Distributed identity endogenous security management method based on multilayer architecture and application thereof

Abstract

The invention belongs to the technical field of wireless communication, and particularly relates to a distributed identity endogenous security management method based on a multilayer architecture and application thereof, and the method comprises the following steps: respectively obtaining certificates of a user network and hardware, and respectively calculating abstracts of the network and the hardware based on the obtained certificates by using an SHA-256 algorithm; after the abstracts of the network and the hardware are subjected to XOR entanglement, salt splicing, Hash mapping and modular operation are sequentially adopted for processing, and an identity private key is generated; based on an elliptic curve algorithm, taking the generated identity private key as a scalar, and performing scalar multiplication with the base point to generate an identity public key; the public key and the network characteristic factor are subjected to secondary cascade hash to serve as specific content of the identifier, and a decentralized identifier DID is obtained; and packaging the identity information in the JSON format, declaring that the generation of the identity is bound with the IMSI, and jointly outputting the decentralization information and the identity information as the identity information of the user. According to the invention, the whole-network uniqueness of the identity of the mobile communication entity is realized.

Description

Technical Field

[0001] This invention belongs to the field of wireless communication technology, and in particular relates to a distributed identity intrinsic security management method based on a multi-layer architecture and its application. Background Technology

[0002] Public Land Mobile Networks (PLMNs) have undergone a significant transformation over the past few decades, evolving from closed, monolithic systems to open, distributed, and interconnected systems. This evolution has introduced numerous participants and stakeholders, such as spectrum traders, wired and satellite service providers, and a vast number of IoT devices. With the advent of 6G networks, network topologies are becoming increasingly heterogeneous, requiring each network entity to have highly secure authentication and authorization interfaces.

[0003] Traditional identity management primarily relies on centralized public key infrastructure (PKI / CA). While technically mature, centralized architectures often become bottlenecks when facing cross-domain interoperability requirements, national data protection regulations, or geopolitical strategic isolation. Furthermore, centralized databases pose a single point of failure risk and struggle to achieve efficient access control while protecting user privacy (such as anonymity).

[0004] Currently, technologies such as Decentralized Identifiers (DID) and Self-Sovereign Identity (SSI) offer new solutions to the aforementioned problems, bringing advantages such as autonomous and controllable identity, tamper-proof nature, and cross-domain applicability. However, existing decentralized identity technologies still have the following significant drawbacks in practical applications:

[0005] 1. Lack of deep integration with the underlying communication architecture: Most existing DID solutions run as "over-the-top" applications at the application layer, failing to be intrinsically adapted to the access layer and core network protocols of mobile communication networks (such as the 3GPP standard architecture). This results in low efficiency in the transmission and verification of identity data, making it difficult to support carrier-grade low-latency services.

[0006] 2. Decoupling of Identity Generation Mechanism from Physical Carrier: Current DID generation typically relies on software algorithms to generate public-private key pairs, lacking a strong binding mechanism with the terminal's physical characteristics (such as SIM card IMSI and device IMEI). Once the file storing the private key is copied or stolen, attackers can easily forge identities, lacking integrated "human-machine-card" anti-cloning capabilities.

[0007] 3. Lack of Dynamic and Quantitative Security Auditing Methods: This is the biggest challenge facing current technologies. Current identity verification mechanisms typically use a binary "black and white" approach, lacking a method for continuous, dynamic, and quantitative assessment of identity security. The system cannot calculate refined security scores based on ledger consensus depth (credibility of evidence storage) or users' historical behavior. This results in the system's inability to provide tiered warnings and differentiated blocking when facing attacks based on "abnormal behavior" or "zombie accounts" after private key leaks, making it difficult to meet the auditing and regulatory needs of high-security scenarios. Summary of the Invention

[0008] To address the single point of failure risks, privacy leaks, and limited cross-domain interoperability inherent in the heavy reliance of identity management in existing mobile communication networks (5G / 6G) on centralized core network databases; and considering that most current mainstream decentralized digital identity technologies are independent of underlying communication protocols and lack deep integration and intrinsic adaptation with mobile communication network architectures (such as 3GPP standards), this invention proposes a multi-layered architecture-based distributed intrinsic security management method for identity, specifically including the following steps:

[0009] Obtain the user's network and hardware credentials separately, and use the SHA-256 algorithm to calculate the digests of the network and hardware based on the obtained credentials;

[0010] After the digests of the network and hardware are XORed and entangled, they are processed sequentially by salting and concatenating, hash mapping and modulo operation to generate the identity private key;

[0011] Based on the elliptic curve algorithm, the generated private key is used as a scalar, and a scalar multiplication operation is performed with the base point to generate the public key.

