KR102016730B1 - Authentification methods and system based on programmable blockchain and one-id - Google Patents

Abstract

The present invention can provide a user authentication method and system for more securely performing user authentication by registering a user ID and a user public key in a programmable blockchain and performing a user authentication program. In addition, by accessing the blockchain through the authentication server (or management server), multiple service provider servers can check the user information without having to individually create a blockchain transaction. In addition, by encrypting the user information verified through the certification authority and stored in the blockchain, there is no need to verify the user's identity every time the user is authenticated, and there is no risk of leakage of user information even if the service provider server is hacked. In addition, the use of a programmable blockchain, for example, Ethereum, ensures the integrity of user authentication programs as well as user information, and even an authentication server cannot tamper with the user authentication program of the blockchain. In addition, since a single ID can log in to multiple institution servers, provide user information, and authenticate user information, user information is not distributed to multiple institution servers, making it easy to manage user information. When changing user information such as information, server information, phone number or personal documents, or whenever a service provider subscribes to a service, both ID and password are memorized, and there is no inconvenience of having to re-enter user information.

Description

Programmable blockchain and integrated identity based user authentication method and system {AUTHENTIFICATION METHODS AND SYSTEM BASED ON PROGRAMMABLE BLOCKCHAIN AND ONE-ID}

The present invention relates to a programmable blockchain and an integrated ID (ID) based user authentication method and system, and more particularly, to register a user ID and a user public key on a programmable blockchain and perform a user authentication program. The present invention relates to a user authentication method and system which ensures the integrity of a user authentication program while at the same time keeping user information more secure.

Conventional user authentication, identity verification or personal authentication system has a problem that the user information is leaked when hacking the institution server because the user information is stored in various service provider (or institution) server. In addition, since user information or personal information is distributed in various institutional sites (servers), it is difficult to manage the history of providing user information, and when changing addresses, terminal information, server information, and telephone numbers, the site must be changed at various sites. In addition, problems with user (personal or institutional) identity theft may arise. In addition, per service of each agency. It is inconvenient to remember both the ID and the password separately, and the hassle of having to repeatedly enter the user information every time the user subscribes to the service of each service provider.

To solve this problem, we can use blockchain that has recently been proven to be highly secure and safe. Korean Patent No. 10-1590076 discloses a technique for encrypting and registering user information on a blockchain. It is a structure that delivers user information by mapping users and institutions (service provider) servers one-to-one. It uses blockchain as an intermediate medium. It enhances security by encrypting user information with the user's public key and storing it in the blockchain. have. However, every time the stored user information is accessed, identity verification or identity verification is required every time, and all institutions must directly generate a transaction every time they access the blockchain, which increases the cost and waiting time.

As blockchain technology has evolved, there is now introduced a blockchain that can be programmed to upload various programs instead of just as a storage medium. An example is Ethereum. If Bitcoin using blockchain is used as a currency, Namecoin acts as a currency and token, Primecoin doubles the computing power, and Coloredcoin allows money to represent a particular asset, Ether Leeum is an open platform that allows you to view the blockchain as a database, load all assets, and directly program how each asset is driven or traded. On Ethereum, you can design Bitcoin, Namecoin, Primecoin, and Colored Coin, as well as control how they work together, transfer conditions, and transfer methods. Therefore, by using such a programmable blockchain platform, not only secure user authentication but also the integrity of the authentication program can be ensured, thereby solving many security issues associated with user authentication.

KR 10-1590076 B.

The present invention is to provide a user authentication method and system that ensures the integrity of the user authentication program at the same time to perform the user authentication more securely by registering the user ID and user public key in the programmable blockchain and performing the user authentication program. The purpose.

In addition, by encrypting the user information verified through an accredited certification authority and storing it in the blockchain, there is no need to verify the user's identity every time the user is authenticated, and there is no risk of leakage of user information even if the service provider server is hacked. Another purpose.

In addition, by providing access to the blockchain through the authentication server (or management server), it is another object to allow the various service provider servers to check user information without directly incurring a separate blockchain transaction.

In addition, it is possible to log in to multiple institutional servers with one ID, so that user information is not distributed to multiple institutional servers, thus making it easy to manage user information, and to change user information and service subscriptions of service providers. Another purpose is to avoid the inconvenience of remembering the ID and password and re-entering user information.

According to an embodiment of the present invention for achieving the above technical problem, a programmable blockchain, a user registration step of registering a user ID and a user public key; Receiving a signature and a text; And a user authentication step of verifying the signature with the user public key and comparing the signature with the original text, wherein the signature is signed with a user private key, and the original is a text for authenticating the user. Programmable blockchain and integrated ID-based user authentication are provided.

The blockchain may be Ethereum.

The blockchain may be connected to a network with an authentication server, and the authentication server may be connected to a network with the service provider server and a user terminal to serve as a relay in the middle of the blockchain.

The original text may be a user authentication request text sent by a service provider server, and the signature text may be signed by the user terminal with the user private key.

The user registration step further includes the step of receiving the user's cipher text and mapping and storing the ID to the user's ID, wherein the cipher text is encrypted by the user terminal with the user's public key, the user information is It may include personal information or documents of the user.

The user registration step may be to register after the user terminal performs a self-authentication through an authorized certification authority.

The programmable blockchain and user ID-based user authentication method further includes a cryptographic text transmission step of transmitting the encrypted text stored mapped to the user's ID when the encrypted text of the user is requested. The user information may be obtained by receiving the cipher text and decrypting it with the user private key.

The encrypted text transmission step may be performed if authentication is successful as a result of performing the user authentication step.

