# US 10,454,918 B1 · Method for SSO service using PKI based on blockchain networks, and device and server using the same > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,454,918 B1 - Document ID: US10454918B1 - Status: Granted - Kind: B1 - Application number: 16/368,582 - Filed: 2019-03-28 - Published: 2019-10-03 - Granted: 2019-10-22 - Earliest claimed: 2018-03-30 - Assignees: Coinplug, Inc. - Applicants: Coinplug, Inc. - Inventors: Joon Sun Uhr; Jay Wu Hong; Moon Gju Suh - Web page: https://patentgrep.com/patent/US10454918B1 ## CPC - H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD} - H04L 63/0815: {providing single-sign-on or federations} - G06F 16/1824: {implemented using Network-attached Storage [NAS] architecture (distributed or networked storage systems G06F3/067; protocols for distributed storage of data in a network H04L67/1097)} - H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC} - H04L 9/3247: {involving digital signatures} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/126: {the source of the received data} - H04L 9/50: {using hash chains, e.g. blockchains or hash trees} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method for a Single Sign On (SSO) service using a Public Key Infrastructure (PKI) based on blockchain networks, and device and server using the same are provided. The method has objects and effects of providing (a) the SSO based on blockchain network technology to efficiently protect authentication information on users from external attacks, (b) the SSO assuring information security and preventing forgery by applying a hash function and encryption to user certificates, and (c) the SSO preventing problems incurred by information theft beforehand through a user-authentication using disposable verification values. ## Claims ### Claim 1 A method for a Single Sign On (SSO) service using a Public Key Infrastructure (PKI) based on blockchain networks, comprising steps of: (a) a first authentication-supporting server performing (i) if information on requesting a registration of a first user certificate using a first PKI certificate generated through a first app of a user device is acquired from the user device or from another device connected with the user device, a process of transmitting a request for a first signature value to the first app of the user device, wherein the first app has been installed in the user device and allows use of a first service provided by a first service server, and wherein the first signature value is obtained by signing a first verification value for reference with a first private key of the first PKI certificate, (ii) if the first signature value is acquired from the user device or from another device connected with the user device, a process of verifying or supporting another device connected with the first authentication-supporting server to verify the first signature value, and (iii) if the first signature value is determined as valid, a process of registering or supporting another device connected with the first authentication-supporting server to register the first user certificate in the first blockchain network, wherein the first user certificate includes a first public key of the first PKI certificate and first registration information thereon; (b) the first authentication-supporting server performing (i) if it is confirmed that a second user certificate is not registered in a second blockchain network in response to a request for confirming the second user certificate by using a second app of the user device, and if information on requesting a verification of the first user certificate is acquired from a second authentication-supporting server connected with a second service server, a process of confirming or supporting another device connected with the first authentication-supporting server to confirm the first user certificate registered in the first blockchain network, wherein the second app has been installed in the user device and allows use of a second service provided by the second service server, and wherein the second user certificate is registered in the second blockchain network as corresponding to the second app, and (ii) a process of allowing the second app to transmit a request for a second signature value to the first app, by transmitting or supporting another device connected with the first authentication-supporting server to transmit a result on verifying the first user certificate including a second verification value for reference to the second app of the user device through the second authentication-supporting server connected with the second service server, wherein the second signature value is obtained by signing the second verification value for reference with the first private key of the first PKI certificate; and (c) the first authentication-supporting server performing (i) if the second signature value is obtained from the first app of the user device or from another device connected with the user device, a process of verifying or supporting the first blockchain network or another device connected with the first authentication-supporting server to verify the second signature value, (ii) if the second signature value is determined as valid, by transmitting or allowing another device connected with the first authentication-supporting server to transmit a result on verifying the second signature value to the first app of the user device, (ii-1) a process of supporting the first app of the user device to transmit the result on verifying the second signature value to the second app of the user device, so as to allow the second app to generate a second PKI certificate and transmit information on requesting a registration of the second user certificate using the second PKI certificate to the second authentication-supporting server, (ii-2) a process of supporting the second authentication-supporting server to transmit a request for a third signature value to the second app in response to the information on requesting the registration of the second user certificate, wherein the third signature value is obtained by signing a third verification value with a second private key of the second PKI certificate, (ii-3) if the third signature value is acquired from the user device or from another device connected with the user device, a process of supporting the second authentication-supporting server to verify or to allow the second blockchain network or another device connected with the second authentication-supporting server to