[0012] Using did:imsi: as the standard prefix, the public key and network feature factor are used to perform a second concatenated hash to obtain the specific content of the identifier, thus obtaining the decentralized identifier DID;

[0013] Encapsulate identity information in JSON format, declare that the generation of this identity is bound to IMSI, and output the decentralized and identity information together as the user's identity information.

[0014] This invention also proposes an application of a distributed identity intrinsic security management method based on a multi-layer architecture. The method is characterized by determining whether an identity is abnormal after it has been uploaded to the blockchain using this multi-layer architecture-based distributed identity intrinsic security management method. This determination specifically includes the following steps:

[0015] Receive the block height where the target decentralized identity is located on the blockchain, the latest block height of the entire network, and the number of active consensus nodes in the network. Calculate the ledger consensus tamper resistance score based on the extracted data.

[0016] Extract the set of historical interaction records for this identity within the time window W. The i-th historical interaction record Includes: the timestamp of the i-th historical interaction record The coordinates of the access source of the i-th historical interaction record. The operation result status of the i-th historical interaction record is used to calculate the dynamic behavior confidence score based on the extracted data;

[0017] A quantitative security index is calculated based on the ledger consensus anti-tampering score and dynamic behavior confidence score. The current identity is then judged to be abnormal based on the range of the quantitative security index.

[0018] This invention also proposes an application of a distributed identity intrinsic security management method based on a multi-layer architecture. The method is characterized by determining whether the decentralized identity generated by this method is anomaly-free after it has been uploaded to the blockchain. This determination includes the following steps:

[0019] Receive the block height where the target decentralized identity is located on the blockchain, the latest block height of the entire network, and the number of active consensus nodes in the network. Calculate the ledger consensus tamper resistance score based on the extracted data.

[0020] Extract the set of historical interaction records for this identity within the time window W. The i-th historical interaction record Includes: the timestamp of the i-th historical interaction record The coordinates of the access source of the i-th historical interaction record. The operation result status of the i-th historical interaction record is used to calculate the dynamic behavior confidence score based on the extracted data;

[0021] A quantitative security index is calculated based on the ledger consensus anti-tampering score and dynamic behavior confidence score. The current identity is then judged to be abnormal based on the range of the quantitative security index.

[0022] This invention is based on the deep integration of blockchain and mobile communication network protocols, and has the following advantages compared with existing technologies:

[0023] 1. This invention supports mobile communication network entities as identity consensus nodes to participate in blockchain consensus, realizing the network-wide uniqueness and intrinsic consensus of mobile communication entity identities, promoting the deep integration of communication networks and blockchain technology, and providing a new solution with intrinsic security for cross-domain trust mechanisms.

[0024] 2. This invention constructs a closed-loop decentralized identity management lifecycle solution through the collaboration of five stages: adaptation and deployment, identity generation, identity authentication, identity authorization, and identity auditing. This enables users to efficiently manage their own identities and ensures that personal privacy is not violated at different stages through cryptographic mechanisms.

[0025] 3. Since the identity management of this invention does not rely on a centralized core network institution, it effectively avoids the impact of single point of failure on the overall network authentication function, significantly enhances the recoverability of mobile communication networks in complex environments, significantly reduces the risk of systemic centralization, and enhances network robustness.

[0026] 4. This invention records all identity management behaviors through an identity chain, achieving full on-chain traceability of all behaviors. In particular, as the number of consensus nodes increases, the computing power cost required for illegal attackers to tamper with identity documents increases. This not only improves the transparency of identity management but also provides quantitative theoretical support for security auditing, establishing high-confidence security audit indicators and exponential anti-tampering capabilities.

[0027] 5. This invention innovatively introduces a "hardware-network dual anchor point" mechanism in the identity initialization algorithm. Through the algorithm, the IMSI (SIM card) and IMEI (terminal hardware) are mathematically entangled, so that the generation of digital identity no longer depends solely on the SIM card. Even if an attacker steals the user's SIM card and inserts it into an illegal terminal, the legitimate decentralized identity (DID) cannot be restored due to the lack of the original terminal's hardware fingerprint parameters. This eliminates the risk of identity theft caused by SIM card theft from the root, giving this invention hardware-level security features against cloning. Attached Figure Description

[0028] Figure 1 This is a schematic diagram of the architecture and process of the autonomous identity management system of the present invention;

