WO2023177013A1

WO2023177013A1 - Payment system using did-based biometric authentication

Info

Publication number: WO2023177013A1
Application number: PCT/KR2022/006779
Authority: WO
Inventors: 이정륜; 윤태연
Original assignee: 주식회사 블록체인기술연구소
Priority date: 2022-03-16
Filing date: 2022-05-11
Publication date: 2023-09-21
Also published as: KR20230135482A

Abstract

A payment system using DID-based biometric authentication is provided. The payment system using DID-based biometric authentication comprises a first user node, a block chain node, a biometrics authentication server, an IDH server, an object storage, and a payment server, wherein the first user node receives user biometrics so as to send same to the biometrics authentication server, receives vector data related to the user biometrics from the biometrics authentication server, and encrypts the vector data by using a public key of the payment server and a private key of the first user node.

Description

Payment system using DID-based biometric authentication

The present invention relates to a payment system using DID-based biometric information authentication. More specifically, the present invention is a system that can easily perform electronic payments by registering user biometric information and using the registered user's biometric information, and using the IDH (Identity Data Hub) server configuration to perform DID inquiry and user biometric information. This is about a payment system using DID-based biometric information authentication that returns the stored location and can complement the existing system that has security vulnerabilities due to leakage of the user's biometric information.

Blockchain refers to a data distribution processing technology that distributes and stores all data subject to management by all users participating in the network. It is also called 'Distributed Ledger Technology (DLT)' or 'Public Transaction Ledger' in that the ledger containing transaction information is not held by the transaction subject or a specific institution, but is shared by all network participants. Blockchain is a name given to a chain of blocks containing transaction information. This blockchain is a technology to prevent hacking such as forgery and falsification of transaction details. It sends transaction details to all users participating in the transaction and compares them for each transaction to prevent data forgery.

Blockchain has decentralization as its core concept, moving away from the existing financial system in which all transactions are secured and managed by financial institutions and oriented toward P2P (Peer to Peer) transactions. P2P refers to a communication network that connects personal computers without a server or client, and each connected computer acts as a server and client and shares information. A digital trust relationship is formed through multiple nodes sharing and verifying the same data. This environment makes it possible to implement smart contracts that can conveniently conclude and modify contracts through P2P without an intermediary.

In the existing financial system, financial companies have stored transaction records on a central server, whereas in a blockchain based on the P2P method, transaction information is stored in blocks, linked in turn, and shared by all participants.

Currently, identity authentication services using biometrics are used in various fields. With the development of biometric information authentication technology, Bio-Pay technology has emerged, which goes beyond authentication and allows you to purchase goods using only biometric information without a credit card or smartphone. In financial services, biometric authentication has emerged as a new non-face-to-face transaction authentication method and is being used in ATM/POS, internet banking, and online and offline payments.

In a transaction system using biometric information authentication, actions such as completing payment, accumulating points, and deducting points are performed according to the results of the verification process after authenticating the registered user's biometric information.

However, one of the major vulnerabilities of the biometric information authentication process concerns the storage and management of biometric information. Leakage of authentication information such as user passwords and mobile phone numbers is recognized as a serious security threat, but leakage of biometric information is an even more serious problem. Since biometric information has unique characteristics for each individual and does not change, it is difficult to change or reissue biometric information once it has been leaked, so management of biometric information is important.

In addition, biometric information does not change every time, but fixed information is transmitted for each transaction, so it is vulnerable to replay attacks.

The technical problem that the present invention aims to solve is to encrypt and share the user's biometric information used for authentication of electronic payment between the user node and the payment server, and to generate a common symmetric key to decrypt it using the ECDH technique, so that each user Because the node's private key cannot be known to a third node, it provides a payment system using DID-based biometric information authentication that can safely protect personal information, including biometric information, of the user node.

Another technical problem that the present invention aims to solve is payment using DID-based biometric authentication, which can reduce the inconvenience of management and reduce security risks by reducing the number of symmetric keys that must be managed by each user node or payment server. providing a system.