When the service provider server receives the specific information of the user from the user terminal and requests authentication of the specific information, the original text is the original text including the specific information transmitted by the service provider server, and the signature text is the user. Only the information requested by the service provider server may be selected from the user information acquired by the terminal and signed with the user private key.

According to yet another embodiment of the present invention, an authentication server connected to a service provider server, a user terminal, and a blockchain via a network receives a user ID and a user public key from the user terminal. Registering a user with the blockchain; Receiving an original text from the service provider server; Receiving a signature from the user terminal; Transmitting the received signature text and original text to the blockchain; And receiving, by the blockchain, signature verification of the signature with the user's public key and receiving an authentication result comparing the original text with a programmable blockchain and an integrated ID-based user authentication method.

The blockchain may be Ethereum.

The original text is a user authentication request text sent by the service provider server, and the signature text transmits the received user authentication request text to the user terminal by the authentication server, and the user authentication request text received by the user terminal. May be signed with a user private key.

The user registration step may further include mapping and storing the cipher text of the user received from the user terminal to the ID of the user, wherein the cipher text is encrypted by the user terminal with the user public key. User information may include personal information or documents of the user.

The user registration step may be to register after the user terminal performs a self-authentication through an authorized certification authority.

The programmable blockchain and the integrated ID-based user authentication method, when the ciphertext is requested from the user terminal, receives the ciphertext mapped to the user's ID from the blockchain and transmits the ciphertext to the user terminal. The method may further include transmitting a cipher text, wherein the user terminal receives the cipher text and decrypts the cipher text with a user private key to obtain the user information.

The ciphertext transmission step may receive the ciphertext when the authentication result is successful.

When the service provider server receives the specific information of the user from the user terminal to request authentication of the specific information, the original text is the original text including the specific information transmitted by the service provider server, and the signature text is the user. Only the information requested by the service provider server may be selected from the user information acquired by the terminal and signed with the user private key.

In addition, according to another preferred embodiment, there is provided a computer program stored in a computer-readable recording medium for executing the method according to each of the above-described methods.

In addition, according to another preferred embodiment, there is provided a computer-readable recording medium having recorded thereon a program for executing each of the above-described methods.

According to another preferred embodiment of the present invention for achieving the above technical problem, a blockchain is provided, which is a programmable blockchain, characterized in that it is operated by a program for executing each of the above-described methods. .

According to another preferred embodiment of the present invention for achieving the above technical problem, as an authentication server connected to the service provider server, the user terminal and the blockchain network, operating by a program for executing each of the above-described methods Characterized in that, the authentication server is provided.

As described above, according to the present invention, there is an effect of providing a user authentication method and system for more securely performing user authentication by registering a user ID and a user public key in a programmable blockchain and performing a user authentication program.

In addition, by accessing the blockchain through the authentication server (or management server), there is an effect that multiple service provider servers can check the user information without having to individually create a transaction of the blockchain.

In addition, by encrypting user information (personal information and documents) whose identity has been verified through an accredited certification authority and storing them in the blockchain, there is no need to confirm the user's identity every time the user is authenticated, and even if the service provider server is hacked, There is no risk of spillage.

In addition, by using a programmable blockchain, for example, Ethereum, the integrity of the user authentication program as well as the user information can be guaranteed and even an authentication server can not operate the user authentication program of the blockchain without permission.

In addition, since a single ID can log in to multiple institution servers, provide user information, and authenticate user information, user information is not distributed to multiple institution servers, making it easy to manage user information. When changing personal information such as information, server information, and phone number, or whenever a service provider subscribes to a service, all IDs and passwords are remembered, and the inconvenience of having to re-enter user information is eliminated.

1 is a block diagram illustrating a configuration of a programmable blockchain and an integrated ID-based user authentication system according to an embodiment of the present invention.
2 is a block diagram illustrating a configuration of a programmable blockchain and an integrated ID-based user authentication system according to another embodiment of the present invention.
3 is a flowchart illustrating a specific example of a programmable blockchain and an integrated ID based user authentication method according to an embodiment of the present invention.
4 is a flowchart illustrating a specific example of a programmable blockchain and an integrated ID-based user authentication method according to another embodiment of the present invention.
5 is a flowchart illustrating a specific example of a programmable blockchain and an integrated ID based user authentication method according to another embodiment of the present invention.
6 is a flowchart illustrating a specific example of user registration of a programmable blockchain and an integrated ID based user authentication method according to another preferred embodiment of the present invention.
7 is a flowchart illustrating a specific example of a login of a programmable blockchain and an integrated ID-based user authentication method according to another preferred embodiment of the present invention.
8 is a flowchart illustrating a specific example of providing user information of a programmable blockchain and an integrated ID-based user authentication method according to another preferred embodiment of the present invention.
9 is a flowchart illustrating a specific example of providing personal information of a programmable blockchain and an integrated ID-based user authentication method according to another preferred embodiment of the present invention.
10 is a flowchart illustrating a specific example of personal information authentication of a programmable blockchain and an integrated ID based user authentication method according to another preferred embodiment of the present invention.
11 is a flowchart illustrating a specific example of user information authentication of a programmable blockchain and an integrated ID based user authentication method according to another preferred embodiment of the present invention.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. In the following description, only parts necessary for understanding the operation according to the embodiment of the present invention are shown and described, and illustrations and descriptions of other parts are omitted so as not to obscure the subject matter of the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention.

