID that proves the identity of the person in charge of the company; replying to the representative terminal for approval of use in response to the corporate DID issuance request requested by the company; requesting the DID issuer server for permission to use the issuing the DID, and registering the corporate DID issued by the DID issuer server to the block chain network and distributing the issued corporate DID to the terminal in charge.

Before the step in which the person in charge terminal requests the DID issuer server to issue a corporate DID of the company to which the person in charge belongs using the first personal DID that proves the identity of the person in charge of the company, the terminal in charge sends the first personal DID to the DID issuer server 1 requesting the issuance of a personal DID, the DID issuer server issuing a first personal DID for the person in charge of the company and registering the first personal DID in the blockchain network, and the DID issuer server sends the registered first personal DID to the person in charge It may include distributing to the terminal, and storing the distributed first personal DID in a storage by the terminal in charge.

Before the representative terminal requests the DID issuer server to approve the use of the corporate DID using a second personal DID that proves the identity of the corporate representative in response to the corporate DID issuance request, the representative terminal requesting the DID issuer server to issue the second personal DID, the DID issuer server issuing a second personal DID for the company representative and registering it in the blockchain network, the DID issuer server registering The method may include distributing the distributed second personal DID to the representative terminal, and storing the distributed second personal DID by the representative terminal in a storage.

The step of issuing, by the DID issuer server, a corporate DID by combining the first and second personal DIDs with corporate-related data in response to a corporate DID issuance request approved for use by the representative terminal, comprises: the terminal in charge of the DID issuer server providing a corporate seal image file and purpose of use to the server, generating corporate related data by processing the corporate seal image file and purpose of use provided by the DID issuer server; and, by the DID issuer server, reflecting the corporation-related data in the DID document of the corporation DID.

After the DID issuer server registers the issued corporate DID in the block chain network and distributes it to the terminal in charge, when the DID issuer server generates usage details including the period of use for the corporate DID, the usage details are hashed and registering in the blockchain network by adding it to the DID document of the corporate DID; and discarding the corporate DID when the DID issuer server elapses the period of use and registering in the blockchain network. have.

According to an embodiment of the present invention, self-sovereign identity security (SSI) and data ownership, which is the purpose of the development of DID, which is being developed mainly for individuals, can be extended to corporations, and currently, electronic contracts, electronic registration, electronic financial transactions, etc. It has the effect of solving various problems such as the existence of accompanying security vulnerabilities, low trust between transaction parties, inability to guarantee the safety of transactions, abuse of personal information, and complicated and cumbersome document procedures required to conduct electronic transactions.

1 is a diagram schematically showing the overall structure of a blockchain-based corporate DID service providing system according to an embodiment of the present invention.

2 is a diagram showing the structure of a terminal in charge of a blockchain-based corporate DID service providing system according to an embodiment of the present invention.

3 is a diagram showing the structure of a DID issuer server of a blockchain-based corporate DID service providing system according to an embodiment of the present invention.

4 is a diagram illustrating a method of providing a corporate DID service by a blockchain-based corporate DID service providing system according to an embodiment of the present invention.

5 is a diagram illustrating a personal DID or corporate DID issuance procedure applied to a blockchain-based corporate DID service providing system according to an embodiment of the present invention.

Prior to the description, when a part in the entire specification "includes" or "includes" a certain component, it does not exclude other components, but may further include other components unless otherwise stated. means there is In addition, terms such as "...unit", "...server", "...system", etc. described in the specification mean a unit that processes at least one function or operation. and may be implemented by hardware, software, or a combination of hardware and software.

In addition, the term "embodiment" herein means serving as an illustration, example, or illustration, but the subject matter of the invention is not limited by such examples. Also, "comprising", "comprising", "having" and other similar terms are used, but when used in the claims, " as an open-ended transition word that does not exclude any additional or other element. It is used generically in a manner analogous to the term "comprising".