Another technical problem that the present invention aims to solve is to protect the personal information of user nodes by using DID-based identifiers and to reduce the amount of data registered in the blockchain to efficiently utilize resources. It provides a payment system using authentication.

Another technical problem that the present invention aims to solve is that by storing the hashed user password in the payment server's database, there is no fear of the user password being exposed, and even if the storage location of the user's biometric data stored in the object storage is disclosed, it is legitimate. Since access is impossible without authorization, we provide a payment system using DID-based biometric information authentication that guarantees safety.

However, the technical problems to be solved by the present invention are not limited to the above problems, and may be expanded in various ways without departing from the technical spirit and scope of the present invention.

A payment system using DID-based biometric information authentication according to an embodiment of the present invention to solve the above problem includes a first user node, a blockchain node, a biometric information authentication server, an IDH server, an object storage, and a payment server. In the payment system using biometric information authentication, receiving user biometric information and transmitting it to the biometric information authentication server, receiving vector data regarding the user biometric information from the biometric information authentication server, and disclosing the user's biometric information to the payment server. A first user node that encrypts the vector data using a key and the private key of the first user node, extracts the vector data from the user biometric information received from the first user node, and transmits it to the first user node. A biometric information authentication server that receives the encrypted vector data from the first user node, registers it in the object storage, receives a return storage location where the encrypted vector data is stored in the object storage, and sets the storage location to the first user node. 1 An IDH server transmits to a user node, and transmits the DID of the payment server to the first user node, and receives and stores the user DID, HUB DID, hashed user password, and the storage location from the first user node. Includes a payment server.

In some embodiments according to the present invention, the first user node generates the private key of the first user node in the key generation module, generates the user password in the password generation module, and uses the DApp to generate the user DID and The HUB DID for using the IDH service can be created, and a DID document related to the user DID can be registered with the blockchain node.

In some embodiments according to the present invention, the IDH server may check whether the first user node has ownership of the user DID through JWS (JSON Web Signature) signing/verification.

In some embodiments according to the present invention, after requesting an order to a service provider server, a second user node selects biometric information authentication as a payment method, inputs the user password, and then inputs the user biometric information; The second user node may transmit the received user biometric information to the biometric information authentication server and receive vector data extracted from the user biometric information from the biometric information authentication server.

In some embodiments according to the present invention, the second user node requests electronic payment by transmitting the hashed user password and the vector data to the payment server, and the payment server requests electronic payment based on the hashed user password. The user DID, the HUB DID, and the storage location are secured, the payment server connects to the IDH server to receive the encrypted vector data stored in the object storage, and the payment server receives the encrypted vector data stored in the object storage. After decrypting the encrypted vector data using the public key and the private key of the payment server, electronic payment operation is performed by comparing the vector data regarding user biometric information provided by the second user node with the decrypted vector data. can be performed.

Other specific details of the invention are included in the detailed description and drawings.

According to the present invention, the user's biometric information is encrypted and shared between the user node and the payment server, and a common symmetric key to decrypt it is generated using the ECDH technique, so that the private key of each user node can be known to a third node. Because there is no such thing, personal information, including biometric information of user nodes, can be safely protected.

Additionally, according to the present invention, the number of symmetric keys that must be managed by each user node or payment server can be reduced to prevent management hassle and reduce security risks.

In addition, according to the present invention, by using a DID-based identifier, the personal information of user nodes can be protected and resources can be efficiently utilized by reducing the amount of data registered in the blockchain.

Additionally, according to the present invention, there is no fear of the user password being exposed by storing the hashed user password in the payment server's database.

Additionally, according to the present invention, even if the storage location of the user's biometric data stored in the object storage is made public, access itself is impossible without proper authority, so safety can be guaranteed.

However, the effects of the present invention are not limited to the above effects, and may be expanded in various ways without departing from the technical spirit and scope of the present invention.

Figure 1 is a diagram showing a distributed processing system using blockchain to which the technical idea according to the present invention can be applied.

