WO2023095953A1

WO2023095953A1 - Distributed id-based verification credential management device and method, and device verification method and apparatus

Info

Publication number: WO2023095953A1
Application number: PCT/KR2021/017562
Authority: WO
Inventors: 배웅식; 우정민; 강의용; 김광용; 두상균
Original assignee: 주식회사 드림시큐리티
Priority date: 2021-11-24
Filing date: 2021-11-25
Publication date: 2023-06-01
Also published as: KR20230076419A; KR102612463B1

Abstract

A distributed ID-based verification credential management method for achieving the above objective, according to one embodiment of the present invention, comprises the steps of: registering IoT device connection information including first verification credentials corresponding to an IoT device; issuing second verification credentials corresponding to a user; and registering the issued second verification credentials with the IoT device.

Description

Distributed ID-based verification credential management and device verification method and apparatus

The present invention is a system configuration and credential management method capable of issuing distributed ID-based digital identities and credentials and providing identification and authentication services between edge devices and service providers in an IoT environment.

Specifically, the present invention relates to a credential integrated management technology in a multi-distributed identity management service that performs authentication of a device using distributed ID-based credentials.

Recently, decentralized identifiers, which allow users to manage and control their own identity information without a centralized registration authority, are being used in various digital industries. In particular, distributed identifiers are used in various digital certificate services such as mobile driver's licenses and vaccine certificates along with the W3C's Verifiable Credential standard.

However, in the current multi-distributed identity management service environment, users have to install separate applications provided by each service to manage credentials. At this time, when the range of applications to be managed by the user increases, inconvenience in managing and using credentials corresponding to each application is expected. In addition, service providers also bear the burden of building and managing distributed ID storage and communication systems. Therefore, there is an urgent need for a technology capable of integrated management of credentials in a multi-distributed identity management environment.

Prior Art Document: (Patent Document 1) Korean Registered Patent Publication No. 10-2139645 (Title of Invention: Blockchain-based Identity Verification System and Driving Method thereof)

An object of the present invention is to perform authentication of an edge device in an IoT environment using distributed ID-based credentials.

In addition, an object of the present invention is to provide a convenient user experience for integrated management and inquiry/use of credentials in multi-distributed identity management services.

In order to achieve the above object, a distributed ID-based verification credential management method according to an embodiment of the present invention includes the steps of registering IoT device connection information including a first verification credential corresponding to an IoT device, Receiving a corresponding second verification credential, and registering the issued second verification credential to the IoT device.

In this case, the registering of the IoT device connection information includes requesting the first verification credential from the IoT device, receiving a verification presentation including the first verification credential, and the first verification step. and verifying credentials and digital signatures of the verification presentation.

In this case, the verifying of the electronic signature may include verifying the digital signature based on the distributed ID document corresponding to each of the first verification credential and the verification presentation.

At this time, the distributed ID document corresponding to each of the first verification credential and the verification presentation results from requesting distributed ID resolving to the distributed ID resolver for the distributed ID corresponding to each of the first verification credential and the verification presentation. can be obtained based on

At this time, the distributed ID resolver requests the distributed ID document from the distributed ID storage corresponding to the distributed ID based on the distributed ID resolving request, and obtains the distributed ID document based on a response from the distributed ID storage. can

At this time, the step of issuing the second verification credential includes generating a distributed ID, a distributed ID document, and a digital signature of the user, registering the distributed ID of the user in a distributed ID storage, and a second corresponding to the user. The method may include requesting issuance of a verification credential, and verifying a digital signature of the second verification credential based on an issuer distributed ID of the issued second verification credential.

In this case, the second verification credential may include information about a distributed ID corresponding to a user, a distributed ID corresponding to a device, and a first verification credential ID.

At this time, the step of requesting issuance of the second verification credential includes generating information necessary for issuing the second verification credential, encrypting the information necessary for issuing the second verification credential, and sending the credential issuing server Transmitting, and receiving second verification credential issuance information mapped to the device based on a verification result using a distributed ID corresponding to the user.

At this time, the step of verifying the digital signature of the second verification credential includes requesting distributed ID resolving for the issuer distributed ID of the second verification credential, and the distributed ID of the distributed ID storage corresponding to the issuer distributed ID. Receiving a distributed ID resolving response including a distributed ID document based on a search result, and verifying the digital signature of the second verification credential using a public key of the distributed ID document. .