verify the third signature value, and (ii-4) if the third signature value is determined as valid, a process of supporting the second authentication-supporting server to register the second user certificate in the second blockchain network, wherein the second user certificate includes a second public key of the second PKI certificate and second registration information thereon. ### Claim 2 (depends on 1) The method of claim 1, wherein, when either the first app of the user device or the second app of the user device generates its corresponding first PKI certificate or its corresponding second PKI certificate, a user of the user device sets path information for accessing either the first private key of the first PKI certificate or the second private key of the second PKI certificate. ### Claim 3 (depends on 1) The method of claim 1, wherein the first authentication-supporting server confirms either a first verification value for comparison extracted by applying the first public key of the first PKI certificate to the first signature value or a second verification value for comparison extracted by applying the first public key of the first PKI certificate to the second signature value, and verifies or supports the first blockchain network to verify either the first signature value or the second signature value by comparing the first verification value for comparison with the first verification value for reference or the second verification value for comparison with the second verification value for reference. ### Claim 4 (depends on 1) The method of claim 1, wherein the first user certificate registered in the first blockchain network or the second user certificate registered in the second blockchain network includes at least one of (i) the first public key or the second public key, (ii) user-identifying information, (iii) user device-identifying information, (iv) first app-identifying information or second app-identifying information, (v) a push token ID corresponding to either the first app or the second app, and (vi) personal information on the user. ### Claim 5 (depends on 1) The method of claim 1, wherein, at the step of (b), the first authentication-supporting server further adds (i) a first app ID corresponding to the first user certificate confirmed from the first blockchain network and (ii) a URL scheme to be used for transmitting the second verification value for reference to the first app and for requesting a signature on the second verification value for reference into the result on confirming the first user certificate, to thereby transmit or support another device connected with the first authentication-supporting server to transmit the result on confirming the first user certificate to the second app. ### Claim 6 A method for a Single Sign On (SSO) service using a Public Key Infrastructure (PKI) based on blockchain networks, comprising steps of: (a) a first authentication-supporting server performing, on condition that respective user certificates using respective PKI certificates generated by multiple apps of a user device have been registered in respective blockchain networks corresponding to respective service servers, if information on requesting an SSO using login information on a specific app of the user device is acquired from the user device or a specific service server, a process of confirming or supporting another device connected with the first authentication-supporting server to confirm whether a specific user certificate corresponding to the login information on the specific app of the user device is registered in a specific blockchain network corresponding to the specific service server, wherein the multiple apps of the user device have been installed in the user device and allow uses of respective services provided by the respective service servers; and (b) the first authentication-supporting server performing, if it is confirmed that the specific user certificate is not registered in the specific blockchain network, (i) a process of supporting at least one second authentication-supporting server, among respective second authentication-supporting servers corresponding to the respective service servers, to check or to allow another device connected with the second authentication-supporting server to check an SSO session from at least one certain blockchain network connected with the second authentication-supporting server, by transmitting a request for confirming whether there is the SSO session to the second authentication-supporting server, and (ii) if information on checking the SSO session is acquired from the second authentication-supporting server, a process of allowing use of a specific service provided by the specific service server through the specific app of the user device by supporting the specific service server or the specific app of the user device to associate with the SSO session. ### Claim 7 (depends on 6) The method of claim 6, further comprising a step of: (c) the first authentication-supporting server performing, if it is confirmed that the specific user certificate is registered in the specific blockchain network, (i) processes of transmitting a request for the specific signature value to the specific app of the user device and of allowing the specific app of the user device to transmit a specific signature value to the first authentication-supporting server by transmitting, wherein the specific signature value is obtained by signing a specific verification value for reference with a specific private key of a specific PKI certificate, (ii) if the specific signature value is acquired and determined as valid, a process of allowing use of the specific service provided by the specific service server through the specific app of the user device, and (iii) a process of registering or supporting another device connected with the first authentication-supporting server to register a specific SSO session corresponding to a log in/out state of the specific app of the user device to/of the specific service server in the specific blockchain network. ### Claim 8 (depends on 6) The method of claim 6, wherein, at the step of (a), the respective user certificates respectively include at least one of (i) public keys respectively corresponding to the multiple apps, (ii) user-identifying information, (iii) user device-identifying information, (iv) multiple apps-identifying information, (v) push token IDs respectively corresponding to the multiple apps, and (vi) personal information on the user, and