TWI888124B - Service systems and methods based on decentralized identifier verification - Google Patents

Abstract

Disclosed herein is directed to a service system based on decentralized identifier verification, comprising a blockchain, an application, a first server, and a second server. According to one embodiment of the present disclosure, the user communicates to the service system via the application which is communicatively connected to the first and the second server independently. Additionally, the first and the second server are further communicatively connected to the blockchain. Also, disclosed herein is a method of user verification based on decentralized identifier.

Description

Service system and method based on decentralized identity verification

This disclosure is about a blockchain-based service system, specifically using decentralized identity to verify users and provide corresponding certificates to provide the services required by users.

Open Authorization (OAuth) is an open standard that allows users to quickly register and log in to websites or applications by providing third-party websites or applications with specific permissions, allowing them to access personal information stored by users on a certain platform within a limited time. For example, if a user wants to register an identity on a new website, he can use Facebook, Google or other existing platforms as a login method to authorize the current website to obtain limited relevant information stored by the user on Facebook, Google or other platforms. In other words, the work of user identity verification is entrusted to the selected platform. This authentication method greatly improves the convenience of users entering new websites or using new applications, but it also creates concerns about data security.

Specifically, if a third-party website or application is attacked, the permissions and user information generated during authorization may be leaked; in addition, if the authorization mechanism is too simple or the authorization scope is poorly set, the third party may obtain too many authorizations, which may lead to data abuse.

In view of this, a novel identity verification method is urgently needed in this field. By providing an identity certificate to confirm the identity of the user, the control of personal data can be returned to the user, allowing the user to give a third party a specific verification result according to his/her choice, thereby replacing the current verification method of authorizing a third party to directly access personal data to ensure the security of personal data.

The content of the invention is intended to provide a simplified summary of the disclosure so that readers can have a basic understanding of the disclosure. This content of the invention is not a complete overview of the disclosure, and it is not intended to point out the important/key elements of the embodiments of the invention or to define the scope of the invention.

The first aspect of the disclosure is about a decentralized identity authentication-based service system that communicates with a client to provide the service desired by the client. According to an implementation method of the present disclosure, the service system includes a blockchain, an application, a first server and a second server, wherein the blockchain stores identity information of a client; the application is connected in communication with the client to receive a certificate application and a service application from the client; the first server is connected in communication with the blockchain and the application respectively to generate a certificate corresponding to the certificate application, and convert the certificate into a hashed certificate and upload it to the blockchain; and the second server is connected in communication with the blockchain and the application respectively to generate the service corresponding to the service application, and transmit the service to the application to provide the service to the client. In the implementation method of the present disclosure, the first server generates the certificate by executing the following steps: (a) receiving a certificate application from an application; (b) obtaining identity information from a blockchain to verify the client and generate a first identity verification result; (c) generating a certificate corresponding to the certificate application based on the first identity verification result; and the second server generates the service by executing the following steps: (i) receiving a certificate application from an application; (ii) obtaining identity information from a blockchain to verify the client and generate a first identity verification result; (iii) generating a certificate corresponding to the certificate application based on the first identity verification result; and (ii) obtaining identity information from the blockchain to verify the client and generate a second identity verification result; (iii) verifying the certificate of step (i) with the hashed certificate on the blockchain to generate a certificate verification result; and (iv) generating the service corresponding to the service application based on the second identity verification result of step (ii) and the certificate verification result of step (iii).

According to an implementation method of the present disclosure, the application communicates with the first server and the second server via the first link and the second link respectively.

According to another embodiment of the disclosure, after step (c), the first server is further configured to execute: (d) signing the certificate based on the private key of the first server to generate a first signature certificate; and (e) transmitting the first signature certificate to the application. In an embodiment of the disclosure, after receiving the first signature certificate from the first server, the application verifies the first signature certificate based on the public key of the first server; and further signs the first signature certificate based on the private key of the application to generate a second signature certificate, and transmits the second signature certificate to the second server. In an exemplary implementation of the present disclosure, after receiving the second signature certificate from the application, the second server is further used to verify the second signature certificate based on the public key of the application and the public key of the first server.

