# US 10,873,463 B2 · System and method for decentralized-identifier authentication

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,873,463 B2
- Document ID: US10873463B2
- Status: Granted
- Kind: B2
- Application number: 16/735,018
- Filed: 2020-01-06
- Published: 2020-05-14
- Granted: 2020-12-22
- Earliest claimed: 2019-07-02
- Assignees: Advanced New Technologies Co., Ltd.
- Applicants: Advanced New Technologies Co., Ltd.
- Inventors: Renhui Yang; Jiawei Liu; Yuan Chen; Yuqi Lin
- Web page: https://patentgrep.com/patent/US10873463B2

## CPC

- H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD}
- G06F 16/2379: {Updates performed during online database operations; commit processing}
- G06F 21/31: User authentication
- G06F 21/45: Structures or tools for the administration of authentication
- G06Q 20/3829: {involving key management}
- H04L 9/0637: {Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]}
- H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC}
- H04L 9/0866: {involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics}
- H04L 9/0877: {using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]}
- H04L 9/3073: {involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing}
- H04L 9/3247: {involving digital signatures}
- H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)}
- H04L 9/3271: {using challenge-response}
- H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint}
- H04L 63/126: {the source of the received data}
- H04L 2209/38
- H04L 2209/56: Financial cryptography, e.g. electronic payment or e-cash
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for blockchain-based decentralized-identifier authentication, are provided. One of the methods includes: obtaining a request for authenticating a decentralized identifier (DID), wherein the request comprises the DID, a plaintext associated with a challenge for authenticating the DID, and a digital signature on the plaintext; obtaining a public key associated with the DID; determining, based on the obtained public key and the plaintext, that the digital signature on the plaintext is created based on a private key corresponding to the DID; and generating, based on the determination, a message confirming authentication of the DID.

## Claims

### Claim 1

A computer-implemented method for blockchain-based decentralized-identifier authentication, comprising:
obtaining, by a server from a computing device, a request for authenticating a decentralized identifier (DID), wherein the request comprises the DID, a plaintext associated with a challenge for authenticating the DID, and a digital signature on the plaintext;
generating, by the server, a blockchain transaction for retrieving a DID document corresponding to the DID from a blockchain, wherein the blockchain transaction invokes a blockchain contract for managing relationships between a plurality of DIDs and a plurality of corresponding DID documents;
sending, by the server, the generated blockchain transaction to one or more blockchain nodes of the blockchain for adding to the blockchain, the one or more blockchain nodes being configured to, after the generated blockchain transaction is added to the blockchain, execute the blockchain contract based on the blockchain transaction to retrieve the DID document corresponding to the DID;
receiving, by the server from at least one of the one or more blockchain nodes, the DID document corresponding to the DID, wherein the DID document comprises information associated with one or more authentication service endpoints associated with the DID, the information identifying the server as one of the one or more authentication service endpoints;
retrieving, by the server, a public key associated with the DID from the received DID document;
determining, by the server based on the obtained public key and the plaintext, that the digital signature on the plaintext is created based on a private key corresponding to the DID;
generating, by the server based on the determination, a message confirming authentication of the DID; and
sending, by the server to the computing device, the message confirming authentication of the DID.

### Claim 2 (depends on 1)

The method of claim 1, wherein the blockchain contract comprises an interface for retrieving information associated with one or more DID documents corresponding to one or more DIDs.

### Claim 3 (depends on 1)

The method of claim 1, further comprising:
sending the message confirming authentication of the DID to a different computing device that is associated with a creator of the challenge for authenticating the DID.

### Claim 4 (depends on 1)

The method of claim 1, wherein the obtained request for authenticating the DID comprises:
a response to the challenge for authenticating the DID, the response comprising the digital signature on the plaintext.

### Claim 5 (depends on 1)

The method of claim 1, further comprising, prior to obtaining the request for authenticating the DID:
obtaining a request for creating the digital signature, wherein the request for creating the digital signature comprises the plaintext and information associated with the DID; and
creating the digital signature on the plaintext based on the request for creating the digital signature.

### Claim 6 (depends on 5)

The method of claim 5, wherein the creating the digital signature on the plaintext comprises:
obtaining one or more permissions associated with a sender of the request for creating the digital signature;
determining, based on the obtained one or more permissions and the information associated with the DID, whether the sender of the request for creating the digital signature is authorized to control one or more operations associated with the DID; and
in response to determining that the sender of the request for creating the digital signature is authorized to control the one or more operations associated with the DID, creating the digital signature on the plaintext.

### Claim 7 (depends on 6)

The method of claim 6, wherein the sender of the request for creating the digital signature comprises:
an owner of the DID; or
an entity authorized to control the one or more operations associated with the DID on behalf of the owner of the DID.

### Claim 8 (depends on 5)

The method of claim 5, wherein the creating the digital signature on the plaintext comprises:
sending instructions to a key management system (KMS) for signing the plaintext using the private key associated with the DID; and
obtaining the digital signature from the KMS.

### Claim 9 (depends on 8)

The method of claim 8, wherein the sending instructions to the KMS comprises:
identifying a blockchain account associated with the DID;
determining an identifier for the private key associated with the DID based on the identified blockchain account associated with the DID; and
including the identifier for the private key associated with the DID in the instructions.