[0029] Figure 2 This is a schematic diagram illustrating the complete lifecycle process of the autonomous identity management system of this invention;

[0030] Figure 3 This is a schematic diagram of the process for generating an identity identifier in an embodiment of the present invention;

[0031] Figure 4 This is a schematic diagram of the identity authentication process in an embodiment of the present invention;

[0032] Figure 5 This is a schematic diagram of the identity authorization process in an embodiment of the present invention;

[0033] Figure 6 This is a preliminary architecture diagram of a mobile communication network in an embodiment of the present invention. Detailed Implementation

[0034] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0035] This invention proposes a distributed identity intrinsic security management method based on a multi-layer architecture, which specifically includes the following steps:

[0036] Obtain the user's network and hardware credentials separately, and use the SHA-256 algorithm to calculate the digests of the network and hardware based on the obtained credentials;

[0037] After the digests of the network and hardware are XORed and entangled, they are processed sequentially by salting and concatenating, hash mapping and modulo operation to generate the identity private key;

[0038] Based on the elliptic curve algorithm, the generated private key is used as a scalar, and a scalar multiplication operation is performed with the base point to generate the public key.

[0039] Using did:imsi: as the standard prefix, the public key and network feature factor are used to perform a second concatenated hash to obtain the specific content of the identifier, thus obtaining the decentralized identifier DID;

[0040] Encapsulate identity information in JSON format, declare that the generation of this identity is bound to IMSI, and output the decentralized and identity information together as the user's identity information.

[0041] To facilitate understanding of the methods provided in the embodiments of this application, the terms involved in this application are explained as follows:

[0042] 1. Decentralized Unique Identifier (DID) is a new type of globally unique identifier built upon asymmetric encryption technology and adhering to the World Wide Web Consortium standard. Technically, it is a Uniform Resource Identifier (URI) that can be parsed into a decentralized document. This identifier eliminates the reliance on centralized identity providers or registration authorities in traditional architectures, allowing entities to autonomously generate and manage identity credentials without third-party authorization. Through the public key information defined in the associated decentralized document and the verification service endpoint, this identifier allows users to have complete autonomy over their identities across technical fields and administrative domains. Furthermore, the cryptographic evidence-based verification mechanism gives this identifier strong tamper resistance and supports flexible upgrades to the associated document without changing the identifier's core, thus meeting the needs of smooth identity evolution in complex application scenarios.

[0043] 2. Mobile communication network entities refer to the physical hardware devices or logical functional components that undertake data processing, signaling control, protocol conversion, and multimedia service transmission functions in a mobile communication system. Spatially, these entities encompass various communication terminals and IoT sensing devices on the user side, base station facilities, radio access network controllers, and relay forwarding nodes on the access side, and various functional network elements on the core network side responsible for access management, authentication, subscription data storage, policy control, and user plane forwarding. Under the intrinsic identity security architecture, these legitimate network entities not only execute standard communication protocol stack processes but also become participants in the identity management system by integrating distributed computing capabilities. As verification nodes or consensus nodes of the distributed ledger, they jointly perform on-chain verification of identity data and ledger synchronization, ensuring the consistency of the network's identity status across time and space.

[0044] 3. Blockchain is a decentralized distributed ledger implemented using a chain-like data structure, consensus mechanism, and cryptographic algorithms. It is specifically designed for persistently recording and managing metadata, verifiable credentials, and the change history of all identity states for decentralized identifiers. It encapsulates each transaction involving identity registration, attribute updates, or credential revocation in a timestamped block using a hash algorithm, forming an irreversible logical chain through forward and backward hash links. This underlying architecture ensures the immutability of identity documents and their associated data after generation. As a consistent source of truth for identity resolution in cross-domain scenarios, blockchain eliminates the dependence on a single trust center, allowing any legitimate entity in the network to trace the initial origin and historical change details of a specific identity by querying the globally consensus-based ledger records, thereby establishing a highly reliable and transparent trust system across heterogeneous network environments.

[0045] This invention provides a distributed identity intrinsic security management method based on a multi-layer architecture. This method constructs a carrier-grade adapted four-layer converged system architecture, embedding distributed identity governance logic into the communication protocol stack to achieve full lifecycle management of identities, and combines this with a quantitative evaluation algorithm to achieve intrinsic security performance gains. The key points of the invention are as follows:

[0046] I. The four-layer integrated system architecture and process of autonomous identity: "entity-network-identity-service".