wherein the login information on the specific app of the user device includes at least one of (i) the public keys, (ii) the user-identifying information, and (iii) the user device-identifying information. ### Claim 9 (depends on 7) The method of claim 7, wherein, at the step of (c), the first authentication-supporting server confirms a specific verification value for comparison extracted by applying a specific public key of the specific PKI certificate to the specific signature value, and verifies or supports either the specific blockchain network or another device connected with the first authentication-supporting server to verify the specific signature value by comparing the specific verification value for comparison with the specific verification value for reference. ### Claim 10 A first authentication-supporting server for a Single Sign On (SSO) service using a Public Key Infrastructure (PKI) based on blockchain networks, comprising: at least one memory that stores instructions; and at least one processor configured to execute the instructions to perform: (I) (I-1) if information on requesting a registration of a first user certificate using a first PKI certificate generated through a first app of a user device is acquired from the user device or from another device connected with the user device, a process of transmitting a request for a first signature value to the first app of the user device, wherein the first app has been installed in the user device and allows use of a first service provided by a first service server, and wherein the first signature value is obtained by signing a first verification value for reference with a first private key of the first PKI certificate, (I-2) if the first signature value is acquired from the user device or from another device connected with the user device, a process of verifying or supporting another device connected with the first authentication-supporting server to verify the first signature value, and (I-3) if the first signature value is determined as valid, a process of registering or supporting another device connected with the first authentication-supporting server to register the first user certificate in the first blockchain network, wherein the first user certificate includes a first public key of the first PKI certificate and first registration information thereon; (II) (II-1) if it is confirmed that a second user certificate is not registered in a second blockchain network in response to a request for confirming the second user certificate by using a second app of the user device, and if information on requesting a verification of the first user certificate is acquired from a second authentication-supporting server connected with a second service server, a process of confirming or supporting another device connected with the first authentication-supporting server to confirm the first user certificate registered in the first blockchain network, wherein the second app has been installed in the user device and allows use of a second service provided by the second service server, and wherein the second user certificate is registered in the second blockchain network as corresponding to the second app, and (II-2) a process of allowing the second app to transmit a request for a second signature value to the first app, by transmitting or supporting another device connected with the first authentication-supporting server to transmit a result on verifying the first user certificate including a second verification value for reference to the second app of the user device through the second authentication-supporting server connected with the second service server, wherein the second signature value is obtained by signing the second verification value for reference with the first private key of the first PKI certificate; and (III) (III-1) if the second signature value is obtained from the first app of the user device or from another device connected with the user device, a process of verifying or supporting the first blockchain network or another device connected with the first authentication-supporting server to verify the second signature value, (III-2) if the second signature value is determined as valid, by transmitting or allowing another device connected with the first authentication-supporting server to transmit a result on verifying the second signature value to the first app of the user device, (III-2-a) a process of supporting the first app of the user device to transmit the result on verifying the second signature value to the second app of the user device, so as to allow the second app to generate a second PKI certificate and transmit information on requesting a registration of the second user certificate using the second PKI certificate to the second authentication-supporting server, (III-2-b) a process of supporting the second authentication-supporting server to transmit a request for a third signature value to the second app in response to the information on requesting the registration of the second user certificate, wherein the third signature value is obtained by signing a third verification value with a second private key of the second PKI certificate, (III-2-c) if the third signature value is acquired from the user device or from another device connected with the user device, a process of supporting the second authentication-supporting server to verify or to allow the second blockchain network or another device connected with the second authentication-supporting server to verify the third signature value, and (III-2-d) if the third signature value is determined as valid, a process of supporting the second authentication-supporting server to register the second user certificate in the second blockchain network, wherein the second user certificate includes a second public key of the second PKI certificate and second registration information thereon. ### Claim 11 (depends on 10) The first authentication-supporting server of claim 10, wherein, when either the first app of the user device or the second app of the user device generates its corresponding first PKI certificate or its corresponding second PKI certificate, a user of the user device sets path information for accessing either the first private key of the first PKI certificate or the second private key of the second PKI certificate. ### Claim 12 (depends on 10) The first authentication-supporting server of claim 10, wherein the processor confirms either a first verification value for comparison extracted by