In addition, the terms or words used in the specification and claims described below are not to be construed as being limited to the ordinary or dictionary meaning, meaning that corresponds to the technical spirit of the present invention so as to best express the present invention To be interpreted as

Throughout the specification, when a part is "connected" to another part, it is not limited to "directly connected", but is "electrically connected" with another element in between. Or it includes a case of communicating via wired / wireless via a wired / wireless network. In addition, when a part is said to "include" a certain component, this means that it may further include other components, except to exclude other components unless otherwise stated.

For simplicity of explanation, although one or more methods are shown and described herein as a series of steps, for example in the form of a flowchart or flow chart, the present invention is not limited by the order of the steps, for the present invention. It will be appreciated that it may be done in a different order or simultaneously with other steps than shown and described herein. Moreover, not all illustrated steps may have to implement a methodology in accordance with the present invention.

Throughout the specification, the term 'user' may be an individual, an organization, an institution or an enterprise, and the user's ID and public key may be registered in the blockchain, the user information may be stored in the blockchain, and user authentication or service from a service provider. Information authentication may be requested.

In addition, the term 'user information' throughout the specification includes not only various personal information of the user but also various types of documents. The term 'personal information' refers to information such as a user's social security number, social security number, address, terminal information, server information, and telephone number.

In addition, the term 'service provider' in the entire specification may be an individual, an organization, an institution, or an enterprise, and an ID and a public key do not necessarily need to be registered in a blockchain, and authentication or user information of a user registered in a blockchain. You can request certification.

1 is a block diagram illustrating a configuration of a programmable blockchain and an integrated ID-based user authentication system according to an embodiment of the present invention.

Referring to FIG. 1, a programmable blockchain and an integrated ID-based user authentication system according to the present invention may include a user terminal 10, a service provider server 20, and a programmable blockchain 40. Can be.

The user terminal 10 may be various personal devices or devices such as a mobile phone, a smartphone, a computer, a tablet, a PC, and also various servers, computers, devices, or devices used in various organizations such as corporations, public institutions, and banks. Can be. In the figure, a smartphone, a notebook computer, and a server are illustrated, but the present invention is not limited thereto.

The user terminal 10 may be provided with a fast identity online (FIDO) authentication device. In this case, a key pair can be generated through a FIDO authentication device, a private key can be stored, and a private key can be obtained through biometric authentication.

The service provider server 20 may be various servers, computers, devices, or devices used by various organizations such as companies, public institutions, and banks that provide specific services, and also include mobile phones, smartphones, computers, tablets, PCs, and the like. May be various personal devices or devices. Although the notebook and the server are shown in this figure, the present invention is not limited thereto.

In the blockchain 40, user information and a user authentication program are stored and executed. Blockchain 40 is not only used as a simple storage medium, but various types of blockchains that can be programmed to upload various programs, and a representative example thereof is Ethereum. Programmable blockchain 40 is a single open platform that can view the blockchain as a database, all the assets can be raised and directly programmed to the way each asset is driven or traded. On Ethereum, you can design a variety of programs, carefully control the way they work together, conditions, etc., and also ensure integrity because you can't manipulate them.

Therefore, when the programmable blockchain 40 is used, not only secure user authentication but also integrity of user information and authentication program can be guaranteed, so that many security issues associated with user authentication can be solved.

The user terminal 10, the service provider server 20, and the blockchain 40 may communicate with each other through various wired or wireless networks, and may include various wired and wireless communication means for communication. The communication network may be a wired network such as Ethernet, or may be a wireless network such as Wi-Fi or a mobile communication network, but is not limited thereto.

2 is a block diagram showing the configuration of a programmable blockchain and an integrated ID based user authentication system according to another embodiment of the present invention.

Referring to FIG. 2, the programmable blockchain and the integrated ID-based user authentication system according to the present invention include a user terminal 10, a service provider server 20, an authentication server 30, and a programmable blockchain 40. It may be configured to include). Compared with the configuration of FIG. 1, the authentication server 30 is further included.

The authentication server (or management server) 30 may be a conventional server that can be operated by an institution, an enterprise, a service provider, an individual, or the like, or may be various devices or devices such as a computer, a tablet, and a PC.

The authentication server 30 may communicate with the user terminal 10 and the service provider server 20 through various wired or wireless networks, and may include various wired and wireless communication means for communication. In addition, the authentication server 30 may communicate with each other through the blockchain 40 and various wired or wireless networks. The communication network may be a wired network such as Ethernet, or may be a wireless network such as Wi-Fi or a mobile communication network, but is not limited thereto.

The authentication server 30 may act as a relay between the user terminal 10 and the service provider server 20 and the blockchain 40.

By allowing the user terminal 10 and the service provider server 20 to access the blockchain through the authentication server 30, various service provider servers can verify user information without directly incurring a transaction of the blockchain individually. . In other words, multiple service provider servers do not need to have the logic to access the blockchain directly.

The blockchain 40 is composed of large nodes and independent, open common ledgers distributed and stored in each node, and also more than 50% proof-of-work or proof of proof for authentication. -of-take is required. Therefore, compared to the advantages of high safety, P2P service has the disadvantage of relatively slow transaction speed, upgrade and slow control.

Therefore, access to the blockchain through the authentication server 30 can improve the slow transaction speed, and the service provider server 20 does not have to bear all the complicated control.

In addition, if a user authentication program is uploaded to the blockchain 40, even the authentication server 30 cannot operate the user authentication program loaded on the blockchain 40 without permission. Therefore, even if the authentication server 30 is hacked, the user information and the program stored in the blockchain 40 are safe.

