Decentralized identity authentication framework for distributed data
Disclosed is a method for authenticating requestors and granting access to a permissioned blockchain network shared among enterprise entities. A decentralized registry of credentialled users, in which credentialled users guard their own access information by keeping a private key of a public-private keypair enables systems to avoid keeping information of a large number of users in large, vulnerable containers. A further method removes authenticated users seeking to be forgotten from the registry of users and deletes any personally identifiable information of the withdrawing users.
1 . A method, including:
receiving from a requestor, a first request by the requestor to access a permissioned blockchain network, wherein the first request includes: (i) identity documentation identifying the requestor, (ii) one or more claims, and (iii) one or more submissions of evidence;
authenticating the requestor based at least in part upon the one or more submissions of evidence, including:
redacting pictures captured of the requestor from at least (i) the identity documentation and (ii) the one or more claims; and
sending the identity documentation and the one or more claims without pictures to a validator server.
2 . The method of claim 1 , further including:
granting a distributed digital credential to the requestor to access the permissioned blockchain network.
3 . The method of claim 2 , further including:
receiving from the requestor, a second request by the requestor to withdraw from accessing the permissioned blockchain network;
rescinding the distributed digital credential issued to the requestor; and
removing personally identifiable information of the requestor.
4 . The method of claim 3 , wherein rescinding the distributed digital credential issued to the requestor further includes:
revoking the distributed digital credential;
deleting a trusted triple data structure, the trusted triple data structure comprised of: (a) a public key, (b) a link to an enterprise application on a server for which the requestor is authenticated, and (c) one or more third-party accreditations in the one or more claims as validated; and
deleting from private storage any identity documentation corresponding to the requestor.
5 . The method of claim 4 , wherein transactions from a requesting user that has withdrawn their credential remain in one or more nodes of the permissioned blockchain network and tied to an organization to which the requesting user was assigned with name, license and personally identifiable information of the requesting user removed.
6 . The method of claim 1 , wherein: (i) the identity documentation identifying the requestor is, at least in part, captured by the requestor at a time of making the first request and (ii) the one or more claims are made by an entity administrator supporting a role, as determined by rules of a trust framework adopted by network members.
7 . The method of claim 1 , wherein authenticating the requestor further includes: storing in a private storage: (i) the identity documentation and (ii) the one or more claims.
8 . The method of claim 1 , further including validating by the validator server, the one or more claims, as determined by rules of a trust framework by: checking by the validator server, a state board of pharmacy database to verify that a pharmacist applying for an ID is really the pharmacist in charge of the pharmacy they claim to manage.
9 . The method of claim 8 , further including the validator server issuing one or more challenges to the requestor; and based at least in part upon responses from the requestor, validating: (i) the identity documentation and (ii) the one or more claims.
10 . The method of claim 9 , wherein challenges are selected from a set comprising of: (i) questions asked through a secure channel, (ii) requests to take a photo of themselves holding an identification, and (iii) invert or flip the identification in a subsequent photo.
11 . The method of claim 2 , wherein granting a distributed digital credential further includes: generating and sending to the requestor, a token for creating a public-private key pair.
12 . The method of claim 11 , wherein granting a distributed digital credential further includes: obtaining a digital ID comprising a pseudonymized user ID of the requestor authenticated from a public key and a digital signature.
13 . The method of claim 11 , wherein granting a distributed digital credential further includes: storing a credential in a public key registry as a trusted triple data structure comprised of: (a) a public key, (b) a link to an enterprise application on a server for which the requestor is being authenticated, and (c) one or more third-party accreditations in the one or more claims as validated.
14 . The method of claim 13 , wherein no registry node contains credentials for all users permitted access to the permissioned blockchain network.
15 . The method of claim 2 , further including: receiving notification from the validator server that an event affecting at least one claim of the one or more claims has been detected or input of a manual review has been received; and
revoking the distributed digital credential in the permissioned blockchain network.
16 . The method of claim 15 , wherein an event affecting the at least one claim of the one or more claims includes: an external validator checking a state board of pharmacy database, based, at least in part, upon an expiry of a 24-hour timer, for any changes in listed pharmacists in charge for each pharmacy and notifying to make any necessary revocations.
17 . The method of claim 7 , further including providing at least some of the identity documentation maintained in a private storage to an external server for audit.
18 . The method of claim 1 , wherein a machine intelligence process is used to authenticate the requestor using a trained neural network classifier trained using a training set of example submissions of evidence and ground truth outcomes.
19 . The method of claim 18 , further including identifying patterns in data points indicating clusters of data, and applying a label to each cluster; and training the trained neural network classifier with at least some of the clusters and labels.
20 . The method of claim 18 , wherein values for one or more labels associated with a training set of example submissions of evidence and ground truth outcomes are determined from a set including at least a plurality of counterfeit, expired, hacked, intentional adulteration, unfit for authentication, and fraudulent activity.
21 . A method of granting and sharing credentials in a shared private permissioned blockchain data structure shared among network members of a blockchain network, the method comprising:
receiving, by a registry server and from a requesting application, a request to authenticate one or more identity claims of a requesting user to permit access to data stored in blocks in the shared private permissioned blockchain data structure shared among network members, the request including: (i) identity documentation identifying the requesting user and captured at a time of making the request and (ii) one or more claims made by an entity administrator supporting a role, as determined by rules of a trust framework adopted by the network members;
storing in a private storage by the registry server, the (i) identity documentation and (ii) claims;
redacting pictures captured of the requesting user from (i) the identity documentation and (ii) the one or more claims;
sending the identity documentation and the one or more claims to a validator server;
upon obtaining, by the registry server and from the validator server, an approval validating: (i) the identity documentation and (ii) the one or more claims made by an entity administrator, generating and sending a one-time token for creating a public-private key pair; and
granting, by the registry server, a credential in the blockchain network based upon validation of (i) the identity documentation and (ii) the claims, the credential being stored in a public key registry at the registry server as a trusted triple data structure comprised of (a) a public key of the public-private key pair, (b) a link to an enterprise application on a server corresponding to the registry server, and (c) one or more third-party accreditations in the one or more claims as validated; and
providing, by the registry server, the trusted triple data structure as verification of the credential to a blockchain network member as requested; thereby enabling the blockchain network member to restrict data from blocks stored in the shared private permissioned blockchain data structure to credentialed users.
22 . The method of claim 21 , further including displaying a first block of the shared private permissioned blockchain data structure using a first color denoting a first network member as a source of the first block and displaying a second block of the shared private permissioned blockchain data structure using a second color, different from the first color, and denoting a second network member as a source of the second block.
23 . A system comprising:
a registry server including a processor and software that when executed implements processing including:
receiving from a requestor, a first request by the requestor to access a permissioned blockchain network, wherein the first request includes: (i) identity documentation identifying the requestor, (ii) one or more claims, and (iii) one or more submissions of evidence;
authenticating the requestor based at least in part upon the one or more submissions of evidence, including:
redacting pictures captured of the requestor from at least (i) the identity documentation and (ii) the one or more claims; and
sending the identity documentation and the one or more claims without pictures to a validator server.
24 . A non-transitory computer readable medium storing instructions, which instructions when executed by one or more processors perform processing including:
receiving from a requestor, a first request by the requestor to access a permissioned blockchain network, wherein the first request includes: (i) identity documentation identifying the requestor, (ii) one or more claims, and (iii) one or more submissions of evidence;
authenticating the requestor based at least in part upon the one or more submissions of evidence, including:
redacting pictures captured of the requestor from at least (i) the identity documentation and (ii) the one or more claims; and
sending the identity documentation and the one or more claims without pictures to a validator server.