The various techniques described herein may be implemented in conjunction with hardware or software, or a combination of both, where appropriate. As used herein, terms such as "...Unit", "...Server", "...System" and the like likewise refer to computer-related entities, i.e., hardware , a combination of hardware and software, software or software in execution may be treated as equivalent. In addition, each function implemented in the system of the present invention may be configured as a module unit program, and may be recorded in one physical memory, or may be recorded while being distributed between two or more memories and recording media.

In the following description, a term indicating a 'blockchain-based corporate DID service providing system' according to an embodiment of the present invention may be abbreviated as 'corporate DID service providing system' or 'system'.

In addition, in the following description, '~ terminal' is a concept indicating a predetermined computing device that accesses the system and requests a service, or an application program itself running in the predetermined computing device.

Hereinafter, a blockchain-based corporate DID service providing system and method according to an embodiment of the present invention will be described in detail with reference to the drawings.

Referring to FIG. 1 , the blockchain-based corporate DID service providing system according to an embodiment of the present invention uses a blockchain network 100 that stores the issued DID, and a first personal DID that certifies the identity of the person in charge of the company. Approving the use of the corporate DID by using the person in charge terminal 200 requesting issuance of the corporate DID of the company to which the corporate manager belongs, and a second personal DID that proves the identity of the corporate representative in response to the request for issuance of the corporate DID In response to a request for issuance of corporate DID approved for use from the representative terminal 300 and the representative terminal, a corporate DID is issued by combining the first and second personal DIDs and corporate-related data, and the issued corporate DID is applied to the blockchain network 100 It may include a DID issuer server 400 for registering and distributing to the terminal 200 in charge.

The blockchain network 100 includes a plurality of distributed ledgers for identity verification, and participants in the blockchain network 100 use a distributed ledger through a smart contract according to a predetermined consensus procedure. information can be recorded or retrieved.

In particular, in the blockchain network 100, the issued corporate DID and DID document are distributed and stored in a plurality of blocks, and the DID document for the corporate DID provided from the terminal 200 in charge according to the request of the service provider server 600 is provided. By providing, the service provider server 600 identifies the purpose of the corresponding company and corporate DID, and confirms the authority to provide the requested service.

The person in charge terminal 200 is a terminal device or application program used by an employee belonging to the corresponding company, and an employee who has the authority to manage and use a certified copy of the corporate register, a corporate seal seal, and a user registration certificate is a corporate transaction through the system of the present invention. A corporate DID can be applied for, issued, and provided to the service provider as a means of proof of corporate identity for contract and other procedures.

To this end, the person in charge of the company is issued a personal DID that can prove that he or she is the person in charge with the authority of the job through the system using the person in charge terminal 200, and the representative of the company using the personal DID In addition to requesting approval from the company, upon completion of approval, the company will request issuance of a corporate DID using his/her personal DID and the representative's personal DID.

Here, even in the same company, general employees are limited in the authority to call representatives for issuing powers of attorney and approval of powers of attorney, and only the participants who are in charge of the company who have the authority to do the work can have access to the system. Such authority is filtered in the identity verification procedure when issuing the above-described personal DID, and the personal DID without authority may be restricted so that the subsequent corporate DID issuance procedure cannot be performed.

And, when the corporate DID is normally issued by the person in charge terminal 200 and registered in the block chain network 100, the corporate person in charge provides the corporate DID to the service provider server 600 for performing the intended task to perform the identity verification procedure. and can carry out the task.

The representative terminal 300 is a terminal device or application program used by a representative who possesses and manages a corporate seal, such as the representative director of the company, and replaces the corporate seal by the person in charge of the company for tasks requiring the sealing of the corporate seal, such as a corporate contract. The use of corporate DID may be approved.

To this end, the company representative is issued a personal DID that can prove that he is a representative through the system using his/her representative terminal 300, and after that, when an approval for issuance of the corporate DID is requested from the person in charge terminal 200, By using their personal DID to verify identity and to process approval for issuance requests, the company person in charge can be issued a corporate DID.