According to certain implementations of the present disclosure, the first server uploads the hash certificate to the blockchain based on a write permission before uploading the hash certificate to the blockchain. In an implementation of the present disclosure, the hash certificate is generated by passing the certificate through a hash function. According to a specific implementation of the present disclosure, procedure (iii) further includes: (iii-1) passing the certificate of procedure (i) through the hash function to generate a hash certificate to be verified; and (iii-2) comparing the hash certificate to be verified with the hash certificate to generate a certificate verification result.

The second aspect of the disclosure is about a method for verifying the identity of a client based on a decentralized identity. According to a specific implementation of the disclosure, the method includes: (1) providing a verification platform, including a blockchain, an application, a first server and a second server, wherein the blockchain stores the identity information of the client; and the application is respectively connected to the first server and the second server, and the first and second servers are respectively connected to the blockchain; (2) according to the operation of the client, the application sends a certificate application to the first server; (3) the first server receives the certificate application and executes the following procedures: (3-1) obtains the identity information from the blockchain to verify the client and generates a first identity verification result; (3-2 ) Based on the first identity verification result, generate a certificate corresponding to the certificate application and transmit the certificate to the application; and (3-3) convert the certificate into a hash certificate and upload it to the blockchain; (4) transmit the certificate from the application to the second server based on the operation of the client; (5) The second server receives the certificate and executes the following procedures: (5-1) obtain the identity information from the blockchain to verify the client and generate a second identity verification result; and (5-2) based on the second identity verification result, verify the certificate with the hash certificate on the blockchain to generate a certificate verification result; and (5-3) confirm the identity of the client based on the certificate verification result.

According to an optional implementation of the present disclosure, step (1) further includes: (1-1) the first server and the second server generate a first link and a second link respectively; and (1-2) the application communicates with the first server and the second server respectively through the first link and the second link.

In an implementation method of the present disclosure, step (3-3) is to upload the hash certificate to the blockchain based on a write permission.

According to a specific implementation of the present disclosure, step (3) is to generate a hash certificate by passing the certificate through a hash function. In the implementation of the present disclosure, step (5-2) is to pass the certificate through the hash function to generate a hash certificate to be verified, and compare the hash certificate to be verified with the hash certificate to generate a certificate verification result.

According to another embodiment of the disclosure, step (3-2) further includes signing the certificate based on the private key of the first server to generate a first signature certificate, and transmitting the first signature certificate to the application. In the embodiment of the disclosure, step (4) further includes verifying the first signature certificate based on the public key of the first server; and signing the first signature certificate based on the private key of the application to generate a second signature certificate, and transmitting it to the second server. In an embodiment of the disclosure, step (5) further includes verifying the second signature certificate based on the public key of the application and the public key of the first server.

After reading the implementation method below, a person with ordinary knowledge in the technical field to which the present invention belongs can easily understand the basic spirit and other invention purposes of the present invention, as well as the technical means and implementation methods adopted by the present invention.

100: Service system

110: Blockchain

120: Applications

130: First server

140: Second server

S210-S230, S310-S340, S410-S450: Steps

U: Client

In order to make the above and other purposes, features, advantages and implementation methods of the present invention more clearly understood, the attached drawings are described as follows.

FIG. 1 is a schematic diagram of a service system 100 according to an implementation method of the present disclosure; FIG. 2 is a flow chart of the first server 130 of the service system 100 of FIG. 1 generating a certificate; FIG. 3 is a flow chart of the second server 140 of the service system 100 of FIG. 1 generating a service; FIG. 4 is a flow chart of a method according to an implementation method of the present disclosure.

According to the usual practice, the various features and components in the figure are not drawn to scale. The drawing method is to present the specific features and components related to the new invention in the best way. In addition, the same or similar component symbols are used to refer to similar components/parts between different figures.

In order to make the description of the disclosure more detailed and complete, the following provides an illustrative description of the implementation and specific embodiments of the present invention; however, this is not the only form of implementing or using the specific embodiments of the present invention. The implementation covers the features of multiple specific embodiments and the method steps and their sequence for constructing and operating these specific embodiments. However, other specific embodiments can also be used to achieve the same or equal functions and step sequences.