In this case, registering the issued second verification credential may include requesting registration of the second verification credential from the device, and receiving a registration result of the second verification credential of the device. there is.

At this time, the registration request message of the second verification credential may include the second verification credential full text and meta data.

In this case, the device may perform a redundancy check on the second verification credential based on the registration request of the second verification credential.

In addition, a distributed ID-based device verification method according to an embodiment of the present invention for achieving the above object includes receiving a verification request for an IoT device, and detecting an IoT device based on a distributed ID included in the verification request. Identifying, requesting distributed ID resolving to a distributed ID resolver, receiving a resolution result including a distributed ID document from the distributed ID resolver, and generating a digital signature using the public key of the distributed ID document. It includes a verification step.

In this case, the verification request of the IoT device may include a verification presentation corresponding to the IoT device.

In this case, the verification presentation may include a first verification credential corresponding to the device, a second verification credential corresponding to the user, and an electronic signature.

In this case, the distributed ID document may include distributed ID documents respectively corresponding to the verification presentation, the first verification credential, and the second verification credential.

In this case, in the verifying the digital signature, the digital signature may be verified for each of the verification presentation, the first verification credential, and the second verification credential.

In this case, the distributed ID-based device verification method according to an embodiment of the present invention may transmit a verification result to the IoT device based on the verification result of the digital signature.

According to the present invention, authentication of an edge device can be performed in an IoT environment using distributed ID-based credentials.

In addition, the present invention can provide a convenient user experience for integrated management and inquiry/use of credentials on multi-distributed identity management services.

In addition, the present invention can easily provide an integrated environment with other distributed ID systems by using a distributed ID-based authentication process.

1 is a diagram conceptually illustrating a distributed identity management service environment based on distributed ID.

2 is a diagram conceptually illustrating a multi-distributed identity management service environment.

3 is a diagram illustrating an IoT environment composed of sensor-based edge device nodes by way of example.

4 is a diagram conceptually illustrating a communication process of Bluetooth Low Energy (BLE).

5 is a diagram conceptually illustrating a credential management method in a multi-distributed identity management service environment.

6 is a diagram conceptually illustrating authentication between IoT devices using a common authentication method.

7 is a flowchart illustrating a distributed ID-based verification credential management method according to an embodiment of the present invention.

8 is a flowchart illustrating a distributed ID-based device authentication method according to an embodiment of the present invention.

9 is a diagram conceptually illustrating a distributed ID and credential-based verification system according to an embodiment of the present invention.

10 to 11 are flowcharts showing in detail a process of registering device connection information according to an embodiment of the present invention.

12 to 14 are flowcharts showing in detail a membership VC issuing process according to an embodiment of the present invention.

15 is a flowchart showing in detail a membership VC registration process according to an embodiment of the present invention.

16 is a flowchart illustrating in detail a process of performing device verification according to an embodiment of the present invention.

17 is a diagram showing the configuration of a computer system according to an embodiment.

Advantages and features of the present invention, and methods of achieving them, will become clear with reference to the detailed description of the following embodiments taken in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but will be implemented in various different forms, only these embodiments make the disclosure of the present invention complete, and common knowledge in the art to which the present invention belongs. It is provided to fully inform the holder of the scope of the invention, and the present invention is only defined by the scope of the claims. Like reference numbers designate like elements throughout the specification.

Although "first" or "second" is used to describe various elements, these elements are not limited by the above terms. Such terms may only be used to distinguish one component from another. Therefore, the first component mentioned below may also be the second component within the technical spirit of the present invention.

Terms used in this specification are for describing embodiments and are not intended to limit the present invention. In this specification, singular forms also include plural forms unless specifically stated otherwise in a phrase. As used herein, "comprises" or "comprising" implies that a stated component or step does not preclude the presence or addition of one or more other components or steps.

Unless otherwise defined, all terms used herein may be interpreted as meanings commonly understood by those of ordinary skill in the art to which the present invention belongs. In addition, terms defined in commonly used dictionaries are not interpreted ideally or excessively unless explicitly specifically defined.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings, and when describing with reference to the drawings, the same or corresponding components are given the same reference numerals, and overlapping descriptions thereof will be omitted. .