Figures 2 and 3 are block diagrams showing the connection of blocks used in a blockchain system.

Figures 4 and 5 are block diagrams showing the configuration of a payment system using DID-based biometric information authentication and a user biometric information registration procedure according to an embodiment of the present invention.

Figures 6 and 7 are block diagrams showing the configuration and electronic payment operation procedure of a payment system using DID-based biometric information authentication according to an embodiment of the present invention.

Figure 8 is a flowchart showing a procedure for registering user biometric information in a payment system using DID-based biometric information authentication according to an embodiment of the present invention.

Figure 9 is a flowchart showing the procedure of an electronic payment operation in a payment system using DID-based biometric information authentication according to an embodiment of the present invention.

Figure 10 is a configuration diagram of a node computing device according to an embodiment of the present invention.

The advantages and features of the present invention and methods for achieving them will become clear by referring to the embodiments described in detail below along with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below and will be implemented in various different forms, but the present embodiments only serve to ensure that the disclosure of the present invention is complete and are within the scope of common knowledge in the technical field to which the present invention pertains. It is provided to fully inform those who have the scope of the invention, and the present invention is only defined by the scope of the claims.

The terminology used herein is for describing embodiments and is not intended to limit the invention. As used herein, singular forms also include plural forms, unless specifically stated otherwise in the context. As used herein, “comprises” and/or “comprising” refers to the presence of one or more other components, steps, operations and/or elements. or does not rule out addition.

Unless otherwise defined, all terms (including technical and scientific terms) used in this specification may be used with meanings that can be commonly understood by those skilled in the art to which the present invention pertains. Additionally, terms defined in commonly used dictionaries are not interpreted ideally or excessively unless clearly specifically defined.

Hereinafter, preferred embodiments of the present invention will be described in more detail with reference to the attached drawings. The same reference numerals are used for the same components in the drawings, and duplicate descriptions for the same components are omitted.

Below, we will first describe a distributed processing system using blockchain to which the concept of the present invention can be applied.

Referring to Figure 1, a distributed processing system using blockchain is a distributed network system consisting of a plurality of nodes (110 to 170). The nodes 110 to 170 constituting the distributed network 100 may be electronic devices with computing capabilities, such as computers, mobile terminals, and dedicated electronic devices.

In general, the distributed network 100 can store and reference information commonly known to all participating nodes within a connected bundle of blocks called a blockchain. The nodes 110 to 170 are capable of communicating with each other and can be divided into full nodes, which are responsible for storing, managing, and disseminating the blockchain, and light nodes, which can simply participate in transactions. . When a node is mentioned without further explanation in this specification, it often refers to a full node that participates in the decentralized network 100 and performs the operation of creating, storing, or verifying the blockchain, but is not limited to this. .

Each block connected to the blockchain contains transaction details, that is, transactions, within a certain period of time. The nodes can manage transactions by creating, storing, or verifying blockchains according to their respective roles.

Depending on the embodiment, the transaction may represent various types of transactions. In one embodiment, the transaction may correspond to a financial transaction to indicate the ownership status of virtual currency and its changes. In another embodiment, the transaction may correspond to a physical transaction to indicate the ownership status of an item and its changes. In another embodiment, the transaction may correspond to an information sharing process to represent the recording, storage, and transfer of information. Nodes that perform transactions in the distributed network 100 may have a private key and public key pair with a cryptographic relationship.

Referring to FIG. 2, the blockchain 200 is a type of distributed database of one or more sequentially

connected blocks

210, 220, and 230. The blockchain 200 is used to store and manage users' transaction details within the blockchain system, and each node participating in the network of the blockchain system creates a block and connects it to the blockchain 200. Although a limited number of

blocks

210, 220, and 230 are shown in Figure 2, the number of blocks that can be included in the blockchain is not limited thereto.

