System and method for mapping decentralized identifiers to real-world entities

• US 10,685,099 B2
• Filed: 01/06/2020
• Issued: 06/16/2020
• Est. Priority Date: 07/02/2019
• Status: Active Grant

• Current Assignee: Advanced New Technologies Company Limited (Ant Group Co., Ltd.)
• Original Assignee: Alibaba Group Holding Ltd.
• Inventors: Chen, Yuan, Yang, Renhui, Lin, Yuqi, Liu, Jiawei
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US16/735,538
• Publication Number:
  US 20200143019A1
• Time in Patent Office: 162 Days
• CPC Class Codes: G06F 16/2379 Updates performed during online database operations; commit processing
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3073 involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing
• CPC Class Codes: H04L 9/3239 involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04L 9/50 : using hash chains, e.g. blockchains or hash trees

Abstract

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for mapping decentralized identifiers (DIDs) to real-world entities. One of the methods includes: receiving a request for creating a DID; obtaining a proof of identity authentication based on the received request; obtaining the DID based on the proof of identity authentication; and storing a mapping relationship between the proof of identity authentication and the DID.

Claims

1. A computer-implemented method for mapping decentralized identifiers (DIDs) to real-world entities, comprising:

receiving, by a server system, a request for obtaining a DID, the request comprising an identifier of a subject corresponding to the DID;

obtaining, by the server system, a proof of identity authentication based on the request for obtaining the DID, wherein the obtaining the proof of identity authentication comprises;

sending, to a client-side application associated with the subject, instructions to obtain data associated with one or more features of the subject,

obtaining data associated with the identifier of the subject from a blockchain, and

comparing the data associated with the one or more features of the subject with the data associated with the identifier of the subject;

obtaining, by the server system, the DID based on the proof of identity authentication by sending a blockchain transaction for creating the DID to one or more blockchain nodes associated with the blockchain; and

storing, by the server system, a mapping relationship between the proof of identity authentication and the DID, wherein the storing comprises;

determining a hash value for a combination of the proof of identity authentication and the DID, and

storing the hash value on the blockchain.

2. The method of claim 1, wherein the proof of identity authentication comprises:

a proof of real-person authentication;

or

a proof of real-name authentication.

3. The method of claim 1, wherein the sending instructions to obtain data associated with one or more features of the subject comprises:

sending, to the client-side application, instructions to capture one or more images of the subject.

4. The method of claim 1, wherein the comparing the data associated with the one or more features of the subject with the data associated with the identifier of the subject comprises:

sending, to the client-side application, instructions to compare the data associated with the one or more features of the subject with the data associated with the identifier of the subject.

5. The method of claim 1, wherein the obtaining the DID comprises:

generating a key alias;

obtaining a public key of a cryptographic key pair; and

storing a mapping relationship between the proof of identity authentication, the public key, and the key alias.

6. The method of claim 5, wherein the obtaining the DID further comprises:

generating, based on the public key, one or more blockchain transactions for adding a DID document associated with the DID to the blockchain.

7. The method of claim 1, further comprising:

generating a verifiable claim (VC) based on the proof of identity authentication; and

uploading the VC to a service endpoint associated with the obtained DID.

8. A non-transitory computer-readable storage medium for mapping decentralized identifiers (DIDs) to real-world entities, configured with instructions executable by one or more processors to cause the one or more processors to perform operations comprising:

receiving a request for obtaining a DID, the request comprising an identifier of a subject corresponding to the DID;

obtaining a proof of identity authentication based on the request for obtaining the DID, wherein the obtaining the proof of identity authentication comprises;

sending, to a client-side application associated with the subject, instructions to obtain data associated with one or more features of the subject,

obtaining data associated with the identifier of the subject from a blockchain, and

comparing the data associated with the one or more features of the subject with the data associated with the identifier of the subject;

obtaining the DID based on the proof of identity authentication by sending a blockchain transaction for creating the DID to one or more blockchain nodes associated with the blockchain; and

storing a mapping relationship between the proof of identity authentication and the DID, wherein the storing comprises;

determining a hash value for a combination of the proof of identity authentication and the DID, and

storing the hash value on the blockchain.

9. The non-transitory computer-readable storage medium of claim 8, wherein the proof of identity authentication comprises:

a proof of real-person authentication;

or

a proof of real-name authentication.

10. The non-transitory computer-readable storage medium of claim 8, wherein the sending instructions to obtain data associated with one or more features of the subject comprises:

sending, to the client-side application, instructions to capture one or more images of the subject.

11. The non-transitory computer-readable storage medium of claim 8, wherein the comparing the data associated with the one or more features of the subject with the data associated with the identifier of the subject comprises:

sending, to the client-side application, instructions to compare the data associated with the one or more features of the subject with the data associated with the identifier of the subject.

12. The non-transitory computer-readable storage medium of claim 8, wherein the obtaining the DID comprises:

generating a key alias;

obtaining a public key of a cryptographic key pair; and

storing a mapping relationship between the proof of identity authentication, the public key, and the key alias.

13. The non-transitory computer-readable storage medium of claim 12, wherein the obtaining the DID further comprises:

generating, based on the public key, one or more blockchain transactions for adding a DID document associated with the DID to the blockchain.

14. The non-transitory computer-readable storage medium of claim 8, wherein the operations further comprise:

generating a verifiable claim (VC) based on the proof of identity authentication; and

uploading the VC to a service endpoint associated with the obtained DID.

15. A system for mapping decentralized identifiers (DIDs) to real-world entities, comprising a processor and a non-transitory computer-readable storage medium storing instructions executable by the processor to cause the system to perform operations comprising:

receiving a request for obtaining a DID, the request comprising an identifier of a subject corresponding to the DID;

obtaining a proof of identity authentication based on the request for obtaining the DID, wherein the obtaining the proof of identity authentication comprises;

sending, to a client-side application associated with the subject, instructions to obtain data associated with one or more features of the subject,

obtaining data associated with the identifier of the subject from a blockchain, and

comparing the data associated with the one or more features of the subject with the data associated with the identifier of the subject;

obtaining the DID based on the proof of identity authentication by sending a blockchain transaction for creating the DID to one or more blockchain nodes associated with the blockchain; and

storing a mapping relationship between the proof of identity authentication and the DID, wherein the storing comprises;

determining a hash value for a combination of the proof of identity authentication and the DID, and

storing the hash value on the blockchain.

16. The system of claim 15, wherein the sending instructions to obtain data associated with one or more features of the subject comprises:

sending, to the client-side application, instructions to capture one or more images of the subject.

17. The system of claim 15, wherein the comparing the data associated with the one or more features of the subject with the data associated with the identifier of the subject comprises:

sending, to the client-side application, instructions to compare the data associated with the one or more features of the subject with the data associated with the identifier of the subject.

18. The system of claim 15, wherein the obtaining the DID comprises:

generating a key alias;

obtaining a public key of a cryptographic key pair; and

storing a mapping relationship between the proof of identity authentication, the public key, and the key alias.

19. The system of claim 18, wherein the obtaining the DID further comprises:

generating, based on the public key, one or more blockchain transactions for adding a DID document associated with the DID to the blockchain.

20. The system of claim 15, wherein the operations further comprise:

generating a verifiable claim (VC) based on the proof of identity authentication; and

uploading the VC to a service endpoint associated with the obtained DID.