[0047] like Figure 1 A four-layer system logical architecture for deep integration with communication networks is constructed as a spatial execution environment for distributed identity management, wherein:

[0048] Entity Layer: As the lowest layer and interaction interface of the system, the core function of the entity layer is to provide standardized access capabilities for various physical entities such as mobile terminals, service provision nodes, and infrastructure. This layer utilizes the U-DID initialization algorithm to capture the original physical characteristics or protocol credentials of entities in real time during the initial stage of network access, and generates globally unique decentralized identifiers through local secure and efficient computation methods. This process establishes the underlying mapping relationship between physical entities and digital identities, providing trusted original credential support for subsequent identity governance.

[0049] Specifically, in this embodiment, the entity layer serves as the physical interaction interface of the system, encompassing physical entities such as mobile terminals (UEs), IoT sensors, base stations, and core network elements. The entity layer deploys a U-DID initialization module responsible for collecting the entity's network credentials (such as IMSI) and hardware credentials (such as IMEI and UUID), and performing localized key generation operations.

[0050] Network Layer: The network layer plays a fundamental role in ensuring connectivity within the architecture. It aims to connect heterogeneous communication networks across multiple scenarios and entities by establishing distributed routing and broadcast mechanisms. This layer adapts to complex and heterogeneous communication environments, ensuring that identity transactions and signaling based on decentralized identifiers (DIDs) can overcome the limitations of physical links and management domains, achieving highly reliable transmission and accurate delivery. By addressing the barriers to the flow of decentralized identity information at the network level, this layer provides a robust communication foundation for cross-domain trust mechanisms across the entire network.

[0051] Specifically, in this embodiment, the network layer is based on the 3GPP standard mobile communication network (5G / 6G) and is responsible for signaling transmission and data routing. In this layer, core network elements (such as AMF and AUSF) not only undertake traditional access authentication functions, but also integrate blockchain light node functions, responsible for forwarding the hash digest of identity data to the identity layer, realizing the endogenous integration of communication protocols and identity protocols.

[0052] Identity Layer: The identity layer is responsible for the core logic processing of distributed identity management. Through the integration of a distributed ledger consensus approval mechanism, it achieves full lifecycle management of decentralized identifiers and their associated documents (DID Documents). This layer ensures consistency across all network nodes for all identity state changes, registrations, and deregistrations via consensus algorithms, maintaining the uniqueness and tamper-proof nature of digital identities in the spatiotemporal dimensions. As the source of consistent truth for the system, the identity layer eliminates dependence on a centralized database, architecturally guaranteeing autonomous control of identity sovereignty.

[0053] Specifically, in this embodiment, the identity layer consists of a consortium blockchain network composed of several consensus nodes, responsible for maintaining the distributed ledger. Its main functions include storing DID documents, hash fingerprints of verifiable credentials (VCs), and state change records. This layer ensures the spatiotemporal consistency and immutability of identity data across the entire network through a consensus mechanism.

[0054] Service Layer: As the high-level support logic for applications, the service layer primarily uses Verifiable Credentials (VC) technology to implement secure service authorization and permission negotiation between entities. This layer supports entities in generating credentials with specific templates based on business needs, enabling trusted cross-domain interactions while protecting privacy. Simultaneously, the service layer automatically records the entire process of all authorization and interaction behaviors and leverages the mathematical properties of hash chains to provide a transparent and tamper-proof audit path, thereby providing upper-layer applications with quantifiable and assessable security traceability capabilities.

[0055] Specifically, in this embodiment, the service layer is geared towards specific business applications, and based on the trusted data provided by the identity layer, fine-grained authorization management and audit traceability are achieved.

[0056] like Figure 1 In this invention, a decentralized unique identity is generated at the entity layer based on the end user's hardware credentials and network credentials. The generated decentralized unique identity is encapsulated as DID characters and DID documents and uploaded to the identity layer through the network layer for decentralized unique identity publicity and identity chain update (i.e., the self-generated identity generation process). Then, the decentralized unique identity is verified through the wireless access network (i.e., the distributed identity authentication process). Next, VC generation is performed at the service layer (i.e., the controlled identity authorization process based on verifiable credentials). Finally, behavior tracing is performed (i.e., the immutable audit process of the entire behavior chain record).

[0057] II. The complete lifecycle process of self-identity management.