Each block included in the blockchain 200 may be configured to include a block header 211 and a block body 213. The block header 211 may include the hash value of the previous block 220 to indicate the connection relationship between each block. In the process of verifying whether the blockchain 200 is valid, the connection relationship within the block header 211 is used. The block body 213 may include data stored and managed in the block 210, for example, a transaction list or a transaction chain.

Referring to FIG. 3, the block header 211 may include a hash 2112 of the previous block, a hash 2113 of the current block, and a nonce 2114. Additionally, the block header 211 may include a root 2115 indicating the header of the transaction list within the block.

As described above, the blockchain 200 may include one or more connected blocks. The one or more blocks are connected based on the hash value in the block header 211. The hash value 2112 of the previous block included in the block header 211 is a hash value for the previous block 220 and is the same as the current hash 2213 included in the previous block 220. The one or more blocks are chained by the hash value of the previous block in each block header. Nodes participating in the decentralized network 100 verify the validity of blocks based on the hash value of the previous block included in the one or more blocks, so that a single malicious node cannot forge or alter the contents of an already created block. The action is impossible.

The block body 213 may include a transaction list 2131. The transaction list 2131 is a list of blockchain-based transactions. For example, the transaction list 2131 may include records of financial transactions made in the blockchain-based financial system. The transaction list 2131 may be expressed in the form of a tree. For example, the amount sent by user A to user B is recorded in the form of a list, and the storage length in the block is the length of the transaction included in the current block. It can be increased or decreased based on the number.

Additionally, the block 210 may include other information 2116 other than the information included in the block header 211 and the block body 213.

Nodes participating in the decentralized network 100 have the same blockchain, and the same transaction is stored in the block. Blocks containing the transaction list are shared across the network, so all participants can verify them.

In the present invention, in order to solve the problems caused by the leakage of individual biometric information in the payment system using biometric information authentication described above and the problem of vulnerability to replay attacks due to repeated transmission of biometric information for authentication, DID-based We would like to propose access control storage (hereinafter referred to as IDH (Identity Data Hub)).

In other words, the present invention does not propose a method of storing the user's biometric information and payment information in a central server, but rather a method of storing biometric information encrypted with the user's key in each user's logical storage (hub instance) through DID-based IDH. do. When biometric information is required, the payment system verifies the owner of the biometric information by referring to the IDH.

Below, we will first explain the concept of DID and DID document.

DID refers to a unique identifier that can prove your identity by CRUD (Create, Read, Update, Delete) information that can identify an individual without a central agency. DID is a key value that serves as a pointer to the DID document of a blockchain transaction. In particular, DID is an identifier generated based on the user's public key.

A DID document refers to a set of documents required for an individual to authenticate himself and prove his association with a DID. The object of DID's CRUD performance is the DID document, which refers to the information required for verification when using the DID service, and the data set contains properties such as public key and authentication method.

The relationship between DID and DID document is to search DID in the blockchain and create DID document based on transaction contents, and the method of reading DID document based on DID may be different for each blockchain.

The payment system using DID-based biometric information authentication according to the present invention includes a first user node 310, a second user node 320, a blockchain node 400, a biometric information authentication server 500, and a payment server ( 600), IDH server 700, object storage 800, and resolver server 900.

Hereinafter, the configuration and operation procedures of the payment system using DID-based biometric information authentication according to the present invention will be described with reference to the drawings.

A payment system using DID-based biometric information authentication according to an embodiment of the present invention includes a first user node 310, a blockchain node 400, a biometric information authentication server 500, a payment server 600, and an IDH server ( 700), object storage 800, and resolver server 900. The method of registering user biometric information for DID-based biometric information authentication according to the present invention may be an algorithm implemented through an application.

Among the components of the present invention, the first user node 310 is a terminal device for registering user biometric information, and may be implemented as a computer capable of accessing a remote server or terminal through a network. Here, the computer may include, for example, a laptop equipped with a navigation system and a web browser, a desktop, a laptop, etc.

