The present invention relates to, in providing a blockchain based authentication, transaction and electronic signature service to a holder (user)'s mobile device, an on/offline mutual authentication and transaction technology configured to process an offline mutual authentication while maintaining a distance without close contact even on offline by developing an online mutual authentication DID (Distributed Identity) that provides a self-authentication value after allowing a holder to first ascertain whether a counterpart connected to the holder online is a legitimate counterpart (or authentication request).
Concomitant with a contactless environment due to abrogation of government-initiated electronic certificate system and Corona virus outbreak, interests on a new authentication and electronic signature technology combined both with security and convenience are drawing attention.
In terms of security aspect, the security system has evolved from a first generation Central Identity system and a second generation Federated Identity system to a decentralized blockchain based third generation DID (Distributed Identity) system.
The said DID authentication system is not only used by being limited to an online transaction but also by being used on offline transaction using QR codes and smartphones.
However, even if a DID authentication system is a safe system guaranteed by blockchain that can rely on a user's public key, and if a system initially accessed by a user or authentication request values (QR code, return URL and the like) are fake, the user's authentication information can be stolen by an attacker at any time. The conventional DID authentication technology has a risk of providing only his or her certificate of identity or electronic signature to a counterpart without a user's ascertaining an opportunity of prior knowledge to whom the certificate of identity was provided and on what the electronic signature was made.
In other words, the conventional DID authentication technology, like the hitherto developed all authentication technologies (i.e., inclusive of OTP, PKI, biometric authentication, action based authentication and blockchain authentication and the like), have developed in the manner of verifying only whether a user accessed to a particular service is a legitimate and has never verified whether a service provider providing the said particular service is a genuine service provider.
For that reason given above, when a user accesses to a service of a malicious attacker disguised as a legitimate service provider and responds to a user authentication or an electronic signature, the relevant user's identity and electronic signature have no choice but to be stolen.
Malicious attackers may exist not only online but also offline. Taking a QR code as an example, when an attacker distributes a pre-generated malicious authentication or an electronic signature QR code to a smartphone of an offline service provider, and a legitimate user recognizes and approves the same as his or her smartphone application (App), the user may approve while not knowing what content he or she actually has approved, whereby his or her identity information may be hijacked or electronic signature may be deprived.
This type of fraudulent transaction (QRishing) caused by replacement of QR code frequently occurs in the offline mobile authentications. Therefore, no matter how a back end of authentication system is guaranteed by a strong blockchain, if a system or an authentication request value (QR code, return URL and the like) initially accessed by a user is faked, the user's authentication information and electronic signature can be stolen or used illegally at any time.
Furthermore, situations have recently surfaced due to outbreak of Corona virus where a safe face-to-face transaction must be made offline while maintaining a distance of 2 or more meters, and therefore an improved method is necessitated where a user's own authentication value or electronic signature value can be transmitted after safely ascertaining the other party to a transaction at a quarantine distance of 2 or more meters in order to improve the QR or NFC authentication method authenticated only within a close distance of 1 meter.
The present invention has been derived to solve the aforementioned problems and it is an object of the present invention to provide a DID based online mutual authentication and transaction technology in which a user's authentication value is transmitted to a relevant service after first ascertaining whether a service requesting a user authentication is a legitimate service, and an offline mutual authentication and transaction method in which a user's authentication value can be transmitted after first ascertaining whether a transaction party (or IoT device) is a legitimate counterpart even at a 2 or more meter offline safe quarantine distance.
In one general aspect of the present invention, there may be provided a blockchain based authentication and transaction system including a user DID (Distributed Identity) wallet which is an application program installed on a user's mobile terminal.
Here, the user DID (Distributed Identity) wallet may allow a user to ascertain whether a counterpart is a legitimate (genuine) party by verifying a counterpart's VP (Verifiable Presentation) and expressing the verified counterpart ascertainment information on a screen when the counterpart's VP provided from a counterpart system which is an authentication or transaction counterpart is obtained.