I Definition

For convenience, specific terms used in this specification, embodiments and the attached patent claims are collected here. Unless otherwise defined in this specification, the scientific and technical terms used herein have the same meaning as those understood and used by ordinary knowledgeable persons in the technical field to which the novel invention belongs. In addition, where there is no conflict with the context, singular terms used in this specification include plural forms of the terms, and plural terms used also include singular forms of the terms. Specifically, in this specification and the patent claims, the singular forms "a" and "an" include plural references unless otherwise indicated by the context. In addition, in this specification and the patent claims, the expressions "at least one" and "one or more" have the same meaning, and both represent one, two, three or more.

In the present disclosure, the "client" includes any computer device that can communicate with at least one server or application, wherein the communication connection is not limited to a wired or wireless network connection. According to one embodiment of the present invention, the "client" includes at least one graphical display device, allowing the user to interact with the application, tool, service or software through a graphical user interface. The "client" is the location where the user interacts with the system through a computer device or terminal. Here, the user of the client refers to a person who interacts with the system of the present invention through the "client", preferably anyone who has identity-related information, documents and other resources. Furthermore, a person with ordinary knowledge in the field of technology should understand that the number of the client can be one or more.

In this disclosure, the "application" refers to a program written for a specific purpose and used to perform specific tasks or functions on a computer, mobile phone, tablet or other device. Common applications include a variety of functions and uses, including industrial automation, controllers, business management, content access, education, simulation, multimedia development and product engineering. In this disclosure, the "application" is a middleware/controller that is responsible for receiving instructions or requests from users and coordinating and forwarding these requests in the system to ensure the correct operation and effective communication of the system.

In the present disclosure, the "server" is a computer system that provides services, resources or functions to other computers or devices, and usually has at least some form of storage unit and communication unit. The storage unit includes volatile and non-volatile, removable and non-removable media, and appropriate methods or techniques can be used to enable the above media to be used to store desired information (such as computer readable instructions, data structures, application modules, and other data). Storage media includes, but is not limited to, random access memory (RAM), read only memory (ROM), Electrically-Erasable Programmable Read-Only Memory (EEPROM), flash memory, or other memory technology, compact disc-ROM, digital versatile disc (DVD), or other optical storage, magnetic cartridges, magnetic tapes, magnetic disk storage, and other magnetic storage devices, or any other media capable of storing the required information and accessible to the processor. Generally speaking, the communication unit can implement computer-readable instructions, data, structures, application modules and other data into various data signals, and can transmit them through any communication media. As an example and not a limitation, the communication media includes wired media (such as wired networks or direct wired connections) and wireless media (such as sound waves, infrared rays, radio, microwaves, spread spectrum technology, and other wireless media technologies). In an embodiment of the present disclosure, the server is a computer system connected to the client, and/or a computer system used by different institutions (such as financial, educational, insurance institutions, etc.) to verify the identity of the user.

In this disclosure, the "certificate" refers to digital information used to prove the identity, authority or qualifications of a user, usually issued by a trusted organization. Generally speaking, the "certificate" does not contain the user's real information (such as date of birth, ID number, etc.), but only records the verification result.

In this disclosure, the "service" refers to the performance of duties to provide activities/work with specific value, capable of meeting specific needs or solving problems, including catering, medical care, finance, education, entertainment and other services. For example, the "service" refers to financial transaction services, when the financial institution confirms the identity certificate provided by the user, it transfers the funds to the account of a specific recipient or transfers assets according to the transaction application submitted by the user.

The term "hash" in this article refers to a string of fixed length used to verify data integrity in blockchain or other distributed systems. It converts input data (such as identity certificates) through a mathematical function (i.e., hash function). Generally speaking, the same content can only produce the same hash value when converted with the same hash function. Therefore, the consistency of the data content can be verified by comparing the contents of two sets of hash values.

II Specific implementation methods

1. Service system based on decentralized identity verification

In order to improve the defects of the current identity authentication mechanism (such as OAuth), users can verify their identity to other organizations without excessive disclosure of personal information to obtain the desired services. This disclosure provides a service system based on decentralized identity authentication using the characteristics of blockchain.