As a hardware device for executing the above-described representative terminal 200 and representative terminal 300, PCS (Personal Communication System), GSM (Global System for Mobile communications), PDC (Personal Digital Cellular), PHS (Personal Handyphone System) ), PDA (Personal Digital Assistant), IMT (International Mobile Telecommunication)-2000, CDMA (Code Division Multiple Access)-2000, W-CDMA (W-Code Division Multiple Access), Wibro (Wireless Broadband Internet) terminal, smartphone All kinds of handheld-based mobile terminal devices such as (smartphone), smart pad (smartpad), tablet PC (Tablet PC), etc., computing devices such as stationary PCs and notebooks may be used.

The DID issuer server 400 may issue and register a personal DID for identification in the block chain network 100 according to the request of the registered manager terminal 200 and the representative terminal 300 of each registered company, and also the authority In accordance with the request of the terminal 200 in charge of having a representative terminal 300 having an obligation to manage, use, etc. the corporate seal may request approval for use.

Here, the DID issuer server 400 may be operated by a separate company or institution, or may be independently operated by a company that wants to use the corporate DID service. As an example, the DID issuer server 400 of the present invention may be mounted on a server itself operated by an institution or company that intends to introduce the system of the present invention, or may provide a service in connection with a corporate server.

In addition, the DID issuer server 400 generates a corporate DID for a use request normally approved by the representative terminal 300 and registers it in the block chain network 100, and distributes the corporate DID to the requested person in charge terminal 200. can

In addition, according to an embodiment of the present invention, the DID issuer server 400 is a separate company or institution in order to verify the ownership of the DID submitted by the requester when the DID issuance request of the person in charge terminal 200 and the representative terminal 300 is requested. You can also request authentication for DID ownership from a server operated by others.

The DID issuer server 400 includes a high-performance microprocessor and large capacity to quickly respond without errors and delays to personal DID and corporate DID issuance requests, use approvals, etc. of a plurality of the person in charge terminal 200 and the representative terminal 300 . A server device equipped with memory and storage may be used.

After that, when the identity of the user of the personal DID is verified in the DID issuer server 400 or the service provider server 600, the personal DID stored in the blockchain network is stored using the authentication value generated by the user's private key. By verifying through the public key included in the DID document, it is possible to verify the user, that is, the company representative or the company representative.

The service provider server 600 is a server device that provides various corporate business services performed by a corporation through a corporate seal or corporate seal card. It can be performed through the corporate DID provided by the system of the present invention.

This service provider server 600 refers to the DID document identified through the corporate DID from the blockchain network when the person in charge terminal 200 requests a predetermined corporate business process through the corporate DID, and the DID ownership of the corporation DID, purpose of use and scope, and provide the requested service through the corporate DID whose identity has been verified through the identity verification process.

According to the above structure, the blockchain-based corporate DID service providing system according to an embodiment of the present invention provides a number of necessary documents such as a corporate registration certificate and corporate seal stamp required to perform business such as corporate contracts in each company. As a substitute, the corporate person in charge can receive a one-time corporate DID according to the purpose through his/her terminal and perform related tasks, thereby solving various problems such as complex document processing, misuse of corporate documents and security vulnerabilities, and stabilizing corporate transactions. And there is an effect that can handle the work.

Hereinafter, a terminal in charge of a blockchain-based corporate DID service providing system according to an embodiment of the present invention will be described in detail with reference to the drawings.

2 is a diagram showing the structure of a terminal in charge of a blockchain-based corporate DID service providing system according to an embodiment of the present invention. In the following description, each component constituting the person in charge terminal 200 and the person in charge terminal 200 may be composed of a computer program executable by a known microprocessor, and is recorded on a readable and writable recording medium and mounted on the terminal device. can be

2 is a diagram showing a terminal 200 in charge of a blockchain-based corporate DID service providing system according to an embodiment of the present invention requests the DID issuer server 400 to issue the first personal DID, and the issued first personal DID Requests issuance of corporate DID to the personal DID management unit 210 receiving the distribution, DID issuer server 400, receives corporate-related data, submits it to the DID issuer server 400, and receives corporate DID distribution It may include a management unit 220, a corporate DID submission unit 230 for submitting the distributed corporate DID to the service provider server 600 according to the purpose of use, and a storage 240 for storing the first personal DID and corporate DID. have.

