Decentralized database identity management system

Patent metadata

Field	Value
Publication number	US-2020204557-A1
Application number	US-201816226336-A
Country	US
Kind code	A1
Filing date	Dec 19, 2018
Priority date	Dec 19, 2018
Publication date	Jun 25, 2020
Grant date	—

Abstract

An example operation may include one or more of receiving, by a blockchain node or peer of a blockchain network, attribute data for a user profile, creating blockchain transactions to store attribute hashes and metadata to a shared ledger, receiving a user profile query from an identity consumer, creating blockchain transactions to retrieve attribute hashes and metadata corresponding to the query, reconstructing the user profile from the metadata, responding to the query by providing attribute data to the identity consumer, and creating and storing hashes of the attribute data and metadata to the shared ledger.

First claim

What is claimed is:

1 . A system, comprising:
one or more external stores; and a blockchain network, comprising:
one or more attribute custodians, configured to:
receive attribute data for a user profile from the one or more external stores; and
create blockchain transactions to store hashes of the attribute data and metadata to a shared ledger;

an identity consumer, configured to:
create a blockchain transaction to query one or more attributes of the user profile; and
receive the one or more attributes of the user profile; and

a smart contract or chaincode, in response to the blockchain transaction to query the one or more attributes, configured to:
retrieve attribute hashes and metadata that corresponds to the query;
reconstruct the user profile from the metadata;
respond to the query with attribute data to the identity consumer; and
create and store hashes of the attribute data and metadata to the shared ledger.

2 . The system of claim 1 , wherein the metadata comprises storage locations to store the attribute data in the one or more external stores.

3 . The system of claim 2 , wherein the smart contract or chaincode reconstructs the user profile from the metadata comprises the smart contract or chaincode retrieves attribute data that corresponds to the user profile from the storage locations and validates the attribute data with the attribute hashes.

4 . The system of claim 3 , wherein the stored ledger comprises a logical view of the user profile, wherein the smart contract or chaincode manages the logical view through one or more application programming interfaces.

5 . The system of claim 4 , wherein the blockchain node or peer modifies metadata in the shared ledger through one or more application programming interface calls to the smart contract or chaincode.

6 . The system of claim 2 , wherein in response to the one or more attribute custodians receives the attribute data for the user profile, the smart contract or chaincode further configured to:
approve the inclusion of the attribute data to the user profile based on user policies and select an external store to obtain the attribute data from.

7 . The system of claim 1 , wherein the identity consumer creates a risk evaluation request for a user that corresponds to the user profile, and in response the smart contract or chaincode:
approves the identity consumer to query the user profile; queries the user profile; determines a risk score for a user that corresponds to the user profile; and provides the risk score to the identity consumer.

8 . A method, comprising:
receiving, by a blockchain node or peer of a blockchain network, attribute data for a user profile; creating blockchain transactions to store attribute hashes and metadata to a shared ledger; receiving a user profile query from an identity consumer; creating blockchain transactions to retrieve attribute hashes and metadata corresponding to the query; reconstructing the user profile from the metadata; responding to the query by providing attribute data to the identity consumer; and creating and storing hashes of the attribute data and metadata to the shared ledger.

9 . The method of claim 8 , wherein the metadata comprises storage locations for storing the attribute data in external stores outside the blockchain network.

10 . The method of claim 9 , wherein reconstructing the user profile from the metadata comprising:
retrieving attribute data corresponding to the user profile from the storage locations; and validating attribute data with the attribute hashes.

11 . The method of claim 10 , wherein the stored ledger comprises a logical view of the user profile, wherein a smart contract or chaincode of the blockchain network manages the logical view through one or more application programming interfaces.

12 . The method of claim 11 , wherein the blockchain node or peer modifies metadata in the shared ledger through one or more application programming interface calls to the smart contract or chaincode.

13 . The method of claim 9 , wherein in response to receiving attribute data for the user profile, the method further comprising:
approving the inclusion of the attribute data to the user profile, based on user policies; and selecting an external store to obtain the attribute data from.

14 . The method of claim 8 , further comprising:
receiving a risk evaluation request from the identity consumer; approving the identity consumer to query the user profile; querying the user profile; determining a risk score for a user corresponding to the user profile; and providing the risk score to the identity consumer.

15 . A non-transitory computer readable medium comprising instructions, that when read by a processor, cause the processor to perform:
receiving, by a blockchain node or peer of a blockchain network, attribute data for a user profile; creating blockchain transactions to store attribute hashes and metadata to a shared ledger; receiving a user profile query from an identity consumer; creating blockchain transactions to retrieve attribute hashes and metadata corresponding to the query; reconstructing the user profile from the metadata; responding to the query by providing attribute data to the identity consumer; and creating and storing hashes of the attribute data and metadata to the shared ledger.

16 . The non-transitory computer readable medium of claim 15 , wherein the metadata comprises storage locations for storing the attribute data in external stores outside the blockchain network, wherein reconstructing the user profile from the metadata comprising:
retrieving attribute data corresponding to the user profile from the storage locations; and
validating attribute data with the attribute hashes.

17 . The non-transitory computer readable medium of claim 16 , wherein the stored ledger comprises a logical view of the user profile, wherein a smart contract or chaincode of the blockchain network manages the logical view through one or more application programming interfaces.

18 . The non-transitory computer readable medium of claim 17 , wherein the blockchain node or peer modifies metadata in the shared ledger through one or more application programming interface calls to the smart contract or chaincode.

19 . The non-transitory computer readable medium of claim 16 , wherein in response to receiving attribute data for the user profile, further causing the processor to perform:
approving the inclusion of the attribute data to the user profile, based on user policies; and selecting an external store to obtain the attribute data from.

20 . The non-transitory computer readable medium of claim 15 , further causing the processor to perform:
receiving a risk evaluation request from the identity consumer; approving the identity consumer to query the user profile; querying the user profile; determining a risk score for a user corresponding to the user profile; and providing the risk score to the identity consumer.

Assignees

• IBM

Inventors

• Singh Kapil Kumar
• Chari Suresh N
• Kundu Ashish
• Muppidi Sridhar
• Su Dong

Classifications

• H04L9/50

  using hash chains, e.g. blockchains or hash trees · CPC title

• G06F21/6236

  between heterogeneous systems · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/102 Primary

  Entity profiles · CPC title

• H04L63/123

  received data contents, e.g. message integrity · CPC title