[0058] In this embodiment, the complete lifecycle process of autonomous identity management is as follows: Figure 2 It consists of four parts, and the following embodiment will describe the process of each of the four parts in detail:

[0059] (1) The process of endogenous generation of autonomous identity:

[0060] like Figure 3 In this embodiment, the process of generating an endogenous autonomous identity is divided into the following steps:

[0061] 1. The AUSF network element generates an authentication vector and sends it to the AMF to start the access process;

[0062] 2. The AMF initiates an authentication request to the mobile user terminal;

[0063] 3. While calculating the response, the user terminal generates a decentralized identifier and identity document through an initialization algorithm;

[0064] 4. The user terminal encapsulates the authentication response and identity information, and returns them to the AMF via uplink signaling;

[0065] 5. AMF extracts identity information and transmits it to the blockchain network element for consensus processing and on-chain storage;

[0066] 6. AMF sends a response verification request to AUSF, simultaneously completing the traditional network access verification;

[0067] (2) Distributed identity authentication process:

[0068] like Figure 4 In this embodiment, the distributed identity authentication process consists of the following steps:

[0069] 1. The authenticator initiates an identity authentication request to the prover;

[0070] 2. The prover returns its decentralized, unique identifier to the certifier;

[0071] 3. The certifier retrieves and obtains the certifier's decentralized unique identity document by invoking a smart contract on the identity chain;

[0072] 4. The authenticator extracts the public key from the identity document. And send random challenge information to the prover;

[0073] 5. The prover uses their private key to sign the challenge and returns the result;

[0074] 6. The authenticator uses the extracted public key. Verify the signature; upon successful verification, the decentralized identity verification is complete.

[0075] (3) Controlled identity authorization process based on verifiable credentials:

[0076] like Figure 5 In this embodiment, the controlled identity authorization process based on verifiable credentials consists of the following steps:

[0077] 1. The authenticator initiates an identity authentication request to the prover;

[0078] 2. The prover returns its decentralized, unique identifier to the certifier;

[0079] 3. The certifier retrieves and obtains the certifier's decentralized unique identity document by invoking a smart contract on the identity chain;

[0080] 4. The authenticator extracts the public key from the identity document. And send random challenge information to the prover;

[0081] 5. The prover uses their private key to sign the challenge and returns the result;

[0082] 6. The certifier uses the extracted... Verify the signature; upon successful verification, the decentralized identity verification is complete.

[0083] (4) An immutable audit process with chain-recorded data throughout the entire process:

[0084] like Figure 6 In this embodiment, the tamper-proof auditing process for the entire chain of records is divided into the following steps:

[0085] 1. Audit Request Initiation: The supervisory node, carrying the decentralized identifier to be verified, initiates an identity behavior tracing request to the blockchain distributed ledger;

[0086] 2. Evidence Index Retrieval: Based on the received identifier, the distributed ledger quickly locates all transaction hashes and block index information associated with it in the consensus storage;

[0087] 3. Behavioral Trajectory Extraction: The system extracts original behavioral records such as registration, authentication, and authorization generated by the identity throughout its entire lifecycle in chronological order, and uses hash chains to verify the integrity of the data;

[0088] 4. Quantitative grading calculation: The system calls a quantitative security assessment algorithm to calculate indicators such as the reduction in the probability of identity forgery based on the scale of consensus nodes and the frequency of historical behavior, and determines its security level.

[0089] 5. Visualized Feedback: The system integrates audit results that include behavior timestamps, operation details, and quantified security levels, and provides real-time feedback to mobile terminals for intuitive display.

[0090] III. Decentralized Unique Identity Initialization and Generation Algorithm.

[0091] This embodiment proposes a deterministic identity generation algorithm executed on the mobile communication terminal side. Unlike traditional methods that rely solely on SIM card information, this algorithm introduces a "dual-anchor" mechanism, using mathematical methods to cryptographically entangle network identity credentials with the physical characteristics of the user terminal. This ensures that the generated digital identity has extremely high anti-cloning properties, achieving integrated binding of "card-device-person". The algorithm is defined as a mapping function from physical space to digital space, with its input set being mobile communication network parameters and physical identity identifiers, and its output set being decentralized identifiers conforming to W3C standards and their associated documents.

[0092] Traditional DID generation typically relies solely on the IMSI (SIM card), but this carries the risk of SIM card theft. The innovation of this invention lies in binding the user's digital identity not only to the SIM card (network credentials) but also forcibly binding it to the current mobile phone hardware (device fingerprint). The identity information generation process in this invention includes:

[0093] Step S1: Generate dual feature factors, i.e., extract digital digests of network credentials and hardware credentials using SHA-256, and normalize the physical identifier into a 256-bit mathematical vector:

[0094]

[0095]

[0096] in, Represents a digest of the user's network credentials; A summary representing the user's hardware credentials; This indicates a one-way cryptographic hash function with an output length of 256 bits; International Mobile Subscriber Identity (SIM card); It is the International Mobile Equipment Identity or the device hardware UUID.