The personal DID management unit 210 may provide various management functions for the first personal DID, which is the DID issued to the person in charge of the company. The personal DID management unit 210 may request the issuance of the first personal DID for identification as a person belonging to the corresponding company, the DID issuer server 400, a server operated by the company, or the like, and the issued first individual The DID may be stored in the storage 240 and, later, when the person in charge of the company wants to prove his/her identity, the stored first personal DID may be submitted to perform an identity verification procedure.

The corporate DID management unit 220 may provide a function related to the corporate DID. In an embodiment of the present invention, a first personal DID may be issued, and a corporate DID for business processing may be generated and distributed based on this. The person in charge of the company holding the first personal DID may request issuance of the corporate DID through the person in charge terminal 200 when a business requiring a corporate seal, such as a corporate contract, is performed, and the corporate DID management unit 220 is stored in the storage 240 . If the corporate DID does not exist, the first personal DID may be submitted to the DID issuer server 400 and an application for the corporate DID may be issued. In this case, the corporate DID management unit 220 may receive information such as the purpose of use of the corporate DID, the submitting institution (company), the corporate representative name and date, and the like, from the person in charge of the corporation.

Accordingly, the DID issuer server 400 may identify a corporate representative in response to a corporate DID issuance application and request approval for corporate DID issuance from the representative terminal.

Thereafter, when the corporate DID is normally issued and distributed, the corporate DID management unit 220 may store the distributed corporate DID in the storage 240 .

The corporate DID submission unit 230 may submit the corporate DID stored in the storage 240 to the service provider server 600 according to the execution of the corporate person in charge. In this case, the corporate DID submission unit 230 may register information such as a submission destination and usage history of the corporate DID in the blockchain network.

The storage 240 may store a personal DID and a corporate DID that are currently in effect. Of these, in general, as a corporate DID has a period of use, a corporate DID whose use period has elapsed may be automatically discarded.

In addition, the person in charge terminal 200 according to an embodiment of the present invention may be stored in a Trusted Execution Environment (TEE) area within the terminal so that the person in charge of the company can manage his/her personal information including personal DID, Accordingly, the storage 240 may exist in the TEE area.

The aforementioned TEE stores personal information including DID on a processor in which a secure normal area and a secure area in which a general application is executed are separated, and information exchange with the general area is controlled and There are features that support security software to run safely.

For example, in a mobile terminal such as a smartphone, an architecture-based processor of ARM Corporation is widely used, and when an ARM processor is installed in the terminal in charge 200 , personal information is stored in TrustZone for TEE support. can be recorded and managed.

In addition, when the person in charge terminal 200 is not a mobile terminal, but an x86, x64-based desktop or laptop computer, a Trusted Platform Module (TPM), which is a separate security module, may be mounted, and the storage 240 is the TPM. It can be created and managed in personal information through this.

Accordingly, when the person in charge terminal 200 wants to access personal information, limited access is possible only through its own application.

On the other hand, although not shown, according to an embodiment of the present invention, in addition to the above-described person in charge terminal 200, the representative terminal used by the representative who performs approval for the corporate DID request may also include a component for using the system. . In detail, the representative terminal requests the issuance of the second personal DID from the DID issuer server and the personal DID management unit that receives the issued personal DID, and the corporate DID issuance request request from the person in charge terminal 200 with the authority of the company representative. It may include a usage approval unit that receives the usage approval input and provides it to the DID issuer server 400, and a storage for storing the second personal DID.

Hereinafter, the DID issuer server of the blockchain-based corporate DID service providing system according to an embodiment of the present invention will be described in detail with reference to the drawings.