Referring to FIG. 1, a distributed identity management service environment is composed of entities such as an issuer, a user, a verifier, and a trust store. The issuer issues credentials to the user, and the user manages the issued credentials and submits the credentials necessary for service use to the verifier. The verifier requests the credential required to provide the service from the user and provides the service by verifying the credential submitted by the user. The trust store stores and manages distributed identifiers (IDs) and distributed identifier documents that represent the identities of issuers, users, and verifiers.

Recently, as distributed identity management services are being used in various fields, users manage credentials issued through two or more distributed identity management services, and verifiers verify users' credentials issued from different distributed identity management services. A multi-distributed identity management service environment that provides

The modern era is called the era of the 4th industrial revolution, and various cutting-edge technologies such as ICBM technology (IoT, Cloud Computing, Big Data, Mobile), artificial intelligence, autonomous driving, and smart city, which are core technologies, are emerging. The size of data used in this digital society is getting bigger, and ultra-high-speed and ultra-low latency technology is required between data transmissions for data processing.

In the case of the Internet of Things (IoT), a hyper-connected technology is required to connect millions of devices in areas such as home/daily life/industry. 5G technology, the 5th generation mobile communication, supports ultra-high-speed transmission and ultra-low latency, including ultra-connectivity capable of connecting 1 million devices per unit area (1km2), so it is an essential technology optimized for communication between edge devices in the Internet of Things environment. is getting attention as

In addition, as electronic equipment develops into a digital society, electronic equipment is gradually miniaturized, and equipment with low power specifications is appearing accordingly. As small, low-power devices are released one after another, Bluetooth is drawing attention as a suitable short-distance wireless communication. From Bluetooth 4.0 or higher, both classic Bluetooth, high-speed (up to 24Mbps) Bluetooth, and low-power Bluetooth (BLE) are supported. With the advent of BLE, beacons, which previously had problems with power supply and mobility, also developed, and in the case of BLE beacons, they can operate for up to two years with only one mercury battery, further raising the possibility of the IoT industry.

Referring to FIG. 4 , a packet transmission/reception process of a central device corresponding to a client and a peripheral device corresponding to a server can be confirmed.

Referring to FIG. 5 , the user needs to manage identity qualifications (credentials) by installing separate applications provided by each service.

Such a user environment makes it difficult for users to conveniently search for and submit appropriate credentials when using services using credentials. In the future, when the distributed identity management service function is applied to various service fields, it is expected that the range of application apps that users need to manage will further increase, increasing the inconvenience of managing and using credentials.

In addition, the service provider also bears the burden of building and managing a communication system with the distributed ID storage. Therefore, there is a need for a method to securely manage and search/use credentials in a multi-distributed identity management service environment.

The current IoT security certification system evaluates security measures differently depending on the size of the device and assigns different certification levels. This can cause difficulties in the mutual authentication process of devices. In the future, at least millions of IoT devices will be used for IoT services in various industries, and for this purpose, as shown in FIG.

A distributed ID-based verification credential management method according to an embodiment of the present invention may be performed in a distributed ID-based authentication system.

However, hereinafter, the method according to the embodiment will be described in detail, focusing on a process performed in a device identity management (credential) application.

Referring to FIG. 7 , in the distributed ID-based verification credential management method according to the embodiment, IoT device connection information including a first verification credential corresponding to the IoT device is registered (S110).

Next, issuance of a second verification credential corresponding to the user is requested (S120), and the issued second verification credential is registered in the IoT device (S130).

At this time, the step of registering the IoT device connection information (S110) includes requesting the first verification credential from the IoT device, receiving a verification presentation including the first verification credential, and the and verifying a first verification credential and a digital signature of the verification presentation.

At this time, requesting issuance of the second verification credential (S120) includes generating information necessary for issuing the second verification credential, encrypting information necessary for issuing the second verification credential, and The method may include transmitting to an issuing server, and receiving second verification credential issuance information mapped to the device based on a verification result using a distributed ID corresponding to the user.

At this time, registering the issued second verification credential (S130) includes requesting registration of the second verification credential from the device and receiving a registration result of the second verification credential of the device. can include

Referring to FIG. 8 , a device verification method based on a distributed ID according to an embodiment of the present invention includes receiving a verification request for an IoT device (S210), and detecting the IoT device based on the distributed ID included in the verification request. Identifying (S220), requesting distributed ID resolving to a distributed ID resolver (S230), receiving a resolution result including a distributed ID document from the distributed ID resolver (S240), and the distributed ID document and verifying the digital signature using the public key of (S250).