In addition, the first user node 310 is, for example, a wireless communication device that guarantees portability and mobility, and includes navigation, personal communication system (PCS), global system for mobile communications (GSM), personal digital cellular (PDC), PHS (Personal Handyphone System), PDA (Personal Digital Assistant), IMT (International Mobile Telecommunication)-2000, CDMA (Code Division Multiple Access)-2000, W-CDMA (W-Code Division Multiple Access), Wibro (Wireless Broadband Internet) ) It may include all types of handheld-based wireless communication devices such as terminals, smartphones, smartpads, and tablet PCs.

The first user node 310 uses DApp when registering user biometric information, generates the private key of the first user node 310 in the key generation module, and generates the user password in the password generation module. Then, the first user node 310 generates a user DID and a HUB DID for using the IDH service, and registers a DID document related to the user DID with the blockchain node 400.

In the present invention, DID is applied to enable the sender node and the receiver node to share a common symmetric key using the asymmetric key of the first user node 310. DID is used as an identifier to query the public key of the first user node 310 registered in the blockchain node 400. The public key of the first user node 310 is registered on a blockchain that can be accessed by an unspecified number of nodes, and the private key of the key pair corresponding to the public key is held only by a specific node. Based on this structure, the personal information of the first user node 310 can be safely shared with other nodes without separate symmetric key management by using the elliptic curve key exchange algorithm (ECDH).

In the present invention, the first user node 310 and the payment server 600 can generate a common symmetric key according to the logic below without the need to generate a separate symmetric key.

Common symmetric key: Private key of a specific user node Public key of the payment server == Private key of the payment server Public key of a specific user node

The ECDH technique used in the present invention applies the Diffie-Hellman key exchange method using elliptic curve cryptography. The third node can know the public keys of specific nodes, but cannot know the private keys of each node, so they exchange with each other. Therefore, the generated symmetric key cannot be known. Accordingly, personal information including biometric information of the first user node 310 can be safely protected.

The first user node 310 requires a symmetric key to safely share the user's biometric information (corresponding to personal information to be protected) with the payment server 600, and generates a separate symmetric key to send the user's biometric information (corresponding to personal information to be protected) to the payment server 600. If encrypted using a public key of ), the number of symmetric keys that must be managed by the payment server 600 for multiple user nodes increases, causing management inconvenience and a security risk. This also becomes a problem in symmetric key management for each user node. To solve this problem, the present invention applies a key exchange algorithm to improve the convenience and strengthen security of symmetric key management, and DID can be used to query the public key of the counterpart node with which you want to transact.

The first user node 310 recognizes user biometric information (eg, facial recognition information) using DApp and transmits the recognized biometric information to the biometric information authentication server 500. Here, the user's biometric information may be, for example, facial recognition information.

The biometric information authentication server 500 extracts and stores the user's biometric information data (hereinafter referred to as 'vector data') from the biometric information received from the first user node 310, and sends the extracted vector data to the first user. It is delivered to the DApp of node 310.

At this time, when registering user biometric information, the first user node 310 uses the DID of the payment server 600 to query the public key of the payment server 600, and uses the public key of the payment server 600 and the first user Using the private key of the node 310, a symmetric key is generated using the ECDH technique as described above to encrypt vector data (vector data extracted from the biometric information authentication server 500).

The IDH server 700 queries the DID authority of the user node with the resolver server 900 in order to register the encrypted vector data provided from the DApp of the first user node 310 in the object storage 800. In the database of the IDH server 700, user DIDs and HUB DIDs for a plurality of user nodes are mapped, and this mapped status is checked when querying DID authority.

In addition, if you want to register encrypted vector data in a user node registered on the IDH server 700, it is necessary to check whether you have ownership of the user DID, and this is done through JWS (JSON Web Signature) signing/verification. The electronic signature is verified by looking up the public key of the first user node 310 on the blockchain through the resolver server 900.

The IDH server 700 registers the encrypted vector data in the object storage 800 and returns the storage location in the object storage 800. The IDH server 700 delivers the returned storage location in the object storage 800 to the first user node 310.