Referring to FIG. 3 , the DID issuer server 400 of the blockchain-based corporate DID service providing system according to the embodiment of the present invention receives a DID issuance request from the person in charge terminal 200 and the representative terminal 300. 410), an identity verification unit 420 that performs identity verification using the first and second personal DIDs, and an approval request unit that requests approval of use from the representative terminal of the company representative in response to a request for issuance of the verified corporate DID ( 430), a DID generating unit 440 that generates a corporate DID for a corporate DID issuance request that is verified and approved for use and registers it in the blockchain network 100, and uses the generated DID to the person in charge terminal 200 or the representative terminal 300 ), when the usage history including the period of use for the DID distribution unit 450 and the corporate DID occurs, the usage history is hashed and added to the DID document of the corporate DID, registered in the blockchain network 100, and allowed to use time It may include a DID management unit 460 that discards the corporate DID and registers it in the block chain network 100 when .

The issuance reception unit 410 may receive the first personal DID according to the request of the person in charge terminal 200 to receive the issuance request for the corporate DID. A person in charge of a company who wants to use the corporate DID for business may submit the first personal DID stored in the person in charge terminal 200 to the DID issuer server 400 and apply for issuance of the corporate DID, and the issuance reception unit 410 is the first individual You can input DID and various information necessary for issuing corporate DID.

The identity verification unit 420 may perform an identity verification procedure for the submitted first personal DID in response to the corporate DID issuance request. The identity verification unit 420 may request identification for the first personal DID by obtaining a DID document from the blockchain network 100 through the first personal DID and confirming the public key. In addition, the person in charge terminal 200 generates a public key authentication value using the private key and provides it to the identity verification unit 420 , and the identity verification unit 420 checks the authentication value using the public key, so that the identity will be verified.

Also, the identity verification unit 420 may verify the identity of the second personal DID, that is, the company representative, according to the same procedure as above.

Upon receipt of the corporate DID request, the approval request unit 430 may request approval for use of the corporate DID request from the representative terminal 300 of the company representative of the identified company, and the corporate representative whose identity is verified through the second personal DID. It is possible to confirm the issuance of the corporate DID by receiving a reply from the representative terminal 300 of the use approval.

The DID generator 440 may generate a corporate DID in response to a corporate DID request for which the corporate DID issuance is confirmed according to the approval of use of the representative terminal 300 . In particular, the DID generating unit 440 according to an embodiment of the present invention generates the corporate DID of the corresponding company, the first and second personal DIDs with the verified identity, the image file for the actual corporate seal, and the terminal 200 in charge. ), a unique index can be created by combining information including the purpose of use, period of use, etc. of the corporate seal input by It is possible to create a corporate DID and its DID document by reflecting it in the DID document. Here, when generating personal DID and corporate DID, a hash function may be used in a given method according to the characteristics of the platform of the applied blockchain network 100, and it is not limited to the method applied to a specific platform.

The DID distribution unit 450 may distribute the generated corporate DID to the terminal 200 in charge, and record and register the corporate DID and DID document in the blockchain network 100 . At this time, the DID generator 440 generates a transaction by executing a smart contract for registration of corporate DID, and the blockchain network 100 determines the legitimacy of the transaction through a known consensus algorithm, and distributes and stores it in the distributed ledger. will do

Thereafter, the person in charge terminal 200 may use the corporate DID for business operation, and when using the corporate DID, the service providing server may proceed normally according to whether or not it meets the predetermined purpose of use in the identity verification procedure or the like. That is, the corporate DID according to the embodiment of the present invention has the effect of sealing the corporate seal only when it meets a preset purpose of use.

DID management unit 460 after distribution of the corporate DID, when a business using the corporate DID by the person in charge terminal 200 occurs, identification of the service provider server that handles the business, the DID document reference, etc. When procedures such as reference are in progress, the details After tracking, the distributed ledger related to the corporate DID can be updated, or the details of the corporate DID can be additionally recorded.

That is, the DID management unit 460 hashes the usage history, including the usage period, for the corporate DID, generates a transaction for the block chain network 100, and adds it to the DID document of the corporate DID. can be registered in

Here, not only the purpose of use, but also the available time defined in the DID document, that is, the permitted time is further set in the corporate DID, and the DID management unit 460 discards the corporate DID so that the corporate DID cannot be used any more when the permitted time has elapsed. can do. This is to secure the transparency of transaction details by preserving all transaction details related to corporate DID.