FIG. 1 is a schematic diagram of a service system 100 according to an implementation method of the present disclosure. As shown in the figure, the service system 100 of the present disclosure structurally includes a blockchain 110, an application 120, a first server 130 and a second server 140, wherein the client U communicates with the application 120 to transmit its instructions and/or requests to the service system 100, the application 120 communicates with the first server 130 and the second server 140, and the first and second servers 130 and 140 are further communicated with the blockchain 110 storing the identity information of the client U, thereby realizing the certificate exchange and verification between the first and second servers 130 and 140 (i.e., the issuing party and the verifying party).

Specifically, the user enters the account password through a personal computer device such as a computer or a smart phone (i.e., a client) and/or establishes a connection with the application by means of biometrics (e.g., fingerprint, face, palm print, iris, retina and/or voice authentication), so that the user can send a request for applying for a certificate and a service (i.e., a certificate application and a service application) to the service system 100 through the client U.

Then, a connection is further established between the application 120 and the first server 130, so that data can be transmitted between the application 120 and the first server 130 (i.e., sending a certificate application and issuing a certificate). According to an exemplary implementation of the present disclosure, the application 120 establishes a connection with the first server 130 through a first connection. Specifically, the first server 130 generates a first connection according to the login message of the client U, and the client U confirms and establishes a connection relationship between the first server 130 and the application 120 by operating the first connection. Optionally, the first connection is time-sensitive, and the connection can only be successfully established if the user operates within a specific period of time. If the time is exceeded, the connection cannot be established through the first connection. According to an optional implementation of the present disclosure, the first link can be in the form of a Uniform Resource Identifier (URI), a Uniform Resource Locator (URL; also known as a Uniform Resource Locator, location address, URL address), a Uniform Resource Name (URN), a Digital Object Identifier (DOI), a Persistent URL (PURL) or a Quick Response Code (QR code; also known as a QR code, a mobile barcode, or a two-dimensional barcode) to locate and access resources on the Internet, but the form of the first link is not limited thereto. This article only exemplifies several link forms commonly used to establish cross-device connections. Those skilled in the art can select an appropriate form to establish a connection based on actual usage requirements. In one embodiment of the disclosure, the first link is a URI, and the client U can click on the URI to agree to the application 120 to communicate with the first server 130. In another embodiment of the disclosure, the first link is in the form of a two-dimensional barcode, and the client U can scan or parse the two-dimensional barcode to agree to the application 120 to communicate with the first server 130. The aforementioned method of establishing a connection is not only fast, but also ensures the accuracy of the connection.

After the first server 130 establishes a connection with the application 120, it can receive the certificate application input by the client U from the application 120 and generate a corresponding certificate according to the content of the certificate application.

Please refer to Figure 1 and Figure 2 at the same time, wherein Figure 2 is a flowchart of the first server 130 generating a certificate according to an implementation method of the present disclosure. As shown in Figure 2, the first server 130 generates a certificate by executing the following steps: Step S210: receiving a certificate application from an application; Step S220: obtaining identity information from a blockchain to verify the client and generate a first identity verification result; and Step S230: generating a certificate corresponding to the certificate application according to the first identity verification result.

In step S210, the certificate application from the application 120 includes application items of the certificate that the client U wants to apply for. The application items may be determined according to the type of service applied for, wherein the application items include, but are not limited to, the user's name, birthday, age, address, phone number, email address, ID number, driver's license number, bank account information, credit card number, health/medical records, work records, tax information, marital status, insurance number, education and other information related to the user. For example, if a user wants to apply for a money transfer service, he or she needs to apply for a certificate to confirm that there is enough money in the account to use this service. Therefore, the application item needs to select bank account information to confirm the account balance.

In step S220, the first server 130 obtains the identity information corresponding to the user identity stored in the blockchain 110 according to the login information of the client U to verify whether the user applying for the certificate is legitimate (that is, whether the client U is a registered user), thereby generating a first identity verification result. According to an exemplary implementation of the present disclosure, the first server 130, as the certificate issuer, needs to first confirm the true identity of the client U, and establish the identity information corresponding to its identity and store it on the blockchain 110 for use in subsequent identity verification procedures. That is, the client U needs to register its identity with the first server 130 before starting to apply for the certificate. When a user registers his/her identity, he/she will generate an immutable identifier representing the user, called a decentralized identity (DID), and a decentralized identity document (DID Document) recording data related to a specific DID, and upload it to the blockchain 110 for storage. The DID-related data includes the DID owner, verification method, creation time, update time, and service endpoint, but does not include the user's real personal information. Specifically, the first server 130 parses and obtains the DID document (i.e., the identity information of the client U) from the blockchain 110 to verify the user's identity.