The HUB DID of the first user node 310 is used as an identifier to logically distinguish individual storage within the object storage 800, and the IDH server 700 identifies the user node corresponding to the true owner of the HUB DID as a normal user node. Confirm with .

And, the payment server 600 uses the user DID and HUB DID to query the individual storage of the object storage 800 linked to the IDH server 700.

The reason why the IDH server 700 uses the identifier as a DID is to protect the user's personal information from the service company that operates the IDH server 700. In addition, considering the possibility that the database linked to the IDH server 700 may be stolen, all identifiers are de-identified as DIDs to protect user personal information from malicious users.

The payment server 600 transmits the DID of the payment server 600 to the first user node 310, and allows the first user node 310 to query the public key of the payment server 600. In addition, the payment server 600 receives the user DID, HUB DID, hashed user password, and storage location information in the object storage from the first user node 310 to enable electronic payment. In the subsequent process, the payment server 600 searches the user DID from the blockchain node 400 through the resolver server 900, and the DID document mapped to the user DID is registered on the blockchain, so the payment server 600 You can search DID documents through user DID.

The first user node 310 can query the DID document by directly querying the node on the blockchain, but there is the inconvenience of having to process it to meet W3C standard specifications. The resolver server 900 performs the role of processing blockchain data in accordance with the W3C standard, and the DID document of the DID identifier can be searched from any node through the resolver server 900. The amount of data that can be registered in the blockchain is limited, and there is a need to utilize resources efficiently. Therefore, the DID document currently registered in the blockchain is raw data with optimized resource utilization, and the raw data is processed through the resolver server 900. can be processed and provided to the first user node 310.

A payment system using DID-based biometric information authentication according to an embodiment of the present invention includes a second user node 320, a blockchain node 400, a biometric information authentication server 500, a payment server 600, and an IDH server ( 700), object storage 800, resolver server 900, and service provider server 910. The electronic payment method using DID-based biometric information authentication according to the present invention may be an algorithm implemented through an application.

Among the components of the present invention, the second user node 320 corresponds to a device such as PoS or a kiosk, and the second user node 320 selects biometric information authentication as a payment method after ordering a product with the service provider server 910. Then, enter the user password and then enter the user's biometric information (for example, facial recognition information).

The second user node 320 transmits the inputted user's biometric information to the biometric information authentication server 500 and receives vector data related to the user's biometric information extracted from the biometric information authentication server 500.

The second user node 320 transmits vector data extracted from the hashed user password and user biometric information to the payment server 600 to request electronic payment.

The payment server 600 secures user information such as user DID, HUB DID, and storage location information in object storage based on the hashed user password, and the payment server 600 connects to the IDH server 700 to collect user biometric information. By requesting related data from the IDH server 700, encrypted vector data stored in the object storage is delivered.

The payment server 600 receives the user DID, HUB DID, hashed user password, and storage location information in the object storage from the first user node 310 during the user biometric information registration process, and the payment server 600 receives the hashed user password. Using the password as the pk value, the storage location in object storage, user DID, and HUB DID are stored in the database. Since hashed user passwords, not user passwords, are stored in the database of the payment server 600, there is no fear of user passwords being exposed, and even if the storage location in the object storage is disclosed, access is impossible without proper authority, so safety is guaranteed. . Additionally, since the user DID or HUB DID describes the owner of the user node or the storage location in the IDH server 700, it is information that is irrelevant even if disclosed. Accordingly, the payment server 600 does not have the user's personal information, but can secure viewable personal information by sharing the user's biometric information.

The payment server 600 searches the blockchain through the resolver server 900 to secure the public key of the first user node 310 based on the user DID, and the private key of the payment server 600 and the first user node ( 310) generates a symmetric key using the public key and decrypts the encrypted vector data.

The payment server 600 performs an electronic payment operation by comparing vector data regarding user biometric information provided by the second user node 320 with vector data decrypted by the payment server 600.