Hereinafter, a method of providing a corporate DID service by a blockchain-based corporate DID service providing system according to an embodiment of the present invention will be described in detail with reference to the drawings.

Referring to FIG. 4 , the corporate DID service providing method by the blockchain-based corporate DID service providing system according to the embodiment of the present invention is a corporate DID service providing method using the blockchain network 100 that stores the issued DID. In this case, the step (S100) of the person in charge terminal 200 requesting the DID issuer server 400 to issue a corporate DID of the company to which the person in charge belongs by using the first personal DID that proves the identity of the person in charge of the company (S100), the DID issuer server Step (400) requesting approval for use of the corporate DID issued by the first personal DID requested by the identity-verified first personal DID to the representative terminal 300 (S200), the representative terminal 300 responds to the corporate DID issuance request Thus, using the second personal DID to prove the identity of the corporate representative, a step of replying to the DID issuer server the approval for use of the corporate DID (S300), the DID issuer server issues the corporate DID approved for use from the representative terminal 300 In response to the request, a step of issuing a corporate DID by combining the first and second personal DIDs with corporate-related data (S400), and the DID issuer server 400 registering the issued corporate DID in the blockchain network 100 and It may include the step of distributing to the person in charge terminal 200 (S500).

First, as a step (S100), in which the terminal in charge requests the DID issuer server to issue a corporate DID of the company to which the person in charge belongs by using the first personal DID that proves the identity of the person in charge of the company, the company in agreement with the system of the present invention In order to perform a business that requires a corporate seal by using the first personal DID for identification verification, the company manager, such as executives and employees of You can request the issuance of a corporate DID.

Here, the first personal DID may be issued directly from the corporate server operated by the company to which the first personal DID belongs, or may be issued from the DID issuer server through the personal DID issuance service of the DID issuer server of the present invention.

Next, in the step (S200) of the DID issuer server requesting approval for use to the representative terminal for the corporate DID issuance request requested by the first personal DID whose identity has been verified, You can identify the representative of the corresponding company and request approval for the issuance of the corporate DID from the representative's terminal.

Next, in response to the request for issuance of the corporate DID, the representative terminal requests the DID issuer server to approve the use of the corporate DID using the second personal DID that proves the identity of the corporate representative (S300), If the corporate representative approves upon request, the representative terminal submits the stored second personal DID to the DID issuer server and approves the issuance of the corporate DID.

Here, the second personal DID may be issued by the same procedure, except that the subject is different from the first personal DID described above.

Next, in the step (S400) of the DID issuer server issuing a corporate DID by combining the first and second personal DIDs with corporate-related data in response to a corporate DID issuance request approved for use from the representative terminal, After creating a unique index by combining the first and second personal DIDs certified by the company, information including the purpose and period of use of the corporate DID, and the image file for the actual corporate seal, hashing the result of the combination, By creating a corporate DID that includes a unique index in the DID document and registering it in the blockchain network, a corporate DID for the request is issued.

Next, in the step (S500) of the DID issuer server registering the issued corporate DID in the block chain network and distributing the corporate DID to the terminal in charge, the DID issuer server transmits the corporate DID issued in step S400 to the terminal in charge of the requesting distribution procedure. will perform

Thereafter, the terminal in charge may use the corporate DID stored therein to replace the corporate seal according to the purpose of use to process tasks such as corporate contracts.

In addition, after step S500, if it is submitted to the service provider server according to the purpose of use of the corporate DID or the period of use has elapsed, the DID issuer server additionally records the usage history in the DID document of the corporate DID of the blockchain network, and discards the corporate DID. can do.

Hereinafter, the technical idea of the present invention will be described in detail through an example of a DID issuance procedure applied to a blockchain-based corporate DID service providing system according to an embodiment of the present invention with reference to the drawings.

5 is a diagram illustrating a personal DID or corporate DID issuance procedure applied to a blockchain-based corporate DID service providing system according to an embodiment of the present invention. The following description exemplifies how DID is used for identity verification in the DID issuer server of the present invention. Some of the methods may be changed.