[0097] Step S2: Private key synthesis based on XOR entanglement. This embodiment differs from traditional direct concatenation. This step utilizes the non-linear properties of XOR operations to perform bit-level entanglement between network features and hardware features, and introduces the hash value of the timestamp as a "dynamic salt" to generate the final identity private key. Specifically, it includes the following steps:

[0098]

[0099]

[0100] in, Represented as a dynamic salt value generated based on the Unix timestamp T at the time of the user's first registration, this dynamic salt value aims to introduce an entropy source in the time dimension to ensure the global uniqueness of identity credentials in both the spatial (device / network) and temporal dimensions; This represents the user's private key; Represents the XOR operation; This indicates a splicing operation; n represents the order of the secp256k1 curve; This indicates finding the remainder.

[0101] Step S3: Derive the secp256k1 identity public key using the standard parameters of the secp256k1 elliptic curve. As a scalar, and the base point Perform calculations to derive the public key. ,include:

[0102]

[0103] in, This represents the user's private key; For the standard base point generator of the secp256k1 elliptic curve; This represents scalar multiplication operations on elliptic curves.

[0104] Step S4: Construct a decentralized identifier (DID) containing network anchors. To reflect telecom-grade identity characteristics, this step uses `did:imsi:` as the standard prefix. The specific content of the identifier is generated by a secondary concatenated hash of the public key and network feature factors, i.e.:

[0105]

[0106] in, This represents the user's public key.

[0107] Step S5: Generate an Identity Document (DID Document), encapsulate the identity document in JSON format, and declare that the generation of this identity is bound to the IMSI. The identity document can be represented as:

[0108]

[0109] In this invention, decentralized identity documents The on-chain identity attributes of communication entities are defined in a structured manner, whereby... This represents a globally unique index of the identity in the distributed ledger; The field indicates that the authentication protocol is named Telecom-Secp256k1, which means that the identity uses the Secp256k1 elliptic curve algorithm suitable for telecommunications network environments to generate public keys. The field is assigned the value "self", clearly indicating that the document's management authority belongs to the entity itself, meaning the communication device independently controls the private key without relying on a centralized third party. This invention will output a tuple. As user identity information.

[0110] IV. Quantitative grading calculation and evaluation.

[0111] Upon receiving an audit request for a specific decentralized identity (DID), the following steps are performed:

[0112] Step S1: Audit object initialization and feature dataset construction:

[0113] The system receives the target identity identifier to be audited. Metadata from two dimensions—blockchain distributed ledger and business logs—is extracted to construct a feature dataset. :

[0114] 1. Ledger characteristic data, including target identity identifiers The corresponding DID document is located at the block height on the blockchain. The latest block height across the entire network and the current number of active consensus nodes on the network. ;

[0115] 2. Behavioral trajectory data, which is the set of historical interaction records of this identity within a time window W. m represents the number of historical interaction records within the time window W, and the i-th historical interaction record includes: the timestamp of the i-th historical interaction record. The coordinates of the access source of the i-th historical interaction record. (e.g., IP address or GPS location), and the status of the operation result (success or failure) of the i-th historical interaction record.

[0116] Step S2: Calculate the ledger consensus tamper resistance score:

[0117] This step aims to quantify the "credibility of evidence storage" of identity data, that is, whether the identity exists on a sufficiently secure, decentralized, and irreversible blockchain. Specifically, it includes the following steps:

[0118] S2-1: Calculate the confirmation depth confidence. First, calculate the block confirmation depth. Then, the probability of transaction immutability is calculated using an exponential convergence model:

[0119]

[0120] in, The probability that the transaction is immutable; This is the consensus convergence coefficient; for consortium blockchains, a larger value is taken. e is a natural number.

[0121] S2-2: Calculate the network's anti-collusion capability. This embodiment introduces a network saturation function. (i.e., hyperbolic tangent function), based on the number of active nodes Calculate network size scores to prevent fraud by a single node, including:

[0122]

[0123] in, K represents the network's resistance to collusion; K is the network size saturation constant (for example, K=100, which means that when the number of active nodes reaches more than 100, the degree of decentralization tends to saturate, and the score approaches 1, that is, the closer the degree of decentralization is to saturation, the closer its value is to 1).

[0124] S2-3: The total security score of the ledger is expressed as follows:

[0125]

[0126] in, The score for the ledger consensus's resistance to tampering.