The IDH server 700 queries the DID authority of the payment server 600 through the resolver server 900 and requests the object storage 800 to receive encrypted vector data.

The IDH server 700 transmits encrypted vector data to the payment server 600, and the payment server 600 performs an electronic payment operation through the above-described operation.

The service provider server 910 receives the electronic payment approval result from the payment server 600 and provides services such as product delivery to the user.

In the DID-based biometric information registration procedure, the first user node 310 uses DApp to generate a user password in a password generation module. And, the first user node 310 uses the user password to generate a user DID and a HUB DID for using the IDH service, registers them in the blockchain node 400, and the user's HUB DID is additionally sent to the IDH server (700). ) to register.

Then, the first user node 310 recognizes the user's biometric information (for example, facial recognition information) using the DApp and transmits the recognized biometric information to the biometric information authentication server 500. The biometric information authentication server 500 receives the user's biometric information from the first user node 310, extracts the vector data, hashes it, and transfers the hashed vector data to the DApp of the first user node 310. Deliver.

In order to use the payment system, the first user node 310 requests public key inquiry of the payment server 600 through the resolver server 900. The resolver server 900 retrieves the public key of the payment server 600 from the blockchain node 400 and provides it to the first user node 310. The first user node 310 encrypts vector data (hashed vector data) using the public key of the payment server 600 and the private key of the first user node 310.

Then, the first user node 310 requests the IDH server 700 to share the encrypted vector data with the payment server 600, and the IDH server 700 sends the encrypted vector data to the object storage 800. To register, the user DID authority is checked with the resolver server 900. The IDH server 700 registers the encrypted vector data in the object storage 800 and returns the storage location in the object storage 800.

The IDH server 700 transmits the storage location of the object storage 800 to the first user node 310, and the first user node 310 transmits the user DID, HUB DID, and hashed user password to the payment server 600. , A payment system is used by transmitting storage location information within object storage.

The DID-based biometric information utilization procedure involves ordering a product from the second user node 320 (device such as PoS or kiosk, etc.) for electronic payment to the service provider server 910, and then selecting biometric information authentication as a payment method, After entering the user password, enter the user's biometric information (for example, facial recognition information).

The second user node 320 transmits the input biometric information to the biometric information authentication server 500, and the biometric information authentication server 500 extracts vector data from the received biometric information of the user and sends the extracted vector data to the biometric information authentication server 500. Transmitted to the second user node 320.

Next, the second user node 320 transmits the hashed user password and vector data extracted from the user biometric information to the payment server 600 to request electronic payment.

At this time, the payment server 600 secures user information such as user DID, HUB DID, and storage location information in object storage based on the hashed user password, and the payment server 600 connects to the IDH server 700 to obtain user biometric information. Data regarding information is requested from the IDH server 700.

Then, the IDH server 700 queries the DID authority of the payment server 600 through the resolver server 900 and requests the object storage 800 to receive encrypted vector data. The IDH server 700 transmits the encrypted vector data to the payment server 600, and the payment server 600 queries the blockchain node 400 through the resolver server 900 to obtain the first user node 310. Secure the public key.

The payment server 600 generates a symmetric key using the private key of the payment server 600 and the public key of the first user node 310, and then decrypts the encrypted vector data. The payment server 600 performs an electronic payment operation by comparing vector data related to the user's biometric information provided from the second user node 320 with vector data decrypted by the payment server 600.

After performing an electronic payment operation, the payment server 600 transmits an approval result to the service provider server 910, and the service provider server 910 provides services such as product delivery to the user according to the approval result.

The computing device 1000 of the node according to an embodiment of the present invention includes a processor 1100 and a memory 1200, and the processor 1100 includes one or more cores, a graphics processing unit, and/or other components and signals. It may include a connection passage (for example, a bus, etc.) for transmitting and receiving.

The processor 1100 according to one embodiment executes one or more instructions stored in the memory 1200, thereby executing the operation of the payment system using DID-based biometric information authentication described in relation to FIGS. 4 to 9.