In addition, by using the authentication server 30, it is possible to log in to a plurality of service provider servers with one ID, provide user information, or authenticate user information. Therefore, since user information is not distributed among various institution servers, it is easy to manage the history of providing user information, and remember all the ID and password every time the user information is changed or the service provider's service is subscribed. Discomfort is effective.

3 is a flowchart (S50) illustrating a specific example of a user-programmable method based on a programmable blockchain and an integrated ID according to an embodiment of the present invention.

Referring to FIG. 3, a blockchain 40 shows a flowchart of user registration and user authentication.

Referring to FIG. 1, various types of information transmitted and received by the blockchain 40 may be directly transmitted and received with the user terminal 10 and the service provider server 20. Also, referring to FIG. 2, an authentication server ( 30) may be transmitted and received.

In operation S52, the blockchain 40 may register a user ID and a user public key. This registration process can only be performed once the first time. This user ID can be used as the integration ID. All service provider servers 20 requesting user authentication can request user authentication with this integrated ID.

In step S54, the signature and the original can be received. At this time, the registered user ID can be received together. The received signature text is signed with the user's private key, and the received text may be original text for authenticating the user.

For example, the original text may be a user authentication request text sent by a service provider server, and the signature text may be signed by the user terminal 10 with the user private key. Therefore, when the original text sent by the service provider server 20 and the signature text provided by the user terminal 10 are signature-verified, the user terminal 10 transmits the original user authentication request text sent by the service provider server 20 to the user. Proof of signing with a key.

As another example, when the service provider server 20 receives the user's specific information (part of the personal information) from the user terminal 10, and requests authentication of whether the received specific information is the specific information of the actual user, The original text is specific information transmitted by the service provider server 20, and the signature text is obtained by the user terminal 10 after obtaining the user information stored in the blockchain 40, and from the obtained user information, the service provider server. Only information required by 20 may be selected and signed with the user private key. Therefore, if the specific information transmitted by the service provider server 20 and the information provided by the user terminal 10 are the same, the specific information is proved to be integrity of the actual user.

In operation S56, the original text may be extracted by verifying the received signature with a user public key. If the signature is verified, it is proved that the signature is sent by the user terminal 10.

In step S58, it is possible to compare whether the extracted original text and the received original text are the same. If the comparison is the same, integrity is proved. The original text extracted from the signature verification with the public key is hashed and compared with the received original hash text. If the original text is not hashed, it can be compared after hashing.

In the entire specification, when comparing the original text extracted with the received text during signature verification, if the original text received above is not hashed, the original text is hashed and then compared with the original text, which will be omitted below.

As an example of the program, the steps S56 and S58 can be implemented with the solidity code used by Ethereum as follows.

# Blockchain code to handle user authentication

# Verification of user signature on original text sent from service provider server 20

function Check (byte32 [] ID, byte32 [] Text, byte32 [] Signature) returns (bool)

{

if (RSA_Verify (User [ID] .pubkey, Signature, Text) == Success)

return true;

else

return false;

}

As described above, by registering the user in the blockchain 40 and uploading the user authentication procedure to the program, it is possible to ensure not only the safe storage and authentication of the user ID, but also the integrity of the authentication program.

4 is a flowchart (S60) illustrating a specific example of a user-programmable method based on a programmable blockchain and an integrated ID according to another embodiment of the present invention.

Referring to FIG. 4, a blockchain 40 registers and stores a ciphertext of a user and transmits a ciphertext when a ciphertext request is received.

Various types of information transmitted and received by the blockchain 40 may be directly transmitted and received with the user terminal 10 with reference to FIG. 1, and also with the authentication server 30 with reference to FIG. 2. have.

In operation S62, the blockchain 40 may receive a cipher text of the user. At this time, the user's ID may be received together.

The cipher text of the user is that the user terminal 10 encrypts the user information with the user public key.

It is desirable to store user information in the blockchain by encrypting user information whose identity has been verified through an accredited certification authority, because the user's identity need not be checked every time the user is authenticated.

In step S64, the blockchain 40 may store the received cipher text by mapping it to a user ID.

In step S66, the blockchain 40 may be requested to transmit the stored cipher text.

When the blockchain 40 receives the ciphertext, the blockchain 40 may transmit the ciphertext of the user mapped to the received user ID (S68).

The user terminal 10 receiving the cipher text stored in the blockchain 40 may obtain the user information by decrypting the cipher text with the user private key. The obtained user information may be transmitted to the service provider server 20 or the like.

If the user terminal 10 includes a FIDO authentication apparatus, the user private key may be obtained and used for decryption by FIDO authentication such as biometric authentication.

As described above, when providing user information to a new service provider, it is necessary to decrypt and use the user information that has been safely stored in the blockchain 40 only by user authentication such as fingerprint recognition, without having to re-enter user information. It can be.

5 is a flowchart (S70) illustrating a specific example of a programmable blockchain and an integrated ID based user authentication method according to another embodiment of the present invention.

Referring to FIG. 5, the blockchain 40 performs an user authentication according to S50 of FIG. 3 before executing an encryption text transmission according to S60 of FIG. 4 (S68). Since the ciphertext is encrypted with the user's public key and cannot be decrypted without the user's private key, it is difficult to decrypt even if leaked to a third party. However, in order to prevent the cipher text from being transmitted to a third party, the user terminal 10 having the user private key verifies whether the request is actually transmitted and then transmits the encrypted text.

In operation S72, the blockchain 40 may receive a request for a user cipher text. In this case, the original text, the signature text, and the user ID may be received together.