[0127] Step S3: Calculate the confidence score for dynamic behavior:

[0128] This step constitutes the core risk control layer. It involves analyzing historical interaction records to identify "spatiotemporal anomalies" and "frequency anomalies," and calculating a credit score based on a time decay model. Specifically, it includes the following steps:

[0129] S3-1: Define the time decay weight. This embodiment uses an exponential decay model to ensure that recent behavior has the highest weight. Let the current time be... The timestamp of the i-th historical interaction record Then we have:

[0130]

[0131] in, τ is the time decay weight of the i-th transaction record; τ is the memory half-life constant, which is set to 30 in this embodiment. This formula ensures that the influence of behavior before the half-life on the current reputation is halved.

[0132] S3-2: Calculate the multidimensional anomaly penalty factor. This is done by traversing interaction record A and calculating the spatiotemporal anomaly coefficient and the frequency anomaly coefficient. The spatiotemporal anomaly coefficient is calculated by detecting whether there is a physically unreachable phenomenon between two adjacent interactions.

[0133]

[0134] in, For spatiotemporal anomaly coefficients; This indicates finding the larger value; This indicates finding the distance between two locations; The maximum physical movement speed can be set, for example, it can be set to... .

[0135] The frequency anomaly coefficient is achieved by detecting brute-force attempts or script attacks within a short period of time, namely:

[0136]

[0137] in, For frequency anomaly coefficients; This represents the number of consecutive failures within the most recent time window W. The permissible trial-and-error threshold is set to [value] in this embodiment. .

[0138] S3-3: Combine the weighted success rate and the anomaly penalty item to calculate the total confidence score for the behavior, i.e.:

[0139]

[0140] in, Confidence score for dynamic behavior; This is an indicator function; it is 1 if the i-th interaction is successful, and 0 otherwise. The spatial anomaly sensitivity coefficient is set to 0.001 in this embodiment; The frequency abnormality sensitivity coefficient is set to 0.5 in this embodiment.

[0141] normal users Approaching 1; once "teleportation from another location" or "brute force attack" occurs, The exponential penalty term will cause the score to drop sharply to 0, achieving real-time blocking.

[0142] Step S4: Two-dimensional feature fusion and security index quantification.

[0143] A weighted geometric mean model is used to fuse static ledger scores and dynamic behavior scores to generate a final quantitative security index, namely:

[0144]

[0145] in, To quantify the safety index; An index factor for the ledger consensus's tamper resistance score; It is an exponential factor for the confidence score of dynamic behavior, and This embodiment sets , .

[0146] Step S5: Graded judgment and audit strategy output, i.e., the system outputs the quantified security index. The value maps the request to three risk levels and executes the corresponding strategy:

[0147] Level 1: Core Trust Level, at this stage The identity is securely stored on the blockchain, and recent behavior is completely consistent with historical habits, with no abnormal characteristics. The strategy adopted at this time is to automatically allow passage and cache its trust certificate locally (TTL=1 hour) to reduce redundant calculations.

[0148] Level 2: Standard warning level, at this time 0.9 > 0.7. There is a slight risk to the identity, such as: logging in from a new device, operating across cities (but at a reasonable speed), or having a small number of on-chain nodes; in this case, the strategy is to trigger secondary verification, that is, to trigger signature interaction verification, and if the verification is successful, the process is allowed.

[0149] Level 3: High-risk blocking level, i.e., 0.7 > If a serious risk is detected, such as sudden login from a different location or signs of brute-force attack, the strategy is to immediately reject the request and freeze the account, add the DID to the "grey list," and force all requests to undergo the highest level of manual review within the next 24 hours.

[0150] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A distributed identity intrinsic security management method based on a multi-layer architecture, characterized in that, Specifically, the following steps are included: Obtain the user's network and hardware credentials separately, and use the SHA-256 algorithm to calculate the digests of the network and hardware based on the obtained credentials; After the digests of the network and hardware are XORed and entangled, they are processed sequentially by salting and concatenating, hash mapping and modulo operation to generate the identity private key; Based on the elliptic curve algorithm, the generated private key is used as a scalar, and a scalar multiplication operation is performed with the base point to generate the public key. Using did:imsi: as the standard prefix, the public key and network feature factor are used to perform a second concatenated hash to obtain the specific content of the identifier, thus obtaining the decentralized identifier DID; Encapsulate identity information in JSON format, declare that the generation of this identity is bound to IMSI, and output a tuple. As user identity information.