At this time, in the step of verifying the digital signature ( S250 ), the digital signatures may be verified for each of the verification presentation, the first verification credential, and the second verification credential.

Although not shown in FIG. 8 , the distributed ID-based device verification method according to an embodiment of the present invention may further include transmitting a verification result to the IoT device based on the verification result of the electronic signature.

Referring to FIG. 9 , the system according to an embodiment of the present invention includes an edge device 10, a device identity management app 20, a distributed ID management server 30, a distributed ID resolver 40, a service provider (home IoT service 50), distributed trust store A 60, and distributed trust store B 70.

In this case, the device identity management app 20 may correspond to an app running on a user terminal, for example, a smart phone, a personal computer, a laptop computer, a tablet PC, and the like. Hereinafter, components of a system according to an embodiment of the present invention will be described in detail.

The edge device 10 refers to a manufacturer's IoT device, and the manufacturer's device VC (Verifiable Credential) is embedded at the time of shipment.

At this time, the edge device 10 may request a service from a service provider using a device VC and a membership VC.

In this case, the device VC and the membership VC may correspond to the first verification credential and the second verification credential, respectively, as an embodiment of the present invention.

The device identity management app 20 is an entity that performs identity management and service setting for service use in a device.

At this time, the device identity management app 20 may receive a membership VC for authentication when using the service and register it in the device.

In addition, the device identity management app 20 may inquire the device VC and membership VC in the device setting window.

At this time, the membership VC can be issued and deleted, but the device VC can be set to be deleted as a basic setting in the device.

The distributed ID management server 30 is an entity that registers and manages distributed IDs in a distributed trust store.

At this time, the distributed ID management server 30 may be used for registration, inquiry, renewal, and discard of distributed IDs for each service domain.

The distributed ID resolver 40 is an entity that provides a distributed ID search function managed by a distributed trust store for each service domain.

At this time, the distributed ID resolver 40 may check the location of the distributed trust storage to be searched based on the distributed ID information.

The service provider 50 is an entity that issues a service credential (membership VC) required for a device to request a service to a user and performs service request processing.

Distributed trust stores 60 and 70 are entities in which each distributed ID and its corresponding data (public key, distributed ID document, metadata, etc.) are registered.

A user can use a home IoT service through a mobile device. For example, a refrigerator has an edge device (hereinafter referred to as a device) built in, and a verification credential (hereinafter referred to as a VC) used for device authentication is installed in the device. This device VC is issued by the device manufacturer and is pre-built into the device.

The user can manage VCs in the device by connecting to the device via mobile through BLE communication. There are two VCs that can be managed: a device VC required for manufacturing certification by a device manufacturer and a membership VC required for home IoT refrigerator service user authentication. Membership VC can be issued from a refrigerator home service provider, and device VC verification is required to obtain membership VC.

The user sends the device VC to the refrigerator home service provider to obtain the membership VC, and to verify this, the refrigerator home service provider must access the distributed ID trust storage of the device manufacturer and inquire the distributed ID mapped with the device VC. Different distributed identity management services can be interlocked through the distributed ID resolver, and the service certification process is based on the W3C standard distributed ID/VC system through signature data transmission and reception between the issuer-user-verifier (service provider) and signature verification. It is done.

BLE communication is used for data transmission and reception between the device and user mobile, and general Internet communication is used otherwise.

10 to 11, the user accesses the device management screen in the identity management app 20 and presses the 'add device' button (S302).

On the device management screen, you can check the distributed ID and VC status, and register and delete the device distributed ID and membership VC.

The mobile device searches for a device that can be connected using BLE technology, a low-power wireless communication supported by Bluetooth 4.0 or higher (S304). When a connectable device is found, a BLE connection is executed (S306). If the connection is successful, the identity management app 20 requests the device VC for trusted device authentication from the device 10 (S308).

The device 10 generates a device VC request response message for transmitting the requested device VC to the mobile (S310).

At this time, the VC is not delivered as it is, but the VP is delivered as a structure in which the device VC is injected into the VP (Verifiable Presentation) value (S312). At this time, a value digitally signed with a private key corresponding to the device distributed ID may be added to the VP.

The identity management app 20 verifies digital signature values for the VP received from the device 10 and the device VC included therein (S314 and S316). The public key required to verify each signature value is stored in the document of each distributed ID, and must be obtained from each distributed trust storage.