In step S230, after completing the aforementioned verification process, the first server 130 can generate the required certificate according to the first identity verification result corresponding to the certificate application, and return the certificate to the application 120. According to the non-essential implementation method of the present disclosure, the application 120 can be used to store one or more received certificates to facilitate the client U to manage its own certificates.

In addition, in order to enable the certificate verifier (e.g., the second server 140) to further verify the certificate content, the first server 130 further converts the generated certificate into a hash value (i.e., a hash certificate) through the operation of a hash function and writes it into the blockchain 110. In other words, if the data in the certificate needs to be modified, a new certificate must be obtained again, otherwise the verifier will not be able to successfully verify the new certificate content.

In some embodiments of the present disclosure, the first server 130 uploads the hash certificate to the blockchain 110 based on a write permission. Specifically, a list of trusted issuers (or whitelist) is stored on the blockchain 110, and the organization to which the first server 130 belongs is compared with the list of trusted issuers. If the first server 130 is listed in the list, the write permission is granted; otherwise, the first server 130 is denied to write data into the blockchain 110. The list can be increased or decreased at any time according to demand to manage trusted issuers.

In the complete identity and certificate verification process of the disclosed content service system, the certificate generated by the first server 130 will be forwarded multiple times so that each site receiving data (i.e., the application 120 and the second server 140) can confirm the source of the certificate. In an embodiment of the disclosed content, after the certificate is generated (i.e., after step S230), the first server 130 further signs the certificate based on its private key to generate a first signed certificate, and transmits the first signed certificate to the application 120. After receiving the first signature certificate from the first server 130, the application 120 can verify the first signature certificate based on the public key of the first server 130 (corresponding to the private key of the first server 130). If the verification is successful, it means that the certificate is from the first server 130; if the verification fails, it means that the certificate is not from the first server 130, and the certificate is invalid.

After the application 120 receives the desired certificate, it further establishes a connection with the second server 140, so that the application 120 and the second server 140 can interact (i.e., send certificates, send service applications, and provide services). Specifically, the method of establishing a connection between the application 120 and the second server 140 is substantially the same as the method of establishing a connection between the application 120 and the first server 130, that is, the second server 140 generates a second link according to the login information of the client U, and the client U establishes a connection relationship between the second server 140 and the application 120 by operating the second link. Exemplary forms of the second link that can be used to establish a cross-device connection include, but are not limited to, URI, URL, URN, DOI, PURL, and QR code. In a specific implementation of the present disclosure, the second link may be a URI or a QR code. Depending on the implementation of the present disclosure, the first link and the second link may be in the same or different forms. For example, the first link and the second link are both presented as a URI or a QR code; or, the first link is presented as a URI, and the second link is presented as a QR code.

After the connection is established, the second server 140 can receive the certificate and service application from the application 120, generate the service required by the client U, and provide the service to the client through the application 120.

FIG. 3 is a flowchart of the second server 140 generating a service according to an implementation method of the present disclosure. As shown in the figure, the second server 140 generates a service by executing the following steps: Step S310: receiving a certificate and a service application from an application; Step S320: obtaining identity information from a blockchain to verify the client and generate a second identity verification result; Step S330: verifying the certificate of step S310 with the hashed certificate on the blockchain to generate a certificate verification result; and Step S340: generating a service corresponding to the service application according to the second identity verification result of step S320 and the certificate verification result of step S330.

After receiving the certificate and service application, the second server 140 verifies the identity and certificate of the client U to confirm whether the user identity and the source and content of the certificate are reliable. If both verifications are passed, the service is generated according to the service application; if any of the verifications fails, the service is refused.