2. The distributed identity intrinsic security management method based on a multi-layer architecture according to claim 1, characterized in that, Generating a private key specifically includes the following steps: Introducing timestamp factor The hash value is used as a dynamic salt, that is: ； The identity private key is represented as: ； in, Represented as a dynamic salt value generated based on the Unix timestamp T of the user's initial registration time; This indicates a one-way cryptographic hash function with an output length of 256 bits; This represents the user's private key; Represents a digest of the user's network credentials; A summary representing the user's hardware credentials; Represents the XOR operation; This indicates a splicing operation; n represents the order of the secp256k1 curve; This indicates finding the remainder.

3. A distributed identity intrinsic security management method based on a multi-layer architecture as described in claim 1 or 2, characterized in that, ； in, This represents the user's public key; This represents the user's private key; For the standard base point generator of the secp256k1 elliptic curve; This represents scalar multiplication operations on elliptic curves.

4. The distributed identity intrinsic security management method based on a multi-layer architecture according to claim 1, characterized in that, The decentralized identifier DID is represented as: ； in, This indicates a one-way cryptographic hash function with an output length of 256 bits; This represents the user's public key; Indicates a splicing operation; This represents a summary of the user's network credentials.

5. An application of a distributed identity intrinsic security management method based on a multi-layer architecture, characterized in that, After uploading the decentralized identity generated by the distributed identity intrinsic security management method based on a multi-layer architecture according to any one of claims 1 to 4 to the blockchain, it is determined whether the identity is abnormal, specifically including the following steps: Receive the block height where the target decentralized identity is located on the blockchain, the latest block height of the entire network, and the number of active consensus nodes in the network. Calculate the ledger consensus tamper resistance score based on the extracted data. Extract the set of historical interaction records for this identity within the time window W. The i-th historical interaction record Includes: the timestamp of the i-th historical interaction record The coordinates of the access source of the i-th historical interaction record. The operation result status of the i-th historical interaction record is used to calculate the dynamic behavior confidence score based on the extracted data; A quantitative security index is calculated based on the ledger consensus anti-tampering score and dynamic behavior confidence score. The current identity is then judged to be abnormal based on the range of the quantitative security index.

6. The application of the distributed identity intrinsic security management method based on a multi-layer architecture as described in claim 5, characterized in that, Ledger consensus anti-tampering score Represented as: ； ； ； in, The tamper resistance score for the ledger consensus; The probability that the transaction is immutable; Let z be the consensus convergence coefficient; z is the block depth of the block where the target decentralized identity is located, denoted as... , This is the latest block height across the entire network. The block height at which the target decentralized identity is recorded on the blockchain; To enhance network anti-collusion capabilities; K represents the current number of active consensus nodes in the network; K is the network size saturation constant.

7. The application of the distributed identity intrinsic security management method based on a multi-layer architecture as described in claim 5, characterized in that, Dynamic behavior confidence score Represented as: ； ； ； ； in, Confidence score for dynamic behavior; The time decay weight for the i-th transaction record. Let m be the timestamp of the i-th transaction record, m be the number of transactions within the time window, and τ be the memory half-life constant. The current time; For spatiotemporal anomaly coefficients, Let the coordinates be the access source coordinates for the i-th transaction record; Maximum physical movement speed; For frequency anomaly coefficients; This represents the number of consecutive failures within the most recent time window W. The allowed trial-and-error threshold; This is an indicator function; it is 1 if the i-th interaction is successful, and 0 otherwise. This is the spatial anomaly sensitivity coefficient; This is the frequency anomaly sensitivity coefficient.

8. The application of the distributed identity intrinsic security management method based on a multi-layer architecture as described in claim 5, characterized in that, The calculation of the quantitative security index includes: ； in, To quantify the safety index; The tamper resistance score for the ledger consensus An index factor for the ledger consensus's tamper resistance score; The confidence score for dynamic behavior. It is an exponential factor for the confidence score of dynamic behavior, and .

9. The application of the distributed identity intrinsic security management method based on a multi-layer architecture as described in claim 5, characterized in that, Determining whether the current identity is abnormal based on the range of the quantitative security index includes: When the quantitative security index is greater than or equal to 0.9, the current identity is automatically allowed to pass and its trust credentials are cached locally to reduce redundant calculations; When the quantitative security index is less than 0.9 but greater than or equal to 0.7, signature interaction verification is triggered, and if the verification passes, the process is allowed. When the quantitative security index is less than 0.7, the request will be immediately rejected and the account will be frozen. The DID will also be added to the gray list, meaning that all requests from the DID will be subject to the highest level of manual review within the next 24 hours.

Images