### Claim 10 (depends on 8)

The method of claim 8, wherein the private key is stored in a trusted execution environment (TEE) associated with the KMS and the digital signature obtained from the KMS is generated in the TEE.

### Claim 11

A non-transitory computer-readable storage medium for blockchain-based decentralized-identifier authentication, configured with instructions executable by one or more processors to cause the one or more processors to perform operations comprising:
obtaining, from a computing device, a request for authenticating a decentralized identifier (DID), wherein the request comprises the DID, a plaintext associated with a challenge for authenticating the DID, and a digital signature on the plaintext;
generating a blockchain transaction for retrieving a DID document corresponding to the DID from a blockchain, wherein the blockchain transaction invokes a blockchain contract for managing relationships between a plurality of DIDs and a plurality of corresponding DID documents;
sending the generated blockchain transaction to one or more blockchain nodes of the blockchain for adding to the blockchain, the one or more blockchain nodes being configured to, after the generated blockchain transaction is added to the blockchain, execute the blockchain contract based on the blockchain transaction to retrieve the DID document corresponding to the DID;
receiving, from at least one of the one or more blockchain nodes, the DID document corresponding to the DID, wherein the DID document comprises information associated with one or more authentication service endpoints associated with the DID, the information identifying the server as one of the one or more authentication service endpoints;
retrieving a public key associated with the DID from the received DID document;
determining, based on the obtained public key and the plaintext, that the digital signature on the plaintext is created based on a private key corresponding to the DID;
generating, based on the determination, a message confirming authentication of the DID; and
sending, to the computing device, the message confirming authentication of the DID.

### Claim 12 (depends on 11)

The non-transitory computer-readable storage medium of claim 11, wherein the blockchain contract comprises an interface for retrieving information associated with one or more DID documents corresponding to one or more DIDs.

### Claim 13 (depends on 11)

The non-transitory computer-readable storage medium of claim 11, wherein the operations further comprise:
sending the message confirming authentication of the DID to a different computing device that is associated with a creator of the challenge for authenticating the DID.

### Claim 14 (depends on 11)

The non-transitory computer-readable storage medium of claim 11, wherein the obtained request for authenticating the DID comprises:
a response to the challenge for authenticating the DID, the response comprising the digital signature on the plaintext.

### Claim 15 (depends on 11)

The non-transitory computer-readable storage medium of claim 11, wherein the operations further comprise, prior to obtaining the request for authenticating the DID:
obtaining a request for creating the digital signature, wherein the request for creating the digital signature comprises the plaintext and information associated with the DID; and
creating the digital signature on the plaintext based on the request for creating the digital signature.

### Claim 16

A system for blockchain-based decentralized-identifier authentication, comprising a processor and a non-transitory computer-readable storage medium storing instructions executable by the processor to cause the system to perform operations comprising:
obtaining, from a computing device, a request for authenticating a decentralized identifier (DID), wherein the request comprises the DID, a plaintext associated with a challenge for authenticating the DID, and a digital signature on the plaintext;
generating a blockchain transaction for retrieving a DID document corresponding to the DID from a blockchain, wherein the blockchain transaction invokes a blockchain contract for managing relationships between a plurality of DIDs and a plurality of corresponding DID documents;
sending the generated blockchain transaction to one or more blockchain nodes of the blockchain for adding to the blockchain, the one or more blockchain nodes being configured to, after the generated blockchain transaction is added to the blockchain, execute the blockchain contract based on the blockchain transaction to retrieve the DID document corresponding to the DID;
receiving, from at least one of the one or more blockchain nodes, the DID document corresponding to the DID, wherein the DID document comprises information associated with one or more authentication service endpoints associated with the DID, the information identifying the server as one of the one or more authentication service endpoints;
retrieving a public key associated with the DID from the received DID document;
determining, based on the obtained public key and the plaintext, that the digital signature on the plaintext is created based on a private key corresponding to the DID;
generating, based on the determination, a message confirming authentication of the DID; and
sending, to the computing device, the message confirming authentication of the DID.

### Claim 17 (depends on 16)

The system of claim 16, wherein the operations further comprise, prior to obtaining the request for authenticating the DID:
obtaining a request for creating the digital signature, wherein the request for creating the digital signature comprises the plaintext and information associated with the DID; and
creating the digital signature on the plaintext based on the request for creating the digital signature.

### Claim 18 (depends on 17)

The system of claim 17, wherein the creating the digital signature on the plaintext comprises:
obtaining one or more permissions associated with a sender of the request for creating the digital signature;
determining, based on the obtained one or more permissions and the information associated with the DID, whether the sender of the request for creating the digital signature is authorized to control one or more operations associated with the DID; and
in response to determining that the sender of the request for creating the digital signature is authorized to control the one or more operations associated with the DID, creating the digital signature on the plaintext.

### Claim 19 (depends on 18)

The system of claim 18, wherein the sender of the request for creating the digital signature comprises:
an owner of the DID; or
an entity authorized to control the one or more operations associated with the DID on behalf of the owner of the DID.

### Claim 20 (depends on 17)

The system of claim 17, wherein the creating the digital signature on the plaintext comprises:
sending instructions to a key management system (KMS) for signing the plaintext using the private key associated with the DID; and
obtaining the digital signature from the KMS.