The identity management app 20 requests distributed ID document inquiry to the distributed ID management server 30 (S318).

The distributed ID management server 30 checks the service domain from the delivered distributed ID value (S320). In the case of the same domain, inquiry can be made through the distributed ID management server, and in the case of heterogeneous domains, the distributed ID document is inquired through the distributed ID resolver 40 (S322). Since the distributed ID managed by the manufacturer corresponds to the heterogeneous domain area, the distributed ID management server 30 requests distributed ID document inquiry from the distributed ID resolver 40 (distributed ID resolving).

The distributed ID resolver 40 analyzes the received distributed ID values to identify a domain and finds a driver to connect to the corresponding domain (S322). The distributed ID resolver 40 requests a distributed ID search through a driver to a domain matching the distributed ID value (S326) and obtains a document according to the search result (S328, S330).

The obtained document is transmitted as a value of the resolving request response text of the distributed ID management server (332, S334). The distributed ID management server 30 generates a response statement containing the distributed ID documents (manufacturer distributed ID document / device distributed ID document) of the response message received from the distributed ID resolver 40 (S336, S338), and the identity management app 20 ) and sends a response (S340).

The identity management app 20 proceeds with the delivered distributed ID documents (S342, S344) to verify the electronic signature of each VP/VC (S346), and the signature verification process utilizes the public key in each distributed ID document. The digital signature value of VP is the public key of the distributed ID of the device, and the digital signature value of the VC is the public key of the distributed ID of the manufacturer. When the signature verification is completed, the identity management app stores the device identification information and uses it as connection information later (S348, S350).

In this case, the device identification information may consist of a device distributed ID, a device VC ID, and a device model name. The device VC ID is an ID generated by a manufacturer to manage device VC issue information and generally has a URL format.

Referring to FIGS. 12 to 14 , the user requests the service provider 50 to issue a membership VC in the identity management app 20 to use the home IoT service. For security between the membership VC issuance process, a secure connection is established in advance (S402), and DID Authentication technology is used. This is a technique used in the distributed ID system. The session key used for end-to-end (E2E) communication is made common by each entity using the distributed ID value of each entity, and then symmetric with it. It refers to communication technology that performs encrypted communication.

When the DID Authentication process is established, the user performs the process of registering the distributed ID to be used in the home IoT service domain. After creating a distributed ID and a document for a service user in the identity management app 20, the document is digitally signed with a private key corresponding to the distributed ID (S404). The identity management app requests the distributed ID management server 30 to register a distributed ID for service users (S406). These values are registered in the distributed trust storage within the service domain through the distributed ID management server 30 (S408). In the distributed trust storage B 70, the digital signature value of the distributed ID document value to be registered is performed through self-sign verification, and if the verification is successful, the digital signature value of the document is excluded and registered in the distributed trust storage (S410, S412, S414). ). When the registration is completed, the distributed trust storage B 70 transmits a response message to the distributed ID management server 30 (S416). The distributed ID management server 30 receiving the response text delivers the response text to the identity management app 20 (S418).

When the distributed ID for user service is registered, the identity management app 20 requests the service provider 50 to issue a membership VC (S420). The service provider 50 sends the information necessary for issuing the membership VC in the form of a request, which is initially transmitted to the identity management app 20 in an encrypted state with the session key shared through the DID Authentication connection ( S422). The identity management app 20 decrypts the request sent through the session key (S424), checks the information necessary for the membership VC, and fills in the corresponding values (S426). There are three types of necessary information.

The three types of information are information necessary for association between user and device information, and are distributed ID for service users, which is a distributed ID directly mapped to membership VC, and device distributed ID and device VC ID, which are information mapped to device VC.

After filling the corresponding values, the identity management app 20 transmits a response message to the service provider (S428), and in this process, it is also sent in an encrypted form using a session key. In the process of encryption/decryption transmission through the session key, the challenge-response authentication process is performed every time to prevent replay attacks.

The service provider 50 decrypts the received encrypted response message (S430) and extracts three ID values necessary for issuing the membership VC. Among them, a search request is made to the distributed ID resolver 40 with the distributed ID value for the service user, and confirmation is made as to whether the distributed ID is actually registered (S432).