In step S310, the client U can select the certificate to be transmitted in the application 120 according to the needs, and transmit it to the second server 140 together with the service application. According to a specific implementation of the present disclosure, the application 120 will use its private key to sign the certificate, so that the second server 140 can verify the certificate based on the public key of the application 120 to confirm the source. In an embodiment of the present disclosure, the certificate received by the application 120 is a first signed certificate signed by the private key of the first server 130. After the verification, the application 120 further signs the first signed certificate with its private key to generate a second signed certificate and transmits it to the second server 140. When the second server 140 receives the second signature certificate, it can verify the second signature certificate based on the public key of the application 120 and the public key of the first server 130, so that the second server 140 can simultaneously confirm the issuer and the relay program (i.e., the first server 130 and the application 120).

In step S320, the second server 140 verifies the identity of the client U. The verification process is basically the same as the identity verification process performed by the first server 130 (step S220 in Figure 2). According to an embodiment of the present disclosure, the second server 140 obtains the identity information corresponding to the user identity stored in the blockchain 110 based on the login information of the client U, and verifies whether the user who submits the certificate and applies for the service is legitimate (that is, whether the client U is a user registered in the service system 100), and generates a second identity verification result. According to an embodiment of the present disclosure, the second server 140 verifies the user's identity by parsing and obtaining the DID document (i.e., identity information) corresponding to the DID of the client U from the blockchain 110.

Next, the second server 140 verifies the certificate content. In step S330, the second server 140 generates a hash certificate to be verified by performing a hash function operation on the received certificate, and compares the hash certificate to be verified with the hash certificate originally uploaded by the first server 130 on the blockchain 110 to generate a certificate verification result, wherein, when the hash certificate to be verified matches the hash certificate, the verification is passed; if the hash certificate to be verified does not match the hash certificate, it means that the certificate transmitted to the second server 140 may be modified during the transmission process, and the content is different from the certificate uploaded by the first server 130, and the verification fails at this time. It is worth noting that the signature and verification in step S310 are used to verify the source of the certificate, while the hash verification in step S330 is used to verify whether the content of the certificate has been tampered with. Through such a verification process, certificates with incorrect sources can be excluded first, and only certificates from the correct issuer are verified for content, so as to save the computing power of the server, reduce the energy consumption of the server operation process, and improve its overall performance.

Finally, in step S340, if the identity and certificate content of the client U are both verified, the second server 140 can generate the service requested by the client U according to the second identity verification result and the certificate verification result, and return the service to the application 120. The client U can then obtain the required service through the application 120.

2. Methods for verifying client identity based on decentralized identity

This disclosure also provides a method of verifying the identity of the client through centralized identity and certificates to develop a login method that replaces the currently commonly used OAuth protocol, which can improve the security of the user's personal information while maintaining its convenience.

FIG. 4 is a flow chart of a method according to an implementation mode of the present disclosure. As shown in the figure, the method includes: step S410: providing a verification platform, including a blockchain, an application, a first server and a second server; step S420: sending a certificate application from the application to the first server according to the operation of the client; step S430: the first server receives the certificate application, generates a certificate corresponding to the certificate application and sends it to the application, and converts the certificate into a hash certificate and uploads it to the blockchain; step S440: sending the certificate from the application to the second server according to the operation of the client; step S450: the second server receives the certificate and verifies it with the hash certificate on the blockchain to confirm the identity of the client.

Specifically, the disclosed method receives the client's request through the verification platform and uses the functional module in the verification platform to execute the identity verification process.

In step S410, a verification platform including a blockchain, an application, a first server, and a second server is provided, wherein the application serves as a connection between the verification platform and the client, and is used to communicate with the client, and the application also serves as a communication channel between the first server and the second server, and is respectively communicated with the first and second servers; in addition, the blockchain stores the identity information of the client, and the first server and the second server are respectively communicated with the blockchain to perform data storage and verification by utilizing the characteristics of the blockchain that is not easily tampered with. The identity information is a DID document that records the DID-related data of the client. In this disclosure, the client communicates with the verification platform application in step S410 through a personal computer device, and inputs requests and/or instructions to operate the verification platform to perform identity verification.

