Method and system for security in a virtual environment
An architecture and operational identify management and trust method and system includes a flexible digital wallet application, an interactive virtual environment within the metaverse, and a secure backend infrastructure on a blockchain network. By integrating self-sovereign identity and blockchain technology, this extended framework aims to establish a secure and user-centric decentralized metaverse.
1 . A decentralized metaverse security system for managing entity access, comprising:
a head-mounted display device for metaverse engagement;
a virtual environment within the metaverse;
a blockchain layer featuring a smart contract for secure access management, wherein the smart contract's data model relies on three core data structures: Entity, Certificate, and trust entity, wherein serving as a central hub between digital identities of entities and a distributed application (dApp), the Smart Contract regulates data flow based on predefined rules;
a business layer, linked to the blockchain layer, for transaction processing via the smart contract, wherein the business layer adopts a hierarchical trust model to foster trust among parties;
a communication layer, connected to the business layer, utilizing an API web service for communication, including establishing web connections to the blockchain layer through the API, enabling information retrieval from the smart contract for user verification; and
an application layer, positioned as a top-level layer, facilitating the connection of the distributed application (dApp) and virtual environment to the blockchain layer via the communication layer during operational phases,
wherein during a user registration process, upon receiving a username and a password provided by a new user at a mobile device, a unique wallet address is created as an identifier of the user within the decentralized metaverse security system, a private-public key pair is generated for the user, the wallet address and the private-public key pair are stored at the mobile device after being encrypted using the password, and the private-public key pair is generated by: (1) deriving, as a seed, a randomly selected 12-word keyphrase from a wordlist that consists of 2048 words, (2) generating a 256-bit private key based on the derived seed using Elliptic Curve Cryptography, and (3) generating a corresponding public key based on the 256-bit private key,
wherein during a user identity verification process, upon receiving from the user an interaction request to initiate an interaction with the virtual environment, a two-tiered verification is performed, which comprises: (1) a trustworthiness assessment, in which it is determined, based on the wallet address, whether the user is a registered entity within the decentralized metaverse security system, and (2) an authenticity validation, in which it is determined whether the interaction request is authenticated by a trusted entity, and
the trusted entity is a registered entity that is both identified by the interaction request and listed in a white list of entities trusted by a provider of the metaverse.
2 . The system of claim 1 , wherein the distributed application (dApp) initiates signing requests, determining handling of user assets, wherein the API serves as a conduit, transmitting signed transactions to other nodes within the blockchain layer.
3 . The system of claim 1 , wherein the metaverse incorporates a login function, wherein the function establishes web connections to the blockchain layer through the API, enabling information retrieval from the smart contract for user verification, wherein verification process includes obtaining a signature for the user's wallet address.
4 . The system of claim 1 , wherein the smart contract features a certificate get logic function, wherein the function retrieves a signed message, issue date, and expiration date of a given certificate associated with a specific address, wherein a sign certificate logic function interacts with the distributed application (dApp), allowing trusted entities to issue new certificates with defined expiration dates.
5 . The system of claim 1 , wherein the blockchain layer retains results from an attestation process, wherein the attestation process involves a trusted entity providing their signature for the entity providing a certificate, affirming the certificate's authenticity, wherein the process creates a robust trust web, confirming that an entity's claim is corroborated by multiple trusted parties within the blockchain layer.
6 . The system of claim 1 , wherein the distributed application examines a user-provided wallet address and cross-references the wallet address with smart contract records to confirm the user's registration.
7 . The system of claim 6 , wherein upon validation of the wallet address, the distributed application prompts the user for a verifiable claim, obtains a relevant claim from the smart contract, and compares the verifiable claim to the obtained relevant claim to verify its authenticity.
8 . The system of claim 1 , wherein the distributed application includes an input for receiving a trusted party claiming to be an issuer of a certificate.
9 . The system of claim 1 , wherein the distributed application includes an input for receiving a certificate, including inputting an event that the user wishes to enter, associating the certificate and event with a unique wallet address, and storing the certificate, event, and wallet address on the blockchain.
10 . The system of claim 1 , wherein the head-mounted display device is configured to initiate access to a metaverse event, including a verification interface for inputting an event name, hostname, and a unique wallet address.
11 . A method for managing entity access in a decentralized metaverse security system, the decentralized metaverse security system comprising a head-mounted display device for metaverse engagement, a virtual environment within the metaverse, a blockchain layer featuring a smart contract for secure access management, wherein the smart contract's data model relies on three core data structures: Entity, Certificate, and trust entity, wherein serving as a central hub between digital identities of entities and a distributed application (dApp), the Smart Contract regulates data flow based on predefined rules, a business layer linked to the blockchain layer, for transaction processing via the smart contract, wherein the business layer adopts a hierarchical trust model to foster trust among parties, a communication layer connected to the business layer, utilizing an API web service for communication, including establishing web connections to the blockchain layer through the API, enabling information retrieval from the smart contract for user verification, and an application layer positioned as a top-level layer, facilitating the connection of the distributed application (dApp) and virtual environment to the blockchain layer via the communication layer during operational phases, the method comprising:
during a user registration process,
receiving a username and a password provided by a new user at a mobile device,
creating a unique wallet address for the user, as an identifier of the user within the decentralized metaverse security system,
generating a private-public key pair for the user by: (1) deriving, as a seed, a randomly selected 12-word keyphrase from a wordlist that consists of 2048 words, (2) generating a 256-bit private key based on the derived seed using Elliptic Curve Cryptography, and (3) generating a corresponding public key based on the 256-bit private key, and
encrypting the wallet address and the private-public key pair using the password and storing the encrypted wallet address and private-public key pair at the mobile device, and
during a user identity verification process,
receiving from the user an interaction request to initiate an interaction with the virtual environment,
performing a two-tiered verification by performing (1) a trustworthiness assessment, in which it is determined, based on the wallet address, whether the user is a registered entity within the decentralized metaverse security system, and (2) an authenticity
validation, in which it is determined whether the interaction request is authenticated by a trusted entity,
wherein the trusted entity is a registered entity that is both identified by the interaction request and listed in a white list of entities trusted by a provider of the metaverse.
12 . The method of claim 11 , wherein the trusted entity authenticates the interaction request through a digital signature generated using an Elliptic Curve Digital Signature algorithm.
13 . The method of claim 11 , wherein the smart contract is deployed in the blockchain layer using Solidity.
14 . The method of claim 11 , wherein the API web service is Infura API web service.
15 . The method of claim 11 , wherein the metaverse is hosted in Oculus.
16 . The method of claim 11 , wherein the predefined rules are based on an Ethereum protocol.
17 . The method of claim 11 , wherein the user identity verification process is initiated when the user initiates access to a metaverse event using the head-mounted display device.