Methods and systems for ownership verification using blockchain
A blockchain system for ownership verification may include one or more issuer network nodes and one or more verification network nodes. An issuer network node may be configured to receive a request including a public key to issue a credential, provision the credential to the communication device, generate a payload derived from hashing the credential and the public key, store the payload in a record of a blockchain, and synchronize the record to other network nodes on the blockchain. A verification network node may be configured to receive the credential, the public key, and a signature generated by the communication device to request access to a resource, verify the signature using the public key, generate a hash value based on the credential and the public key, determine that the hash value is stored in the blockchain, and authenticate the communication device for access to the requested resource.
1 . A computer-implemented method comprising:
receiving, by a credential issuer computer, a request to issue a credential for a communication device, the request including a communication device public key associated with the communication device, wherein the credential is a sixteen digit number;
determining, by the credential issuer computer, the credential to issue to the communication device;
provisioning, by the credential issuer computer, the credential to the communication device by storing the credential in a secured memory of the communication device;
generating, by the credential issuer computer, a payload derived from hashing the credential and the communication device public key;
storing, by the credential issuer computer, the payload in a record of a blockchain, the blockchain comprising a plurality of blocks, each block containing one or more records, and the record signed with an issuer key associated with the credential issuer computer and a certificate authority key associated with a certificate authority, where the certificate authority is a trusted entity that issues certificates to other entities to certify identities of the other entities, wherein the certificates include information about a cryptographic key and information about the identity of an owner of the cryptographic key, and wherein the other entities include the credential issuer computer and a merchant computer that can receive the credential; and
synchronizing, by the credential issuer computer, the record to other network nodes on the blockchain.
2 . The computer-implemented method of claim 1 , wherein the payload is further derived from a hash of a previous block of the blockchain.
3 . The computer-implemented method of claim 1 , wherein provisioning the credential to the communication device includes providing to the communication device a block identifier identifying which block in the blockchain contains the record.
4 . The computer-implemented method of claim 1 , wherein the credential is an account identifier, or a token that is a substitute for the account identifier.
5 . The computer-implemented method of claim 1 , wherein determining the credential comprises generating the credential randomly or using a predetermined algorithm.
6 . The computer-implemented method of claim 1 , wherein determining the credential comprises retrieving the credential from a database.
7 . The computer-implemented method of claim 1 , wherein the blockchain comprises a Hyperledger Fabric.
8 . The computer-implemented method of claim 1 , wherein the other network nodes on the blockchain comprise a plurality of verification nodes configured to process user requests to access resources.
9 . The computer-implemented method of claim 1 , wherein the issuer key is an issuer private key.
10 . The computer-implemented method of claim 9 , wherein the credential issuer computer comprises a hardware security module (HSM) that stores the issuer private key and a plurality of public keys associated with other entities.
11 . A credential issuer computer comprising:
a processor; and
a non-transitory computer-readable medium storing instructions executable by the processor for performing processing comprising:
receiving a request to issue a credential for a communication device, the request including a communication device public key associated with the communication device, wherein the credential is a sixteen digit number;
determining the credential to issue to the communication device;
provisioning the credential to the communication device by storing the credential in a secured memory of the communication device;
generating a payload derived from hashing the credential and the communication device public key;
storing the payload in a record of a blockchain, the record signed with an issuer key associated with the credential issuer computer and a certificate authority key associated with a certificate authority, where the certificate authority is a trusted entity that issues certificates to other entities to certify identities of the other entities, wherein the certificates include information about a cryptographic key and information about the identity of an owner of the cryptographic key, and wherein the other entities include the credential issuer computer and a merchant computer that can receive the credential; and
synchronizing the record to other network nodes on the blockchain.
12 . The credential issuer computer of claim 11 , wherein the payload is further derived from a hash of a previous block of the blockchain.
13 . The credential issuer computer of claim 11 , wherein provisioning the credential to the communication device includes providing to the communication device a block identifier identifying which block in the blockchain contains the record.
14 . The credential issuer computer of claim 11 , wherein determining the credential comprises generating the credential randomly or using a predetermined algorithm.
15 . The credential issuer computer of claim 11 , wherein determining the credential comprises retrieving the credential from a database.
16 . The credential issuer computer of claim 11 , wherein the credential is an account identifier.
17 . The credential issuer computer of claim 11 , wherein the credential is a token that is a substitute for an account identifier.
18 . The credential issuer computer of claim 11 , wherein the other network nodes on the blockchain comprise a plurality of verification nodes configured to process user requests to access resources.
19 . The credential issuer computer of claim 11 , wherein:
the issuer key is an issuer private key; and
the credential issuer computer further comprises a hardware security module (HSM) that stores the issuer key and a plurality of public keys associated with other entities.