The service provider 50 requests the distributed ID resolver 40 to resolve the distributed ID for the service user (S434). The distributed ID resolver 40 requests the distributed trust storage B 70 to retrieve the distributed ID document for the service user (S436), and receives a response of the distributed ID document for the service user according to the search result (S438) (S440). . The distributed ID resolver 40 transmits a distributed ID resolving response for the service user to the service provider (S442). When it is confirmed that the corresponding distributed ID is registered (S444), the service provider 50 proceeds with a membership VC issuance procedure. The service provider 50 creates a membership VC associated with the device (S446).

The membership VC contains specific device and user information, and the information is injected into the credentialSubject field of the VC. When issuing membership VC, a digital signature value is added using a private key corresponding to the distributed ID of the service provider 50. In general, the VC issuance process has a VC issuing server separately managed for each service provider, and the structure may be different for each service provider, and the scope of the present invention is not limited thereto.

The membership VC created by the service provider 50 is included in the VC issuance request response statement to be sent to the identity management app 20, and is transmitted in the form of an encrypted response statement through the session key (S448). The identity management app 20 receiving the encrypted response text decrypts the response text with the session key to obtain the membership VC (S450). Among the fields of the membership VC, the issuer field is a distributed ID value of the VC issuer, and a document value obtained by requesting distributed ID resolving (S452, S454) for this value, that is, the public key of the VC issuer can be obtained.

Specifically, the distributed ID resolver 40 requests distributed ID document inquiry to the distributed trust storage A 60 corresponding to the heterogeneous domain (S456), and receives a distributed ID document search result (S458) (S460). The distributed ID resolver 40 transmits the heterogeneous domain distributed ID resolving response to the distributed ID management server 30 (S462), and the distributed ID management server 30 transmits the response to the identity management app 20.

The identity management app 20 verifies the digital signature value of the issued membership VC with the obtained public key of the VC issuer (S466). The purpose of this verification process is to check whether the membership VC received by the user is the correct VC issuer. When the digital signature verification of the membership VC is completed, the identity management app can store the membership VC and utilize the VC when using the home IoT service afterwards.

Referring to FIG. 15 , when transmitting membership VC from the identity management app 20 to the device 10, BLE communication is used (S502). When the user confirms the BLE wireless connection with the device (S504), membership VC can be registered in the device. When the membership VC registration button is clicked (S506), a list of transmittable membership VCs appears, and the user selects a membership VC (S508). The identity management app 20 creates a registration request to transmit the membership VC (S510), and the full membership VC and meta information of the membership VC are inserted into the registration request. Meta information may be used as information to be used instead of the VC full text when outputting the VC management list in the device 10.

When the membership VC registration request is made, the request is transmitted to the device in the form of BLE communication (S512). At this time, there are three types of transport packets, which are divided into start packets, data packets, and end packets. The start packet is the header of the membership VC registration request, and the packet structure is in the form of ^SOF^ + [number of data packets]. The total number of transmitted data packets can be confirmed by checking the start packet, and the number of data packets is calculated as follows.

[Membership VC registration request size] / [Transmission size of one data packet]

Several data packets are transmitted in the form of splitting the actually transmitted membership VC registration request data, and the order is not guaranteed. Therefore, the device 10, which is the receiving side, needs to know the order of assembling the data, and for this, the data packet structure is composed of ^NUM_ + [data packet sequence] + ^ + [data].

The end packet is the last packet sent when there is no more transmission data, and the structure of the end packet is composed of ^EOF^. When the device completes receiving the end packet, it saves the transmitted packets as a file and sends a notification packet notifying the identity management app that the reception has been completed. The notification packet structure is in the form of ^ALL_RCV^, and the identity management app 20 terminates the transmission mode by receiving the corresponding packet. If the identity management app 20 does not receive this notification packet for a certain period of time, it determines that it is a transmission error and retransmits the packets. A total of 3 attempts are made, and if all 3 attempts fail, the transmission failure is notified to the user.

After receiving the membership VC registration request, the device 10 checks whether membership VCs are duplicated (S514). The redundancy check is conducted with three pieces of information from the membership VC. First, it is checked whether the vcId field value of the membership VC overlaps with other VCs in the device. Next, it is checked whether deviceDid and deviceVcId have duplicate values among the credentialSubject fields of the membership VC.

If there is no abnormality in the membership VC duplicate check, the device stores the received membership VC (S516), creates a registration response statement, and transmits it to the identity management app 20 (S518). The identity management app checks the result of the registration response statement and outputs a registration success message if successful (S520).

