Zero-knowledge proof-based certificate service method using blockchain network, certification support server using same, and user terminal using same

A method for managing a certificate based on a zero-knowledge proof using a blockchain network, comprising steps of:

• (a) on condition that a user commitment, generated by applying an operation of a commitment scheme to user identity information and user trap information, has been registered on a distributed ledger of the blockchain network, wherein the user trap information is generated by using a secret key of a user, in response to acquiring a proof information request corresponding to the user identity information from a verification server, a user device (i) generating random nonces, (ii) verifying the user identity information by using the commitment scheme, and (iii) generating user identity proving information corresponding to the random nonces in order to check whether the user identity information satisfies a certain requirement;
• and
• (b) the user device transmitting the user identity proving information to the verification server, to thereby instruct the verification server to (i) acquire the user commitment from the blockchain network, (ii) verify the user identity information by using the user commitment acquired from the blockchain network and the user identity proving information acquired from the user device, and (vi) verify whether the user identity information satisfies the certain requirement;
• wherein generators of the commitment scheme are represented as g and h, the user trap information is represented as hA(the secret key), wherein said hA(the secret key) represents said h to the power of the secret key, and the user commitment is represented as comm(the user identity information)=g{circumflex over ( )}(the user identity information) * hA(the secret key), wherein said g{circumflex over ( )}(the user identity information) represents said g to the power of the user identity information, and
• wherein, at the step of (a), the user device (i) generates a random nonce x and a random nonce y, (ii) generates first user identity proving information g{circumflex over ( )}x*h{circumflex over ( )}y corresponding to the random nonce x and the random nonce y by using the commitment scheme, (iii) generates a hash value c=hash(g{circumflex over ( )}x*h{circumflex over ( )}y) by using the first user identity proving information g{circumflex over ( )}x*h{circumflex over ( )}y, and (iv) generates (2_1)-st user identity proving information x′=x+c*(user identity information) and (2_2)-nd user identity proving information y′=y+c*(secret key) by referring to the user identity information, the secret key, the random nonce x, the random nonce y, and the hash value c, and
• wherein, at the step of (b), the user device transmits the (2_1)-st user identity proving information x′, the (2_2)-nd user identity proving information y′, and the hash value c to the verification server, to thereby instruct the verification server to check whether (1) a verification value hash((g{circumflex over ( )}x′*h{circumflex over ( )}y′/(comm(the user identity information){circumflex over ( )}c)) generated by referring to the (2_1)-st user identity proving information x′, the (2_2)-nd user identity proving information y′, the hash value c, and the user commitment comm(the user identity information) and (2) the hash value c correspond with each other, thus verifying the user identity information.

A user device for managing a certificate based on a zero-knowledge proof using a blockchain network, comprising:

• at least one memory that stores instructions;
• and
• at least one processor configured to execute the instructions to perform processes of:
• (I) on condition that a user commitment, generated by applying an operation of a commitment scheme to user identity information and user trap information, has been registered on a distributed ledger of the blockchain network, wherein the user trap information is generated by using a secret key of a user, in response to acquiring a proof information request corresponding to the user identity information from a verification server, (i) generating random nonces, (ii) verifying the user identity information by using the commitment scheme, and (iii) generating user identity proving information corresponding to the random nonces in order to check whether the user identity information satisfies a certain requirement;
• and (II) transmitting the user identity proving information to the verification server, to thereby instruct the verification server to (i) acquire the user commitment from the blockchain network, (ii) verify the user identity information by using the user commitment acquired from the blockchain network and the user identity proving information acquired from the user device, and (vi) verify whether the user identity information satisfies the certain requirement;
• wherein generators of the commitment scheme are represented as g and h, the user trap information is represented as hA(the secret key), wherein said hA(the secret key) represents said h to the power of the secret key, and the user commitment is represented as comm(the user identity information)=g{circumflex over ( )}(the user identity information)*hA(the secret key), wherein said g{circumflex over ( )}(the user identity information) represents said g to the power of the user identity information, and
• wherein, at the process of (I), the processor (i) generates a random nonce x and a random nonce y, (ii) generates first user identity proving information g{circumflex over ( )}x*h{circumflex over ( )}y corresponding to the random nonce x and the random nonce y by using the commitment scheme, (iii) transmits the first user identity proving information to the verification server, and (iv) in response to the verification server transmitting a random nonce c, generates (2_1)-st user identity proving information x′=x+c*(user identity information) and (2_2)-nd user identity proving information y′=y+c*(secret key) by referring to the user identity information, the secret key, the random nonce x, the random nonce y, and the random nonce c, and
• wherein, at the process of (II), the processor transmits the (2_1)-st user identity proving information x′ and the (2_2)-nd user identity proving information y′ to the verification server, to thereby instruct the verification server to check whether (1) a first verification value g{circumflex over ( )}x*h{circumflex over ( )}y*comm(the user identity information){circumflex over ( )}c generated by referring to the first user identity proving information g{circumflex over ( )}x*h{circumflex over ( )}y and the user commitment comm(the user identity information) and (2) a second verification value g{circumflex over ( )}x′*h{circumflex over ( )}y′ generated by referring to the (2_1)-st user identity proving information x′ and the (2_2)-nd user identity proving information y′ correspond with each other, thus verifying the user identity information.

A user device for managing a certificate based on a zero-knowledge proof using a blockchain network, comprising:

• at least one memory that stores instructions;
• and at least one processor configured to execute the instructions to perform processes of:
• (I) on condition that a user commitment, generated by applying an operation of a commitment scheme to user identity information and user trap information, has been registered on a distributed ledger of the blockchain network, wherein the user trap information is generated by using a secret key of a user, in response to acquiring a proof information request corresponding to the user identity information from a verification server, (i) generating random nonces, (ii) verifying the user identity information by using the commitment scheme, and (iii) generating user identity proving information corresponding to the random nonces in order to check whether the user identity information satisfies a certain requirement;
• and (II) transmitting the user identity proving information to the verification server, to thereby instruct the verification server to (i) acquire the user commitment from the blockchain network, (ii) verify the user identity information by using the user commitment acquired from the blockchain network and the user identity proving information acquired from the user device, and (vi) verify whether the user identity information satisfies the certain requirement;
• wherein generators of the commitment scheme are represented as g and h, the user trap information is represented as hA(the secret key), wherein said hA(the secret key) represents said h to the power of the secret key, and the user commitment is represented as comm(the user identity information)=g{circumflex over ( )}(the user identity information)*hA(the secret key), wherein said g{circumflex over ( )}(the user identity information) represents said g to the power of the user identity information, and wherein, at the process of (I), the processor (i) generates a random nonce x and a random nonce y, (ii) generates first user identity proving information g{circumflex over ( )}x*h{circumflex over ( )}y corresponding to the random nonce x and the random nonce y by using the commitment scheme, (iii) generates a hash value c=hash(g{circumflex over ( )}x*h{circumflex over ( )}y) by using the first user identity proving information g{circumflex over ( )}x*h{circumflex over ( )}y, and (iv) generates (2_1)-st user identity proving information x′=x+c*(user identity information) and (2_2)-nd user identity proving information y′=y+c*(secret key) by referring to the user identity information, the secret key, the random nonce x, the random nonce y, and the hash value c, and wherein, at the process of (II), the processor transmits the (2_1)-st user identity proving information x′, the (2_2)-nd user identity proving information y′, and the hash value c to the verification server, to thereby instruct the verification server to check whether (1) a verification value hash((g{circumflex over ( )}x′*h{circumflex over ( )}y′/(comm(the user identity information){circumflex over ( )}c)) generated by referring to the (2_1)-st user identity proving information x′, the (2_2)-nd user identity proving information y′, the hash value c, and the user commitment comm(the user identity information) and (2) the hash value c correspond with each other, thus verifying the user identity information.