For example, the received text may be a user authentication request text sent by the service provider server 20, and the received signature text may be signed by the user terminal 10 with the user private key.

As another example, when the service provider server 20 receives the specific information of the user from the user terminal 10 and requests authentication of the received specific information is the specific information of the actual user, the original text is the service provider server. The signature is transmitted by the user 20, and the signature is obtained by the service provider server 20 from the user information after the user terminal 10 obtains the user information stored in the blockchain 40. Only information may be selected and signed with the user private key.

In operation S74, the original text may be extracted by verifying the received signature with a user public key. If the signature verification succeeds, it is proved that the signature is sent from the user terminal 10.

In step S76, it is possible to compare whether the extracted original text and the received original text are the same.

If the comparison result of step S76 is the same, user authentication is successful.

If the signature verification is successful, the cipher text of the user mapped and stored in the user ID may be transmitted (S78).

As described above, the ciphertext may be transmitted to the user terminal 10 instead of the third party by transmitting the ciphertext through the user authentication procedure in the blockchain 40.

6 is a flowchart (S100) illustrating a specific example of user registration of a programmable blockchain and an integrated ID-based user authentication method according to another preferred embodiment of the present invention.

Referring to FIG. 6, a specific embodiment of a user registration procedure implemented in the authentication system of FIGS. 1 and 2 is illustrated.

The user terminal 10 may generate a user key pair (private key and public key) (S102).

Among the generated key pairs, the user private key may be stored in a secure zone (trust zone, etc.) (S104). If the user terminal 10 includes a FIDO authentication apparatus, key pair generation and private key storage may be performed through authentication such as biometric authentication.

The user terminal 10 may receive identity verification or identity verification through the user's personal information (S106).

The user terminal 10 may generate a user cipher text by encrypting the original text including the user information with the user public key (S108).

The user cipher text may not be registered at the time of user registration, but may be separately performed after user registration. In the present embodiment, it is described as performing simultaneously, but is not necessarily limited thereto.

The user terminal 10 may make a user registration request to the authentication server 30 (S110). In this case, the user ID, the user public key, and the user cipher text may be transmitted together.

In the present embodiment, although the user registration is shown to be performed through the authentication server 30, the user registration request may be directly made to the blockchain 40 without passing through the authentication server 30.

Upon receiving the user registration request, the authentication server 30 may generate the authentication server signature by signing the user cipher text with the authentication server private key (S112).

The authentication server 30 generating the authentication server signature may make a user registration request to the blockchain 40 (S114). At this time, the user ID, user public key, user passphrase, and authentication server signature may be transmitted together.

Upon receiving the user registration request, the blockchain 40 may verify the signature with the authentication server public key previously stored in the authentication server signature (S116). If the signature verification succeeds, it is proved that the user registration request has been received from the authentication server 30.

If the signature verification is successful, the blockchain 40 may map and store the received user ID, the user public key, and the user cipher text (S118).

In operation S120, the blockchain 40 may transmit a result of successfully registering the user to the authentication server 30.

Upon receiving the user registration result, the authentication server 30 may transmit the result to the user terminal 10 (S122).

As described above, user information encrypted with a user ID, a user public key, and a user public key may be securely stored in the blockchain 40.

According to the above embodiments, the blockchain 40 may register a plurality of users through the authentication server 30.

7 is a flowchart illustrating a specific example of a login of a programmable blockchain and an integrated ID-based user authentication method according to another preferred embodiment of the present invention.

Referring to FIG. 7, an embodiment of a method in which the user terminal 10 logs in to a plurality of various service provider servers 20 using one integrated ID is described. In addition, since the embodiment using the authentication server 30 described in Figure 2, all the service provider server 20 requesting user authentication does not need to register the user in the blockchain 40, transactions in the blockchain 40 You do not need to generate it yourself.

The user terminal 10 may make a login request to the service provider server 20 (S202). At this time, the user ID can be transmitted together.

The service provider server 20 receiving the login request may generate a user authentication request text (or login text) for user authentication (S204).

The service provider server 20 may transmit the generated user authentication request text together with the user ID to the authentication server 30 (S206).

The authentication server 30 may transmit the received user authentication request text to the user terminal 10 (S208).

The user terminal 10 may generate a signature by signing the original user authentication request text with a user private key (S210). In this case, if the user terminal 10 includes the FIDO authentication apparatus, the user private key may be obtained and used by biometric authentication.

The user terminal 10 may transmit the generated signature text to the authentication server (S30) (S212).

The authentication server 30 may make a user authentication request while transmitting the received signature to the blockchain 40 together with the original user authentication request received in step S206 (S214). At this time, the user ID can also be transmitted.

The blockchain 40 receiving the user authentication request may extract the original text by verifying the signature with the registered user public key (S216). At this time, if the signature verification is successful, it is proved that the received signature is actually signed by the user.

The blockchain 40 may compare and verify whether the extracted original text is the same as the received original text (S218). At this time, if the verification result is the same, the user authentication request requested by the service provider server 20 is successful.

The blockchain 40 transmits the user authentication result to the authentication server 30 (S220), and the authentication server 30 transmits the result to the service provider server 20 (S222) and the service provider server 20. By transmitting to the user terminal 10 that the login was successful (S224), the secure integrated ID login is completed.

When the user terminal 10 logs in to another service provider server, the user terminal 10 may go through the procedure of S200. In this case, the user terminal 10 only needs to perform an authentication procedure such as biometric authentication once.

As described above, since it is possible to log in to a plurality of institution servers with one integrated ID, the inconvenience of having to remember both the ID and the password every time the service provider joins the service is eliminated.