According to the optional implementation of the present disclosure, the client can choose to establish a connection with a specific first and second server in the personal device. In an embodiment of the present disclosure, the application establishes a connection with the first and second servers respectively through the first link and the second link generated by the first server and the second server, so that the application communicates with the first and second servers respectively.

In step S420, the client inputs a certificate application request through a personal device and sends it to the application. When the application receives the request, it generates a certificate application according to the request and sends it to the first server. The certificate application includes application items of the certificate that the client wants to apply for; for example, the application items can be authentication of the user's identity information (e.g., name, birthday, age, address, phone number, email address, ID number, marital status and driver's license number), authentication of financial information (e.g., bank account information, credit card number and tax information), authentication of medical information and/or authentication of employment records. It can be seen that the identity described in this disclosure is not limited to personal information such as name, age, birthday, etc. It also includes personal status and qualifications; for example, the identity can refer to the user's academic information, deposit records, medical records, etc. Therefore, verifying the identity of the client can mean confirming whether the information is true.

Then, in step S430, after receiving the certificate application, the first server first obtains the identity information of the corresponding client from the blockchain, verifies whether the user is a registered user, and generates a first identity verification result. Based on the first identity verification result, the legitimacy of the client identity is confirmed (i.e., the user is a registered user), and the required certificate is generated in response to the certificate application and transmitted to the application. Optionally, the application can be used to store and manage the received certificate.

The first server also converts the certificate into a hash certificate and uploads it to the blockchain for storage for subsequent certificate verification. According to an implementation method of the present disclosure, the first server generates the hash certificate by passing the certificate through a hash function.

In addition, according to a specific implementation of the present disclosure, the first server must be listed in the whitelist of trusted issuers to obtain the write permission to upload data to the blockchain, and upload the hash certificate to the blockchain based on the write permission. However, if the first server is not listed in the whitelist, it is denied to upload data to the blockchain. The whitelist can be increased or decreased at any time according to demand to manage the list of trusted issuers.

In step S440, the client can select a specific certificate from the application and send it to the second server.

Finally, in step S450, after receiving the certificate of the application, the second server will also obtain the identity information of the corresponding client from the blockchain, verify whether the user is a registered user, and generate a second identity verification result. Then, the second server will use the same hash function operation on the received certificate used in step S430 to generate a hash certificate to be verified and compare it with the hash certificate on the blockchain, and generate a certificate verification result to confirm the identity of the client.

Since both the first and second servers can be connected to multiple different applications (i.e., different clients), in order to make the data source more specific, a checking mechanism can be established at each recipient of the transmitted data (i.e., the application and the second server) to avoid executing the verification process with incorrect data, thereby affecting the overall verification efficiency. In an implementation method of the present disclosure, before the certificate is transmitted to the application, the first server will sign it with its private key to generate a first signature certificate, which is used by the certificate recipient to confirm the identity of the issuer (i.e., the first server); when the application receives the first signature certificate, in order to confirm that the source of the certificate is the first server, the first signature certificate will be verified using the public key of the first server. If the verification is successful, the source can be confirmed; and the application further signs the first signature certificate based on the application's own private key to generate a second signature certificate, and transmits the second signature certificate to the second server. As described above, when the second server receives the second signature certificate from the application, it can perform a second verification on the second signature certificate based on the public key of the application and the public key of the first server to confirm the identity of the issuer and the source of the application.

In summary, this disclosure provides a service system based on decentralized identity authentication and a method for authenticating the identity of a client. Through certificates and decentralized identities, the data control in the authentication process is returned to the user, reducing the possibility of personal data leakage, and filtering out erroneous data through a phased authentication method, thereby improving the accuracy and reliability of data and users, and reducing unnecessary authentication operations performed by the server.

It should be understood that the above description of the embodiments is given only in the form of embodiments, and those with ordinary knowledge in the art to which this invention belongs can make various modifications. The above specification, embodiments and experimental results provide a complete description of the structure and use of the exemplary embodiments of the present invention. Although various specific embodiments of the present invention are disclosed in the above embodiments, they are not used to limit the present invention. Those with ordinary knowledge in the art to which this invention belongs can make various changes and modifications to it without deviating from the principles and spirit of the present invention. Therefore, the scope of protection of the present invention shall be based on the scope defined by the attached patent application.