applying the first public key of the first PKI certificate to the first signature value or a second verification value for comparison extracted by applying the first public key of the first PKI certificate to the second signature value, and verifies or supports the first blockchain network to verify either the first signature value or the second signature value by comparing the first verification value for comparison with the first verification value for reference or the second verification value for comparison with the second verification value for reference. ### Claim 13 (depends on 10) The first authentication-supporting server of claim 10, wherein the first user certificate registered in the first blockchain network or the second user certificate registered in the second blockchain network includes at least one of (i) the first public key or the second public key, (ii) user-identifying information, (iii) user device-identifying information, (iv) first app-identifying information or second app-identifying information, (v) a push token ID corresponding to either the first app or the second app, and (vi) personal information on the user. ### Claim 14 (depends on 10) The first authentication-supporting server of claim 10, wherein, at the process of (II), the processor further adds (i) a first app ID corresponding to the first user certificate confirmed from the first blockchain network and (ii) a URL scheme to be used for transmitting the second verification value for reference to the first app and for requesting a signature on the second verification value for reference into the result on confirming the first user certificate, to thereby transmit or support another device connected with the first authentication-supporting server to transmit the result on confirming the first user certificate to the second app. ### Claim 15 A first authentication-supporting server for a Single Sign On (SSO) service using a Public Key Infrastructure (PKI) based on blockchain networks, comprising: at least one memory that stores instructions; and at least one processor configured to execute the instructions to perform: (I) on condition that respective user certificates using respective PKI certificates generated by multiple apps of a user device have been registered in respective blockchain networks corresponding to respective service servers, if information on requesting an SSO using login information on a specific app of the user device is acquired from the user device or a specific service server, a process of confirming or supporting another device connected with the first authentication-supporting server to confirm whether a specific user certificate corresponding to the login information on the specific app of the user device is registered in a specific blockchain network corresponding to the specific service server, wherein the multiple apps of the user device have been installed in the user device and allow uses of respective services provided by the respective service servers; and (II) the first authentication-supporting server performing, if it is confirmed that the specific user certificate is not registered in the specific blockchain network, (II-1) a process of supporting at least one second authentication-supporting server, among respective second authentication-supporting servers corresponding to the respective service servers, to check or to allow another device connected with the second authentication-supporting server to check an SSO session from at least one certain blockchain network connected with the second authentication-supporting server, by transmitting a request for confirming whether there is the SSO session to the second authentication-supporting server, and (II-2) if information on checking the SSO session is acquired from the second authentication-supporting server, a process of allowing use of a specific service provided by the specific service server through the specific app of the user device by supporting the specific service server or the specific app of the user device to associate with the SSO session. ### Claim 16 (depends on 15) The first authentication-supporting server of claim 15, further comprising a process of: (III) if it is confirmed that the specific user certificate is registered in the specific blockchain network, (III-1) processes of transmitting a request for the specific signature value to the specific app of the user device and of allowing the specific app of the user device to transmit a specific signature value to the first authentication-supporting server by transmitting, wherein the specific signature value is obtained by signing a specific verification value for reference with a specific private key of a specific PKI certificate, (III-2) if the specific signature value is acquired and determined as valid, a process of allowing use of the specific service provided by the specific service server through the specific app of the user device, and (III-3) a process of registering or supporting another device connected with the first authentication-supporting server to register a specific SSO session corresponding to a log in/out state of the specific app of the user device to/of the specific service server in the specific blockchain network. ### Claim 17 (depends on 15) The first authentication-supporting server of claim 15, wherein, at the process of (I), the respective user certificates respectively include at least one of (i) public keys respectively corresponding to the multiple apps, (ii) user-identifying information, (iii) user device-identifying information, (iv) multiple apps-identifying information, (v) push token IDs respectively corresponding to the multiple apps, and (vi) personal information on the user, and wherein the login information on the specific app of the user device includes at least one of (i) the public keys, (ii) the user-identifying information, and (iii) the user device-identifying information. ### Claim 18 (depends on 15) The first authentication-supporting server of claim 15, wherein, at the process of (III), the processor confirms a specific verification value for comparison extracted by applying a specific public key of the specific PKI certificate to the specific signature value, and verifies or supports either the specific blockchain network or another device connected with the first authentication-supporting server to verify the specific signature value by comparing the specific verification value for comparison with the specific verification value for reference.