8 is a flowchart illustrating a specific example of providing personal information of a programmable blockchain and an integrated ID-based user authentication method according to another preferred embodiment of the present invention.

Referring to FIG. 8, a method of providing personal information by the authentication system shown in FIG. 2 according to the present invention is illustrated.

When the user terminal 10 receives a request for personal information from the service provider server 20 (S302), the user terminal 10 may request the personal information stored in the blockchain 40 to the authentication server 30 (S304). At this time, the user ID can be transmitted together.

The authentication server 30 receiving the personal information request may request a user cipher text stored in the blockchain 40 (S306). At this time, the user ID can be transmitted together.

The blockchain 40 which has received the ciphertext request may transmit the user ciphertext mapped to the received user ID to the authentication server 30 (S308).

The authentication server 30 may transmit the received user cipher text to the user terminal 10 (S310).

The user terminal 10 may obtain the user information by decrypting the received cipher text with the user private key (S312). If the user terminal 10 includes the FIDO authentication apparatus, the user private key can be obtained and used through FIDO authentication.

The user terminal 10 may transmit the obtained user information to the service provider server 20 (S314). If the personal information requested by the service provider server 20 is some information included in the user information, only the information requested by the service provider server 20 is selected from the obtained user information and transmitted to the service provider server 20. You may.

As described above, user information can be provided to a plurality of institution servers with a single ID, and user information is not distributed to various institution servers, thereby making it easy to manage user information, and to change user information or service providers. Every time you subscribe to the service remembers both the ID and password, there is an effect that eliminates the inconvenience of having to re-enter the user information.

9 is a flowchart (S400) illustrating a specific example of providing personal information of a programmable blockchain and an integrated ID-based user authentication method according to another exemplary embodiment of the present invention.

Referring to FIG. 9, in comparison with FIG. 8, when receiving user information stored in the blockchain 40 to provide personal information, a user authentication procedure for verifying whether the user actually requested is added. . That is, the embodiment further strengthens security than the user information providing method S300 of FIG. 8.

When the user terminal 10 receives a request for personal information from the service provider server 20 (S402), the user terminal 10 may request the personal information stored in the blockchain 40 to the authentication server 30 (S408). At this time, the user ID can be transmitted together.

In addition, the service provider server 20 may generate a user authentication request text (or login text) (S404), and request a user authentication to the authentication server 30 (S406). At this time, the original user authentication request text and the user ID may be transmitted together.

The authentication server 30 receiving the user authentication request and the user information request may transmit the received user authentication request text to the user terminal 10 (S410).

The user terminal 10 may generate a signature by signing the original user authentication request text with a user private key (S412). In this case, if the user terminal 10 includes the FIDO authentication apparatus, the user private key may be obtained and used by biometric authentication.

The user terminal 10 may transmit the generated signature text to the authentication server (S30) (S414).

The authentication server 30 receiving the signature text may simultaneously transmit the user authentication request and the user ciphertext request while simultaneously transmitting the original user authentication request text received in step S406 to the blockchain 40 (S416). At this time, the user ID can also be transmitted.

The blockchain 40 receiving the user authentication request and the user cipher text request may extract the original text by signature verification of the received signature text with the registered user public key (S418).

At this time, if the signature verification succeeds, it is proved that the received signature is actually signed by the user.

The blockchain 40 may compare and verify whether the extracted original text is the same as the received original text (S420).

At this time, if the verification result is the same, the user authentication request requested by the service provider server 20 is successful.

Since the user authentication is successful, the blockchain 40 may transmit the user cipher text, which is mapped and stored in the user ID, to the authentication server 30 (S422).

The authentication server 30 may transmit the received user cipher text to the user terminal 10 (S424).

The user terminal 10 may obtain the user information by decrypting the received cipher text with the user private key (S426). If the user terminal 10 includes the FIDO authentication apparatus, the user private key can be obtained and used through FIDO authentication.

The user terminal 10 may transmit the obtained user information to the service provider server 20 (S428). If the personal information requested by the service provider server 20 is some information included in the user information, only the information requested by the service provider server 20 is selected from the obtained user information and transmitted to the service provider server 20. You may.

As described above, by transmitting and receiving the user cipher text through the user authentication process it is possible to perform a more secure user information management.

10 is a flowchart (S500) illustrating a specific example of user information authentication of a programmable blockchain and an integrated ID-based user authentication method according to another preferred embodiment of the present invention.

Referring to FIG. 10, it is necessary for the service provider server 20 to receive a user authentication request from the user terminal 10 and to verify whether the user's specific information (part of personal information) is correct. Example when there is.

When the user terminal 10 is requested to input the user's specific information by the request of the service provider server 20, the user terminal 10 receives the user's specific information from the user (S502). In this case, the specific information of the user may be information included in user information stored in the blockchain 40 by the user.

When the user terminal 10 transmits specific information to the service provider server 20 (S504), the service provider server 20 may request authentication or confirmation of the specific information from the authentication server 30 (S506). In this case, the received specific information and the user ID may be transmitted together.

In operation S508, the authentication server 30 may request a user cipher text stored in the blockchain 40 (S508). At this time, the user ID can be transmitted together.

The blockchain 40 which has received the ciphertext request may transmit the user ciphertext, which is mapped and stored to the received user ID, to the authentication server 30 (S510).

The authentication server 30 may transmit the received user cipher text to the user terminal 10 (S512).

The user terminal 10 may decrypt the received cipher text with a user private key to obtain user information (S514). If the user terminal 10 includes the FIDO authentication apparatus, the user private key can be obtained and used through FIDO authentication.

