自主式數位身分設計

Autonomous Digital Identity Design

姜博允(Po-Yun Chiang)

指導教授 ： 薛智文

國立臺灣大學/電機資訊學院/資訊工程學研究所/碩士(2018年)

https://doi.org/10.6342/NTU201803238

摘要

現今我們能在社群網站上以若干個可被識別的數位身分與他人交
流，然而在網路上的身分經常是碎片化且無法被追蹤的。甚者，由於身
分提供者的使用者定型化契約，使得身分及資料所有權可能並非個人所
有。時至今日，人們在網路上仍未擁有一個全球通用且跨平台的身分。
因此我們分析、組合並把數位身分整合成了一個服務，在基於一個連結
了各式各樣身分的自主式身分之上，來建立一個跨平台的自主式數位身
分系統，成為了提供身分服務的角色，且樹立了身分的三個原則──自
主性、可控制性與可攜性。再者，藉由導入智能合約，便能把個人的身
分認證狀態轉移到區塊鏈上，進而透過區塊鏈提供的信任基礎來防止任
何人去竄改個人的身分。此外還能藉由不同身分的組合來擴展身分系統
的功能，並提供第三方串接應用程式介面來處理身分的識別、驗證與授
權。在這之中，最重要的價值在於單一個體的身分便能在不同的平台間
做轉移。因此，該身分系統透過與其合作夥伴們的互動後，便形成了一
個永續的身分生態系。

關鍵字

數位身分 ； 身分自主 ； 身份驗證 ； 社群網路 ； 區塊鏈

並列摘要

Nowadays, we can interact with others as a recognizable identity on the social net-working sites. But our roles on the network are usually fragmented and untraceable. Moreover, the ownership of digital identity and personal data from an identity provider may not be truly ours because of the contracts of adhesion. We have not possessed a universal and cross-platform digital identity on the global network. As a result, we analyze, combine and integrate digital identities as a service. We build on Autonomous Digital Identity system which is platform-independent, based on Autonomous Identity which is integrated with various identities. It ensures three principles of identity, which are autonomy, controllability, and portability. Furthermore, we can transfer the authen-tication status of one’s digital identities to the blockchain by calling smart contracts. Therefore, it guarantees that nobody will have the opportunity to falsify the represen-tative of an individual. Besides, we combine the various types of digital identities to extend the functionality of our system, and we also provide API to handle access control, namely, identification, authentication, validation and authorization of identity. Most importantly, the representative of an entity can be seamlessly transferred to the third-party. Therefore, sustainable ecosystem of identity is constituted by the interac-tions among its cooperative partners.

並列關鍵字

digital identity ； autonomous identity ； authentication ； social network ； blockchain

參考文獻

[1] ISO/IEC 24760-1:2011. Information technology – security techniques – a frame- work for identity management – part 1: Terminology and concepts. Standard, International Organization for Standardization, Geneva, CH, December 2011.

[2] Statista. Most famous social network sites worldwide as of april 2018. https://www.statista.com/statistics/272014/global-social-networks-ranked-by-number-of-users/, 2018. [Online; accessed 13-July-2018].

[3] European Parliament and Council of the European Union. General data protec- tion regulation (gdpr) final text neatly arranged. https://gdpr-info.eu/, 2018. [Online; accessed 13-July-2018].

[4] Jan De Clercq. Single sign-on architectures. Proceedings of Infrastructure Secu- rity: International Conference InfraSec 2002, pages 40–58, 2002.

[5] Yuxuan Lin. The design and implementation of autonomous identity for socialnetwork. Master’s thesis, National Taiwan University, July 2014.