In one exemplary embodiment, the user DID wallet may decode the counterpart's VP using a public key corresponding to the counterpart's VP, verify the counterpart' electronic signature included in the decoded VP, obtain an issuer's electronic signature that has issued the counterpart' VC from the counterpart's VC (Verifiable Credential) included in the decoded VP, and screen-express the verified counterpart's confirmation information to the user after verifying the issuer's electronic signature using the public key of the issuer.
In one exemplary embodiment, the counterpart's VP may be a static VP of pre-generated fixed value, or a dynamic VP dynamically generated by the counterpart's DID wallet at the authenticated or transacted time by encoding the pre-issued counterpart's VC using a private key.
In one exemplary embodiment, the blockchain based authentication and transaction system may further include a counterpart's DID wallet which is an application program installed on the counterpart's system. Here, the counterpart's DID wallet may mount the counterpart's VP on a QR (Quick Response) code, or may provide the QR code to the user by mounting the network access information of repository on the QR code that is accessible to the counterpart's VP. Here, the user's DID wallet may obtain the counterpart's VP through recognition of the QR code.
In one exemplary embodiment, the counterpart's DID wallet may allow submitting the user's VP to the counterpart' system or to a submitter designated by the counterpart's system or the counterpart's VC only when the counterpart is authenticated by the user through the screen-expressed counterpart's confirmation information.
In one exemplary embodiment, the counterpart's DID wallet may extract a terminal identification value from a short-range wireless signal transmitted from the counterpart's system or from an interlocking device that interlocks with the counterpart's system, and obtain the counterpart's VP corresponding to the terminal identification value from a terminal information server by transmitting the extracted terminal identification value to the terminal information server.
In one exemplary embodiment, the counterpart's DID wallet may additionally perform a verification on whether the terminal identification value extracted from the short range wireless signal and the terminal identification value of the counterpart's system included in the decoded VP are matched, and may allow submitting the user's VP to a submitter designated by the counterpart's system or the counterpart's VP only when the said verification is normally realized.
In one exemplary embodiment, the counterpart's DID wallet may provide a screen where a remittance amount can be inputted only to a deposit address based on recipient information expressed on the screen as the counterpart's confirmation information when the transaction corresponds to a blockchain based remittance transaction, and may transmit to the relevant remittance address when the user remits the remittance amount.
The exemplary embodiments of the present invention have advantageous effects of providing an offline mutual authentication and transaction method where a safer identity authentication and transaction is made possible by providing a DID based online mutual authentication technology in which a user authentication value is transmitted to a relevant service after first ascertaining whether a service requesting a user authentication is a legitimate service, and a safe identity authentication and transaction is also made possible while maintaining a safe quarantine distance even offline.
The invention described hereunder may be applied with various changes and several exemplary embodiments, and particular exemplary embodiments will be described in detail through exemplary drawings and detailed descriptions.
However, it should be noted that the present invention is not limited to particular exemplary embodiments, and it will be appreciated that the present invention described is intended to embrace all such alterations, modifications, and variations that fall within the scope and novel idea of the present invention. In describing the present invention, detailed descriptions of well-known art in the art may be omitted to avoid obscuring appreciation of the invention with unnecessary details.
Numerals (e.g., first, second, etc.) used in the process of explaining the present specification are merely identifying numerals to distinguish one element from another element.
Furthermore, throughout the specification, it will be understood that when an element is referred to as being “connected”, “coupled” or “accessed” to another element, it can be directly connected, coupled or accessed to the other element or intervening elements may be present unless explicitly described to the contrary.
In addition, throughout the specification, when an element “includes” another element, this does not mean that another element is precluded but may further include another element unless explicitly described to the contrary.
Now, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.
Toward this end, the conventional general DID technology will be explicitly described hereunder.
As explained above, the general user authentication or an electronic signature flow is such that a user authentication or an electronic signature is realized by allowing a service provider to provide a QR code mounted with an address that receives a user VP or a link to a user wallet, and a user to submit the VP to a relevant URL address or to the link.
That is, the authentication process based on the standard DID according to the prior art only performs a user authentication and cannot process the authentication on whether a service provider providing a relevant service or a counterpart requesting an electronic signature is legitimate or genuine.