For example, the processor 1100 collects information about data upload/download occurring in one or more nodes by executing one or more instructions stored in memory, records the collected information in a block, and executes the information recorded in the block. Based on the information, relevant information is provided for at least one node.

Meanwhile, the processor 1100 may further include RAM (Random Access Memory) and ROM (Read-Only Memory) that temporarily and/or permanently store internally processed signals (or data). . Additionally, the processor 1100 may be implemented in the form of a system on chip (SoC) including at least one of a graphics processing unit, RAM, and ROM.

The memory 1200 may store programs (one or more instructions) for processing and controlling the processor 1100. Programs stored in the memory 1200 may be divided into a plurality of modules according to their functions.

The operations of the system described in relation to embodiments of the present invention may be implemented directly in hardware, implemented as a software module executed by hardware, or a combination thereof. The software module may be RAM (Random Access Memory), ROM (Read Only Memory), EPROM (Erasable Programmable ROM), EEPROM (Electrically Erasable Programmable ROM), Flash Memory, hard disk, removable disk, CD-ROM, or It may reside on any type of computer-readable recording medium well known in the art to which the present invention pertains.

The components of the present invention may be implemented as a program (or application) and stored in a medium in order to be executed in conjunction with a hardware computer. Components of the invention may be implemented as software programming or software elements, and similarly, embodiments may include various algorithms implemented as combinations of data structures, processes, routines or other programming constructs, such as C, C++, , may be implemented in a programming or scripting language such as Java, assembler, etc. Functional aspects may be implemented as algorithms running on one or more processors.

The above-described embodiments should be understood in all respects as illustrative and not restrictive, and the scope of the present invention will be indicated by the claims below rather than the detailed description above. In addition, the meaning and scope of this claim, as well as all changes and modifications derived from the equivalent concept, should be construed as being included in the scope of the present invention.

Claims

In a payment system using biometric information authentication including a first user node, a blockchain node, a biometric information authentication server, an IDH server, an object storage, and a payment server,

Receive user biometric information and transmit it to the biometric information authentication server, receive vector data regarding the user biometric information from the biometric information authentication server, and use the public key of the payment server and the private key of the first user node. a first user node that encrypts the vector data;

a biometric information authentication server that extracts the vector data from the user biometric information received from the first user node and transmits it to the first user node;

Receiving the encrypted vector data from the first user node, registering it in the object storage, receiving a return storage location where the encrypted vector data is stored in the object storage, and transmitting the storage location to the first user node IDH server; and

DID-based, including; a payment server that delivers the DID of the payment server to the first user node, and receives and stores the user DID, HUB DID, hashed user password, and storage location from the first user node; Payment system using biometric authentication.
According to clause 1,

The first user node is,

Generate the private key of the first user node in the key generation module, generate a user password in the password generation module, and generate the user DID and the HUB DID for using the IDH service using DApp,

A payment system using DID-based biometric information authentication that registers a DID document related to the user DID with the blockchain node.
According to clause 2,

The IDH server is a payment system using DID-based biometric information authentication that checks whether the first user node has ownership of the user DID through JWS (JSON Web Signature) signature/verification.
According to clause 1,

After requesting an order from the service provider server, a second user node selects biometric information authentication as a payment method, inputs the user password, and then inputs the user biometric information; further comprising;

The second user node is,

A payment system using DID-based biometric information authentication that transmits the inputted user biometric information to the biometric information authentication server and receives vector data extracted from the user biometric information from the biometric information authentication server.
According to clause 4,

The second user node transmits the hashed user password and the vector data to the payment server to request electronic payment,

The payment server secures the user DID, the HUB DID, and the storage location based on the hashed user password,

The payment server connects to the IDH server and receives the encrypted vector data stored in the object storage,

The payment server decrypts the encrypted vector data using the public key of the first user node and the private key of the payment server, and then collects the vector data on the user biometric information provided by the second user node and the A payment system using DID-based biometric information authentication that performs electronic payment operations by comparing decrypted vector data.