100: Service system

110: Blockchain

120: Applications

130: First server

140: Second server

U: Client

Claims (10)

A service system based on decentralized identity authentication is connected to a client to provide a service to the client, comprising: A blockchain storing identity information of the client; An application connected to the client to receive a certificate application and a service application from the client; A first server connected to the application and the blockchain to generate a certificate corresponding to the certificate application, convert the certificate into a hashed certificate, and upload it to the blockchain; and A second server is connected to the application and the blockchain respectively, for generating the service in response to the service application, and transmitting the service to the application to provide the service to the client; Wherein, the first server generates the certificate by executing the following steps: (a) receiving the certificate application from the application; (b) obtaining the identity information from the blockchain to verify the client and generate a first identity verification result; (c) generating the certificate in response to the certificate application based on the first identity verification result; (d) signing the certificate based on a private key of the first server to generate a first signed certificate; (e) The first signature certificate is sent to the application; and the second server generates the service by executing the following steps: (i) receiving the certificate and the service application from the application; (ii) obtaining the identity information from the blockchain to verify the client and generate a second identity verification result; (iii) verifying the certificate of step (i) with the hash certificate on the blockchain to generate a certificate verification result; and (iv) generating the service in accordance with the second identity verification result of step (ii) and the certificate verification result of step (iii); wherein, When the application receives the first signature certificate from the first server, the application verifies the first signature certificate based on a public key of the first server; further signs the first signature certificate based on a private key of the application to generate a second signature certificate and transmits it to the second server; and When the second server receives the second signature certificate from the application, the second server verifies the second signature certificate based on a public key of the application and the public key of the first server. A service system as described in claim 1, wherein the application is connected to the first server and the second server via a first link and a second link. The service system as described in claim 1, wherein the first server uploads the hash certificate to the blockchain based on a write permission. The service system as described in claim 1, wherein the hashed certificate is generated by passing the certificate through a hash function. The service system as described in claim 4, wherein process (iii) further comprises: (iii-1) passing the certificate of process (i) through the hash function to generate a hash certificate to be verified; and (iii-2) comparing the hash certificate to be verified with the hash certificate to generate the certificate verification result. A method for verifying the identity of a client based on decentralized identity, comprising: (1) providing a verification platform, comprising a blockchain, an application, a first server and a second server, wherein the blockchain stores identity information of the client; and the application is connected to the first server and the second server for communication, and the first server and the second server are connected to the blockchain for communication; (2) transmitting a certificate application from the application to the first server according to the operation of the client; (3) the first server receives the certificate application to execute the following procedures: (3-1) obtaining the identity information from the blockchain to verify the client and generate a first identity verification result; (3-2) Based on the first identity verification result, a certificate is generated corresponding to the certificate application, and the certificate is transmitted to the application. The certificate is signed based on a private key of the first server to generate a first signature certificate, and transmitted to the application; and (3-3) The certificate is converted into a hash certificate and uploaded to the blockchain; (4) Based on the operation of the client, the certificate is transmitted from the application to the second server, and the first signature certificate is verified based on a public key of the first server; and the first signature certificate is signed based on a private key of the application to generate a second signature certificate, and transmitted to the second server; (5) The second server receives the certificate to perform the following procedures: (5-1) obtain the identity information from the blockchain to verify the client and generate a second identity verification result; (5-2) verify the certificate with the hash certificate on the blockchain based on the second identity verification result to generate a certificate verification result; and (5-3) confirm the identity of the client based on the certificate verification result, wherein the second server verifies the second signature certificate based on a public key of the application and the public key of the first server. The method as described in claim 6, wherein step (1) further comprises: (1-1) the first server and the second server generate a first link and a second link respectively; and (1-2) the application communicates with the first server and the second server through the first link and the second link. The method as described in claim 7, wherein step (3-3) is uploading the hash certificate to the blockchain based on a write permission. The method of claim 7, wherein step (3) is performed by passing the certificate through a hash function to generate the hashed certificate. The method as described in claim 8, wherein step (5-2) is to pass the certificate through the hash function to generate a hash certificate to be verified, and compare the hash certificate to be verified with the hash certificate to generate the certificate verification result.

Images