Hereinafter, a refrigerator home IoT service process will be described in detail as an embodiment of the present invention with reference to FIG. 16 .

The user can use the identity management app 20 to set the refrigerator home IoT service. For example, in a home IoT refrigerator, menu management is provided with a touch screen screen. In the refrigerator, the quantity of specific ingredients can be checked through a sensor that detects the ingredients, and if the ingredients are insufficient, the item can be purchased once by a preset number. It is said that there is a service that automatically connects to an online market and performs payment.

When checking ingredients suitable for the next day's diet, as a result of the sensor detection, if the ingredients are insufficient, a notification requiring product purchase is transmitted to the device 10 . The device 10 generates a product order request statement to be submitted to the service provider based on the received notification (S602). The product order request contains information necessary for product order details, IoT equipment, and payment user authentication. Information necessary for authentication is included in the request in the form of a VP containing the device VC and membership VC, and transmitted to the service provider (S604).

At this time, the transmitting VP creates a digital signature with the private key corresponding to the device distributed ID and sends it in addition to the original VP text.

Upon receiving the request, the online service provider 50 confirms the product order request (S606) and performs an authentication process based on the VP information of the product order request (S608). A total of three digital signature values must be authenticated, and the subject of each digital signature and its distributed ID value are as follows.

- VP's digital signature: device

- Device Distributed ID: Issuer value of VP

- Electronic signature of device VC: device manufacturer

- Manufacturer Distributed ID: Issuer value of device VC

- Digital signature of membership VC: service provider

- Distributed ID of service provider: Issuer value of membership VC

Next, the service provider 50 sends a distributed ID resolving batch request to the distributed ID resolver 40 to retrieve the public key of each distributed ID (S610). The distributed ID resolver 40 finds the distributed trust storage 70 suitable for the distributed ID domain with the distributed IDs received and performs distributed ID document inquiry (S612, S614). The distributed ID resolver 40 puts the searched distributed ID documents in a response message and delivers them to the service provider (S618).

The service provider 50 extracts the public key from the document of each distributed ID and verifies the digital signature values of the device VC, membership VC, and VP, respectively (S620). When the signature verification is completed, the service provider 50 processes the product order through the online market according to the requested product order details (S622). When the product order processing is finished, the service provider 50 transmits a response to the product order request to the device (S624). Upon receiving the product order response, the device processes a screen indicating that the product order was successful on the touch screen screen of the refrigerator (S626).

The identity management app of the distributed ID-based verification credential management and device verification method according to the embodiment may be implemented in the computer system 1000 such as a computer-readable recording medium.

Computer system 1000 may include one or more processors 1010, memory 1030, user interface input devices 1040, user interface output devices 1050, and storage 1060 that communicate with each other over a bus 1020. can In addition, computer system 1000 may further include a network interface 1070 coupled to network 1080 . The processor 1010 may be a central processing unit or a semiconductor device that executes programs or processing instructions stored in the memory 1030 or the storage 1060 . The memory 1030 and the storage 1060 may be storage media including at least one of volatile media, nonvolatile media, removable media, non-removable media, communication media, and information delivery media. For example, memory 1030 may include ROM 1031 or RAM 1032 .

The specific implementations described herein are examples and do not limit the scope of the present invention in any way. For brevity of the specification, description of conventional electronic components, control systems, software, and other functional aspects of the systems may be omitted. In addition, the connection of lines or connecting members between the components shown in the drawings are examples of functional connections and / or physical or circuit connections, which can be replaced in actual devices or additional various functional connections, physical connection, or circuit connections. In addition, if there is no specific reference such as “essential” or “important”, it may not be a component necessarily required for the application of the present invention.

Therefore, the spirit of the present invention should not be limited to the above-described embodiments and should not be determined, and all scopes equivalent to or equivalently changed from the claims as well as the claims to be described later are within the scope of the spirit of the present invention. will be said to belong to

Claims

registering IoT device connection information including first verification credentials corresponding to the IoT device;

issuing a second verification credential corresponding to the user; and

registering a second verification credential issued to the IoT device;

Distributed ID-based verification credential management method comprising a.
The method of claim 1,

The step of registering the IoT device connection information is

requesting the first verification credential from the IoT device;

receiving a verification presentation including the first verification credential; and

verifying the digital signature of the first verification credential and the verification presentation;