In particular, the decentralized identity authentication technology premised by the system of the present invention is an electronic identity authentication technology that stores personal information in the user's terminal and selects and submits only the necessary information for personal information authentication. This has the feature of enabling self-sovereign identity verification that allows individuals to verify their identity without going through a centralized institution by using the blockchain network to directly manage their data.

Referring to FIG. 5 , according to the DID issuance procedure according to the embodiment of the present invention based on the SSI, when a corporate DID is issued using a personal DID that proves his/her identity, the person in charge terminal ( 200), it can be submitted to the DID issuer server 400 in the form of, for example, 'did:sov:abcdef' (a).

Through this, the DID issuer server 400 can identify and obtain a DID document from 'did:sov:abcdef' registered in the blockchain network 100 (b). In addition, the DID issuer server 400 refers to a database operated by itself for 'did:sov:abcdef' and checks whether the issue was issued by the company (c).

Accordingly, when it is confirmed that there is a record in the stored DID issuance history through the 'abcdef' of the personal DID, the authentication value generated by the private key is provided from the terminal in charge 200, and the DID issuer server 400 is the corresponding By verifying the authentication value using the public key extracted from the DID document of the personal DID, it is confirmed that the terminal in charge 200 is the owner of the personal DID (d).

Although many matters are specifically described in the above description, these should be construed as examples of preferred embodiments rather than limiting the scope of the invention. Accordingly, the invention should not be defined by the described embodiments, but should be defined by the claims and equivalents to the claims.

*Description of symbols*

100: Blockchain network 200: Person in charge terminal

210: personal DID management unit 220: corporate DID management unit

230: corporate DID submission unit 240: storage

300: representative terminal 400: DID issuer server

410: issuance connection unit 420: identity verification unit

430: approval request unit 440: DID generation unit

450: DID distribution unit 460: DID management unit

600: service provider server

Claims

a blockchain network that stores issued DIDs;

a person in charge terminal that requests issuance of a corporate DID of a company to which the person in charge of the company belongs by using a first personal DID that proves the identity of the person in charge of the company;

a representative terminal that approves the use of the corporate DID by using a second personal DID that certifies the identity of the corporate representative in response to a request for issuing the corporate DID; and

In response to a corporate DID issuance request approved for use by the representative terminal, a corporate DID is issued by combining the first and second personal DIDs with corporate-related data, and the issued corporate DID is registered in the blockchain network and the terminal in charge DID issuer server that deploys to

A blockchain-based corporate DID service provision system that includes
The method of claim 1,

The person in charge terminal,

a personal DID management unit that requests issuance of the first personal DID from the DID issuer server and receives the issued first personal DID;

a corporate DID management unit that requests issuance of the corporate DID from the DID issuer server, receives the corporate related data, submits it to the DID issuer server, and receives the issued corporate DID;

a corporate DID submission unit that submits the distributed corporate DID to the service provider server according to the purpose of use; and

Storage for storing the first personal DID and corporate DID

A blockchain-based corporate DID service providing system that includes
The method of claim 1,

The representative terminal,

a personal DID management unit that requests issuance of the second personal DID from the DID issuer server and receives the issued second personal DID;

a use approval unit for receiving the approval for use of the corporate DID issuance request with the authority of a company representative and providing it to the DID issuer server; and

Storage for storing the second personal DID

A blockchain-based corporate DID service providing system that includes
The method of claim 1,

The DID issuer server,

an issuance reception unit receiving a request for issuance of the DID from the person in charge terminal and the representative terminal;

an identity verification unit for verifying the identity of the corresponding company person in charge and the company representative using the first and second personal DIDs;

an approval requesting unit for requesting approval for use of the corporate DID issuance request for a verified corporate DID from the representative terminal of the company representative;

a DID generating unit that generates a corporate DID for a request for identity verification and approval of corporate DID issuance and registers it in the blockchain network; and

DID distribution unit that distributes the generated DID to the terminal in charge or the representative terminal