Unlike the prior art, the present invention provides a DID based online mutual authentication and electronic signature technology in which a user authentication value is transmitted to a relevant service after first confirming whether a service requesting a user authentication is a legitimate or genuine service, and also provides an offline mutual authentication and electronic signature technology in which a user authentication value is transmitted after first confirming offline whether a transaction counterpart (or IoT device) is a legitimate counterpart. Now, in relation thereto, the technical method according to the present invention will be described hereunder in detail with reference to
In description of
Furthermore, in description of
[DID Based Online Mutual Authentication—User Authentication Information Transmission Method Subsequent to Confirmation of Service Provider Using the SVP]
Referring to
Thereafter, when a user recognizes a QR code using a DID wallet installed on a user's own mobile terminal [See reference numeral 4 of
At this time, the verification process on whether the counterpart is legitimate through the user's DID wallet may be explained as under.
First, the user's DID wallet may inquire into a public key from a relevant blockchain system by referring to the DID information (Distributed Identification information) (which may be one type of a public key address) included in the SVP obtained through the QR code recognition, and may decode the data included in the SVP using the inquired public key.
At this time the decoded SVP may include the counterpart VC (i.e., SVC), a counterpart's electronic signature value. Furthermore, the decoded SVP may include not only the identification information that can confirm a relevant counterpart (hereinafter simply referred to as counterpart confirmation information but also an electronic signature value of an issuer who issued the SVC and the public key address.
As a result, the user DID wallet may verify the counterpart's electronic signature value using a public key corresponding to the SVP. To be more specific, the user DID wallet may verify whether the counterpart's electronic signature value is legitimate or genuine by confirming whether the generated electronic value and the counterpart's electronic signature value included in the decoded SVP are matched using a public key corresponding to the SVP and Hash function (which is a Hash function used by the counterpart when generating a relevant electronic signature value).
Furthermore, the user DID wallet may verify an issuer's electronic signature value. To be more specific, the user DID wallet may first obtain a relevant issuer's public key using the issuer's public key address included in the SVC, and may verify the genuineness of the issuer's electronic signature value (i.e., verification of genuineness per se of the SVC) by confirming whether the generated electronic signature value and the issuer's electronic signature value included in the SVC are matched using the obtained issuer's public key and the predetermined Hash function (which is a Hash function used when the issuer generates a relevant electronic signature value).
As explained above, when the verification of genuineness of the SVP and the SVC is completed, the user DID wallet may express, on a wallet App screen, the counterpart's confirmation information (i.e., the verification-completed counterpart's confirmation information) included in the decoded SVP. As a result, the user may confirm the counterpart's confirmation information verified through the wallet App screen, through which the verification of genuineness of the counterpart can be confirmed.
When the genuineness of counterpart is confirmed through the aforesaid processes and when the user performs the confirmation process (e.g., by click of confirmation button) through the wallet App screen, the user DID wallet may generate a user VP and allow submitting the same to a submitter (i.e., return URL) designated by the user VP at the Verifier (i.e., counterpart system) or SVC [See reference numerals 6 and 7 of
At this time, the user's VP submission process and the subsequent service processing based on the user authentication [See reference numerals 8˜10 of
The service provider (Verifier in
In this case, the service DID wallet may provide a QR code to the user after the QR code is mounted with SVP, or the QR code is mounted with network access information of repository (storage) accessible to the SVP.
An exemplary screen of service processing regarding the case of online mutual authentication of the aforementioned
At this time, the online service mutual authentication process of the aforementioned
Furthermore, the online service mutual authentication process of aforesaid
In order to realize the offline mutual authentication using the aforesaid BLE beacon, the counterpart system or a device interlocked therewith is required to be mounted with a BLE beacon transmission module. At this time, when a device mounted with a BLE transmission module is a mobile terminal, it operates simply as a client and cannot operate as a server such that it is impossible to transmit by allowing the SVP to be mounted within a message of BLE beacon signal. Thus, when an offline mutual authentication service using the BLE beacon is to be realized, there may be an additional configuration of TIS (Terminal Information Server) as shown in
[Offline Mutual Authentication—a User Authenticating Method after Confirmation of Offline Counterpart Using the SVP, Albeit Using the BLE Beacon and the TIS]
Referring to
As a result, the user DID wallet may obtain a counterpart SVP corresponding to a relevant terminal identification information by transmitting the terminal identification information to the TIS [See reference numerals 2 and 3 of
When the said process of confirming whether the counterpart is genuine is completed, the user DID wallet may express the verified counterpart confirmation information through a wallet App screen, and when a counterpart confirmation is completed from the user, the user DID wallet may generate a user VP and transmit the same to the counterpart system [See reference numerals 5 and 6 of
In the aforesaid offline mutual authentication process, the user DID wallet may further add the following process. That is, the user DID wallet may determine that the SVP content is legitimate only when the counter intrinsic identification value (UUID) received from the BLE beacon and the intrinsic identification value within the SVP received from the TIS are matched, and may allow the counterpart confirmation information to be expressed on the wallet App screen.