The user terminal 10 may select only the information requested by the service provider server 20 from the obtained user information, that is, specific information, and generate a signature by signing with a user private key (S516).

The user terminal 10 may transmit the generated signature text to the authentication server (S30) (S518).

The authentication server 30 receiving the signature text may request the authentication of the specific information while hashing the specific information received in step S506 and transmitting the signature information to the blockchain 40 together with the signature text (S520). At this time, the user ID can also be transmitted.

That is, the information requested by the service provider server 20 from the specific information received from the service provider server 20 and the user information obtained by decrypting the user cipher text registered and stored in the blockchain 40 by the user terminal 10. It selects only and requests the blockchain 40 to verify whether the signature with the user's private key is the same.

The blockchain 40 receiving the authentication request for the specific information may extract the original text by verifying the received signature with the registered user public key (S522).

At this time, if the signature verification is successful, it is proved that the received signature is actually signed by the user.

The blockchain 40 may compare and verify whether the extracted original text is the same as the received original text (hashed specific information) (S524).

In this case, if the verification result is the same, it is proved that the specific information requested by the service provider server 20 is actually information of the user.

The blockchain 40 transmits the user authentication result to the authentication server 30 (S526), the authentication server 30 transmits the result to the service provider server 20 (S528), the service provider server 20 The secure user authentication and confirmation of specific information is completed by transmitting to the user terminal 10 that the user authentication is successful (S530).

FIG. 11 is a flowchart illustrating a specific example of user information authentication of a programmable blockchain and an integrated ID based user authentication method according to another preferred embodiment of the present invention.

Referring to FIG. 11, in comparison with S500 of FIG. 10, when transmitting and receiving user information stored in the blockchain 40, a procedure of verifying whether the user actually requested the service is further added. That is, this embodiment is more secure than the user information authentication method S500 of FIG. 10.

When the user terminal 10 is requested to input the user's specific information (part of the personal information) by the request of the service provider server 20, the user terminal 10 receives the user's specific information (S602). In this case, the specific information of the user may be information included in user information stored in the blockchain 40 by the user.

The user terminal 10 which has received the specific information from the user may transmit the specific information to the service provider server 20 (S604).

The service provider server 20 may generate a user authentication request text (S606) and simultaneously request the user authentication request and authentication of specific information to the authentication server 30 (S608). At this time, the original user authentication request text, specific information, and user ID may be transmitted together.

The authentication server 30 receiving the user authentication request and the user information request may transmit the received user authentication request text to the user terminal 10 (S610).

The user terminal 10 may generate a signature by signing the received user authentication request text with a user private key (S612). In this case, if the user terminal 10 includes the FIDO authentication apparatus, the user private key may be obtained and used by biometric authentication.

The user terminal 10 may transmit the generated signature text to the authentication server (S30) (S614).

The authentication server 30 receiving the signature text may simultaneously transmit the user authentication request and the user ciphertext request while simultaneously transmitting the original user authentication request text received in step S608 to the blockchain 40 (S616). At this time, the user ID can also be transmitted.

The blockchain 40 receiving the user authentication request and the user ciphertext request at the same time may extract the original text by verifying the signature with the registered user public key (S618).

At this time, if the signature verification succeeds, it is proved that the received signature is actually signed by the user.

The blockchain 40 may compare and verify whether the extracted original text is the same as the received original text (S620).

At this time, if the verification result is the same, the user authentication request requested by the service provider server 20 is successful.

Since the user authentication is successful, the blockchain 40 may transmit the user cipher text, which is mapped and stored to the user ID, to the authentication server 30 (S622).

The authentication server 30 may transmit the received user cipher text to the user terminal 10 (S624).

The user terminal 10 may obtain user information by decrypting the received cipher text with a user private key (S626). If the user terminal 10 includes the FIDO authentication apparatus, the user private key can be obtained and used through FIDO authentication.

The user terminal 10 may generate the signature by selecting only the information requested by the service provider server 20, that is, the specific information, from the obtained user information and signing with the user private key (S628).

The user terminal 10 may transmit the generated signature text to the authentication server (S30) (S630).

The authentication server 30 receiving the signature text may request the authentication of the specific information while hashing the specific information received in step S608 and transmitting the signature information to the blockchain 40 together with the signature text (S632). At this time, the user ID can also be transmitted.

That is, only the information requested by the service provider server 20 is selected from the specific information received from the service provider server 20 in step S608 and the user information obtained by decoding the user cipher text previously stored in the user terminal 10. Requesting the blockchain 40 to verify whether the signature with the user's private key is the same.

The blockchain 40 receiving the specific information authentication request may extract the original text by verifying the received signature with a registered user public key (S634).

At this time, if the signature verification succeeds, it is proved that the received signature is actually signed by the user.

The blockchain 40 may compare and verify whether the extracted original text is the same as the received original text (hashed specific information) (S636).

In this case, if the verification result is the same, it is proved that the specific information requested by the service provider server 20 is actually information of the user.

The blockchain 40 transmits the user authentication result to the authentication server 30 (S638), the authentication server 30 transmits the result to the service provider server 20 (S640), the service provider server 20 By transmitting to the user terminal 10 that the user authentication was successful (S642) secure user authentication and confirmation of specific information is completed.

As described above, according to the present embodiments, it is possible to provide a user authentication method and system for more securely performing user authentication by registering a user ID and a user public key in a programmable blockchain and performing a user authentication program. . In addition, by encrypting user information verified through an accredited certification authority and storing it in the blockchain, there is no need to verify the user's identity every time a user authenticates, and there is no risk of leaking user information even if the service provider server is hacked. have.