A blockchain-based corporate DID service providing system that includes
5. The method of claim 4,

The DID generating unit,

A blockchain-based corporate DID service providing system that generates corporate-related data by processing the corporate seal image file and purpose of use provided from the terminal in charge, and reflects the corporation-related data in the DID document of the corporation DID.
6. The method of claim 5,

The corporate-related data is

A blockchain-based corporate DID service providing system including data obtained by hashing the corporate seal image file through a predetermined hash function.
5. The method of claim 4,

The DID issuer server,

When a usage history including a period of use is generated for the corporate DID, the use history is hashed, added to the DID document of the corporate DID, and registered in the blockchain network. When the period of use has elapsed, the corporate DID is discarded and the DID management unit that registers in the blockchain network

A blockchain-based corporate DID service providing system that further includes.
In the method of providing a corporate DID service using a blockchain network that stores the issued DID,

requesting, by the person in charge terminal, the issuance of a corporate DID of the company to which the person in charge of the company belongs, to the DID issuer server using a first personal DID that proves the identity of the person in charge of the company;

sending, by the DID issuer server, an approval of use to the representative terminal in response to the corporate DID issuance request requested by the first personal DID whose identity has been verified;

requesting, by the representative terminal, an approval for use of the corporate DID from the DID issuer server by using a second personal DID that certifies the identity of the corporate representative in response to the request for issuing the corporate DID;

issuing, by the DID issuer server, a corporate DID by combining the first and second personal DIDs with corporate-related data in response to a corporate DID issuance request approved for use from the representative terminal; and

Registering, by the DID issuer server, the issued corporate DID to the blockchain network and distributing it to the terminal in charge

A method of providing a blockchain-based corporate DID service, including
9. The method of claim 8,

Prior to the step of the terminal in charge requesting the issuance of the corporate DID of the company to which the company person belongs by using the first personal DID that proves the identity of the person in charge of the company, the DID issuer server

requesting, by the person in charge terminal, to issue the first personal DID to the DID issuer server;

issuing, by the DID issuer server, a first personal DID for the person in charge of the company and registering it in the blockchain network;

distributing, by the DID issuer server, the registered first personal DID to the terminal in charge; and

Storing, by the person in charge terminal, the distributed first personal DID in a storage

A method of providing a blockchain-based corporate DID service, including
9. The method of claim 8,

Prior to the step of the representative terminal requesting the DID issuer server for approval of use of the corporate DID by using a second personal DID that proves the identity of the corporate representative in response to the request for issuing the corporate DID,

requesting, by the representative terminal, to issue the second personal DID to the DID issuer server;

issuing, by the DID issuer server, a second personal DID for the corresponding company representative and registering it in the blockchain network;

distributing, by the DID issuer server, the registered second personal DID to the representative terminal; and

Storing, by the representative terminal, the distributed second personal DID in a storage

A method of providing a blockchain-based corporate DID service, including
9. The method of claim 8,

The step of issuing, by the DID issuer server, a corporate DID by combining the first and second personal DIDs with corporate-related data in response to a corporate DID issuance request approved for use from the representative terminal,

providing, by the person in charge terminal, a corporate seal image file and purpose of use to the DID issuer server;

generating corporate-related data by processing the corporate seal image file provided by the DID issuer server and the purpose of use; and

The step of the DID issuer server reflecting the corporation-related data in the DID document of the corporation DID

A method of providing a blockchain-based corporate DID service, including
12. The method of claim 11,

The corporate-related data is

A method of providing a blockchain-based corporate DID service including data obtained by hashing the corporate seal image file through a predetermined hash function.
9. The method of claim 8,

After the DID issuer server registers the issued corporate DID in the blockchain network and distributes it to the terminal in charge,

when the DID issuer server generates a usage history including a usage period for the corporate DID, hashing the usage history, adding it to the DID document of the corporate DID, and registering it in the blockchain network; and

When the DID issuer server expires the use period, the corporate DID is discarded and registered in the blockchain network.

A method of providing a blockchain-based corporate DID service, including