Distributed ID-based verification credential management method comprising a.
The method of claim 2,

The step of verifying the digital signature is

Distributed ID-based verification credential management method, characterized in that for verifying the electronic signature based on the first verification credential and the distributed ID document corresponding to each of the verification presentation.
The method of claim 3,

The distributed ID document corresponding to each of the first verification credential and the verification presentation is

Distributed ID-based verification credential management method, characterized in that obtained based on a result of requesting distributed ID resolving to a distributed ID resolver for the distributed ID corresponding to each of the first verification credential and the verification presentation.
The method of claim 4,

The distributed ID resolver is

Based on the distributed ID resolving request, the distributed ID document is requested from a distributed ID storage corresponding to the distributed ID, and the distributed ID document is obtained based on a response from the distributed ID storage. How to manage verification credentials.
The method of claim 1,

The step of issuing a second verification credential corresponding to the user

generating a user's decentralized ID, distributed ID document, and digital signature;

registering the distributed ID of the user in a distributed ID storage;

requesting issuance of the second verification credential; and

verifying a digital signature of the second verification credential based on an issuer distributed ID of the issued second verification credential;

Distributed ID-based verification credential management method comprising a.
The method of claim 6,

The second verification credential is

Distributed ID-based verification credential management method comprising information about a distributed ID corresponding to a user, a distributed ID corresponding to a device, and a first verification credential ID.
The method of claim 7,

The step of requesting issuance of the second verification credential is

generating information necessary for issuance of the second verification credential;

encrypting information necessary for issuing the second verification credential and transmitting the encrypted information to a credential issuing server; and

Receiving second verification credential issuance information mapped to the device based on a verification result using a distributed ID corresponding to the user;

Distributed ID-based verification credential management method comprising a.
The method of claim 8,

The step of verifying the electronic signature of the second verification credential

requesting distributed ID resolving for an issuer distributed ID of the second verification credential;

receiving a distributed ID resolving response including a distributed ID document based on a distributed ID search result of a distributed ID storage corresponding to the issuer distributed ID; and

verifying the digital signature of the second verification credential using the public key of the distributed ID document;

Distributed ID-based verification credential management method comprising a.
The method of claim 1,

Registering the issued second verification credential

requesting the device to register the second verification credential; and

receiving a second verification credential registration result of the device;

including,

The registration request message of the second verification credential is

Distributed ID-based verification credential management method comprising the second verification credential full text and meta data.
The method of claim 10,

The device

Distributed ID-based verification credential management method, characterized in that performing a duplicate check on the second verification credential based on the registration request of the second verification credential.
Receiving a verification request of an IoT device;

identifying an IoT device based on a distributed ID included in the verification request;

requesting distributed ID resolving to a distributed ID resolver;

receiving a resolution result including a distributed ID document from the distributed ID resolver; and

verifying the digital signature using the public key of the distributed ID document;

Distributed ID-based device verification method comprising a.
The method of claim 12,

Wherein the verification request of the IoT device includes a verification presentation corresponding to the IoT device.
The method of claim 13,

The verification presentation

Distributed ID-based device verification method comprising a first verification credential corresponding to a device, a second verification credential corresponding to a user, and an electronic signature.
The method of claim 14,

The distributed ID resolver is

Based on the distributed ID resolving request, the distributed ID document is requested from a distributed ID storage corresponding to the distributed ID, and the distributed ID document is obtained based on a response from the distributed ID storage. Device verification method.
The method of claim 15

The distributed ID document is

Distributed ID-based device verification method comprising distributed ID documents respectively corresponding to the verification presentation, the first verification credential, and the second verification credential.
The method of claim 16

The step of verifying the digital signature is

Distributed ID-based device verification method, characterized in that for verifying the digital signature for each of the verification presentation, the first verification credential, and the second verification credential.
The method of claim 17

Distributed ID-based device verification method, characterized in that for transmitting the verification result to the IoT device based on the verification result of the electronic signature.
a memory in which at least one program is recorded; and

Processor running the program

Including,

said program

Receiving a verification request of an IoT device;

identifying an IoT device based on a distributed ID included in the verification request;

requesting distributed ID resolving to a distributed ID resolver;

receiving a resolution result including a distributed ID document from the distributed ID resolver; and

verifying the digital signature using the public key of the distributed ID document;

Distributed ID-based device verification apparatus comprising a command for the execution of.