In addition, by accessing the blockchain through the authentication server (or management server), there is an effect that multiple service provider servers can check the user information without having to individually create a transaction of the blockchain. In addition, by using a programmable blockchain, for example, Ethereum, the integrity of the user authentication program as well as the user information can be guaranteed, and even an authentication server can not operate the user authentication program of the blockchain without permission.

In addition, since a single ID can log in to multiple institution servers, provide user information, and authenticate user information, user information is not distributed to multiple institution servers, making it easy to manage user information. When changing user information such as information, server information, phone number or personal documents, or whenever a service provider subscribes to a service, both ID and password are remembered, and there is no inconvenience of having to re-enter user information.

In addition, the embodiments of the programmable blockchain and the integrated ID-based user authentication method described above may be implemented in the form of computer program instructions that may be executed through various computer components. In addition, the implemented computer program may be recorded in a computer readable recording medium. The mentioned recording medium may be a ROM, a magnetic disk or a compact disk, an optical disk, or the like, but is not necessarily limited thereto.

As described above, the present invention has been described with reference to the embodiments shown in the drawings, but this is merely exemplary, and those skilled in the art may various modifications and equivalent other embodiments from this. Will understand. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

10: user terminal
20: service provider server
30: Certificate Server
40: programmable blockchain

Claims (21)

Programmable blockchain,
A user registration step of registering a user ID and a user public key;
Receiving a signature and a text; And
A user authentication step of verifying the signature with the user public key and comparing the signature with the original text;
Including,
The blockchain is connected to the authentication server and the network,
The authentication server is connected to the service provider server and the user terminal network to act as a relay in the middle of the blockchain,
The signature is signed with a user private key,
The original text is an original text for authenticating the user,
The user registration step further includes the step of receiving the user's cipher text and mapping and storing the user's ID, wherein the cipher text is encrypted by the user terminal with the user's public key, the user information is the user's personal information or Contains documents,
When receiving the user's cipher text request, further comprising a cipher text transmission step of transmitting the cipher text that is stored mapped to the user's ID, the user terminal receives the cipher text to decrypt the user private key to obtain the user information,
When the service provider server receives the specific information of the user from the user terminal to request the authentication of the specific information, the original text is the original text including the specific information transmitted by the service provider server, and the signature text is determined by the user terminal. Programmable blockchain and integrated ID-based user authentication method, characterized in that only the information requested by the service provider server from the obtained user information and signed with the user private key.
The method of claim 1,
The blockchain is Ethereum (Ethereum), Programmable blockchain and user ID based integrated authentication method.
delete The method of claim 1,
The original text is a user authentication request text sent by a service provider server.
The signature text is characterized in that the user terminal signed the user authentication request text with the user private key, programmable block chain and integrated ID based user authentication method.
delete The method of claim 1,
The user registration step is characterized in that the user terminal is registered after performing the authentication through an authorized certification authority, programmable block chain and integrated ID based user authentication method.
delete The method of claim 1,
The encryption text transmission step, characterized in that performed if the authentication is successful as a result of performing the user authentication step, programmable block chain and integrated ID based user authentication method.
delete The authentication server connected to the service provider server, the user terminal and the blockchain network,
A user registration step of receiving a user ID and a user public key from the user terminal and registering the same in the blockchain;
Receiving an original text for authenticating a user from the service provider server;
Receiving a signature signed with a user private key from the user terminal;
Transmitting the received signature text and original text to the blockchain; And
Receiving, by the blockchain, a signature verification of the signature text with the user public key and then comparing the original text with an authentication result;
Including,
The user registration step further includes the step of mapping and storing the cipher text of the user received from the user terminal to the user ID, wherein the cipher text is encrypted by the user terminal with the user public key, the user information of the user Include personal information or documents,
When the cipher text is requested from the user terminal, the method further includes a cipher text transmission step of receiving the cipher text mapped to the ID of the user from the blockchain and transmitting the cipher text to the user terminal, wherein the user terminal receives the cipher text with the user private key. Obtain the user information by decrypting,
When the service provider server receives the specific information of the user from the user terminal and requests the authentication of the specific information, the original text is the original text including the specific information transmitted by the service provider server, and the signature is obtained by the user terminal. Programmable blockchain and integrated ID-based user authentication method, characterized in that only the information requested by the service provider server from among the user information and signed with the user private key.
The method of claim 10,
The blockchain is characterized in that the Ethereum, programmable blockchain and integrated ID-based user authentication method.
The method of claim 10,
The original text is a user authentication request text sent by the service provider server.
The signature text is characterized in that the authentication server transmits the received user authentication request text to the user terminal, the user terminal signed the received user authentication request text with a user private key, programmable User authentication based on blockchain and integrated ID.
delete The method of claim 10,
The user registration step is characterized in that the user terminal is registered after performing the authentication through an authorized certification authority, programmable block chain and integrated ID based user authentication method.
delete The method of claim 10,
The encrypted text transmission step, if the authentication result is successful, characterized in that for receiving the encrypted text, programmable block chain and integrated ID based user authentication method.
delete Computer-readable for executing the method according to any one of claims 1, 2, 4, 6, 8, 10-12, 14, 16. A computer program stored on a record carrier.
delete delete An authentication server connected to a service provider server, a user terminal, and a blockchain by a network.
An authentication server, characterized in that it is operated by a program for executing the method according to any one of claims 10 to 12, 14 and 16.

Images