Furthermore, when a counterpart BLE data comprised of counterpart intrinsic identification value and authentication value (a variable value changing at every 60 seconds) is received, the user DID wallet may transmit to the counterpart side by signing the counterpart's authentication value using the user's own private key when the user VP is submitted.
At this time, the counterpart system may additionally confirm that a relevant user exists at a position near to the BLE beacon transmission area based on the authentication value included in the user VP received from the user side in the process of verifying the user VP in the blockchain system.
An exemplary screen of service processing regarding the case of online mutual authentication of the said
[Offline Mutual Authentication—Method of Authenticating a User after Confirmation of Offline IoT Using the SVP]
Referring to
The aforementioned blockchain based authentication and transaction system may be identically applied to other transactions such as remittance and deposit and withdrawal, which will be explained with reference to
Although the conventional blockchain transaction did not contain private information of a recipient or of a receiver in the blockchain because of emphasis of anonymity, the trend is that use of real names between a remitter and a recipient is gradually taking root while relevant laws are amended. Concomitant with this trend, the aforementioned technology of the present invention may be also used in the confirming process between a remitter and a recipient during cryptocurrency (coin/token) transactions in addition to identity authentication.
In the conventional technology, users had to transmit coins and tokens only to a public key address while not confirming to whom the coins and tokens are transmitted. Thus, errors have occurred where an erroneous public key address is inputted, and problems have occurred where, even if a public key address is correct, a blockchain was mistakenly chosen and remittance was made to a relevant public key address.
Therefore, the technology of the present invention, when applied to coin/token remittance transactions, can realize a safe transaction using a method of sending a remittance amount via blockchain by receiving the remittance amount only through a public key address, which is a relevant deposit address, after first confirming recipient information based on DID, and expressing to a user, by a wallet, counterpart confirmation information (recipient name, blockchain, public key address and the like) contained in the relevant DID information under the user's approval (consent).
Depending on a method realizing the system, a wallet configured to send the transaction may be also implemented by allowing even the remittance amount to be contained in the DID information without a user's input of the remittance amount.
To be more specific, as shown in
Referring to
Another applicable example is the one where coins/tokens possessed by his or her own mobile wallet are deposited using cryptocurrency exchange website, which is illustrated in
Still another applicable example is the one where coins/tokens possessed by cryptocurrency exchange website are withdrawn using his or her own mobile wallet, which is illustrated in
Referring to
Furthermore, referring to
The blockchain based authentication and transaction system according to the aforementioned present invention may be implemented by a computer-readable media in a computer-readable code. The computer-readable media may include all types of recording media stored with data decoded by computer system. By way of example, and not limitation, such computer-readable media may comprise ROM (Read Only Memory), RAM (Random Access Memory), magnetic tapes, magnetic discs, flash memory, optical data storage and the like. Furthermore, the computer-readable media may be distributed to a computer system connected to a computer communication network and stored and implemented by a code that can be read in a distributed way.
Although the present invention has been described in terms of exemplary embodiments, the present invention is not limited thereto. It should be easily appreciated that variations and changes may be variably made in the embodiments described by persons skilled in the art without departing from the teachings and scope of the present invention as defined by the claims.
Filing Document | Filing Date | Country | Kind |
---|---|---|---|
PCT/KR2021/019924 | 12/27/2021 | WO |