Method, system and device for realizing blockchain verifiable credential application based on security endogenous commercial cryptographic technology, processor and medium

Abstract

The application relates to a method for realizing blockchain verifiable certificate application based on a safe endogenous commercial cipher technology, and the method comprises the following steps: initiating a blockchain digital identity (DID) application request, generating a user SM2 public and private key pair by a commercial cipher (KMS) and hosting the private key after identity verification, and completing DID registration; initiating a VC application request, signing a one-time JWT authorization certificate by the commercial cipher (KMS) through an agency-level SM2 key pair, carrying out business circulation and auditing, performing user private key proxy signature and agency private key signature based on the JWT authorization, and uploading an SM3 hash value of a VC document to a blockchain system to complete trusted storage. The method, system, device, processor and computer readable storage medium thereof based on the safe endogenous commercial cipher technology realize user experience optimization, system iteration flexibility, great improvement of system iteration efficiency, better signature and verification performance, and controllable identity credibility.

Description

Technical Field

[0001] This invention relates to the fields of blockchain and secure intrinsic commercial cryptography, particularly to the field of digital identity authentication. Specifically, it relates to a method, system, device, processor, and computer-readable storage medium for applying for blockchain-verifiable credentials based on secure intrinsic commercial cryptography. Background Technology

[0002] With the development of the digital economy, decentralized identity (hereinafter referred to as "DID") and verifiable credentials (hereinafter referred to as "VC"), as the core components of the blockchain digital identity system, have solved the problems of privacy leakage, centralized permissions, and poor interoperability in traditional centralized identity authentication, and have been widely used in government services, financial transactions, enterprise collaboration and other fields.

[0003] Commercial cryptography (hereinafter referred to as "commercial cryptography") serves as a core support for information security in my country. Based on the Cryptography Law of the People's Republic of China and related regulations, it utilizes national cryptographic algorithms such as SM2, SM3, and SM4 to achieve functions like data encryption, digital signatures, and hash verification, effectively ensuring the security and compliance of data transmission and storage. Currently, the application process for blockchain DIDs and VCs often employs internationally recognized encryption algorithms (such as RSA and SHA-256), which suffer from insufficient independent control over the algorithms, non-compliance with my country's commercial cryptography compliance requirements, and vulnerability to the cracking and leakage of sensitive identity data. Furthermore, existing blockchain digital identity systems lack commercial cryptographic hardware-level support for the identity verification process during DID registration and VC issuance, resulting in insufficient key storage security and further reducing the credibility of DIDs and VCs. In addition, most digital identity systems adopt a self-hosted private key model on the client side, relying on the client cryptography SDK to complete the key generation and signing of DID / VC, which has the following four problems: 1) The SDK integration is heavy (5-6M) and the vendor does not maintain it; 2) It is difficult to back up and retrieve user private keys, and asset security is not guaranteed; 3) App release depends on the SDK, and the system iteration flexibility is low; 4) It is difficult to achieve compliant and unified management of client-side signatures.

[0004] Therefore, there is an urgent need for a technical solution that deeply embeds commercial cryptographic algorithms into the entire process of blockchain DID and VC application to achieve compliant identity authentication, standardized key management, and take into account both autonomy and controllability as well as practicality. Summary of the Invention

[0005] The purpose of this invention is to overcome the shortcomings of the prior art and provide a method, system, device, processor and computer-readable storage medium for applying for blockchain verifiable credentials based on secure endogenous commercial cryptography technology, which meets the requirements of security, compliance, independent controllability and wide applicability.

[0006] To achieve the above objectives, the present invention provides a method, system, apparatus, processor, and computer-readable storage medium for applying for blockchain verifiable credentials based on secure endogenous commercial cryptography technology, as follows: The method for applying for verifiable credentials on the blockchain based on secure intrinsic commercial cryptography is characterized by the following steps: (1) Initiate a blockchain digital identity (DID) application request. After identity verification, the commercial cryptography KMS generates the user's SM2 public and private key pair and manages the private key. The public key is then encapsulated in the DID document and uploaded to the blockchain system to complete the DID registration. (2) Initiate a VC application request, apply for authorization from the commercial cryptography KMS through strong authentication, the commercial cryptography KMS signs the document with the institutional-grade SM2 key pair, generates a one-time JWT authorization certificate, conducts business flow and review, the commercial cryptography KMS performs user private key signing and institutional private key signing based on the JWT authorization, generates a complete VC document, uploads the SM3 hash value of the VC document to the blockchain system to complete trusted storage, and returns the VC application result to the user.

[0007] Preferably, step (1) specifically includes the following steps: (1.1) To verify identity, the user front-end initiates a DID application request, and the business back-end calls the unified authentication service of the certificate to complete the verification of the user's face and identity information. After the verification is successful, the user's unique identifier UserOneId is obtained. (1.2) To generate a key, the blockchain application calls the commercial cryptographic KMS interface. KMS generates an SM2 public-private key pair for the user and marks it as a personal private key. At the KMS underlying layer, it maintains the mapping relationship between the user's unique identifier UserOneId, the personal private key number KeyID, and the public key, and returns the public key and KeyID to the blockchain application. (1.3) Register on the blockchain: The blockchain application encapsulates the user's public key into the DID document, calls the blockchain interface to complete the DID registration and on-chain, and generates the user's unique blockchain digital identity DID; (1.4) Synchronize the results. The blockchain will synchronize the DID application results to the business service layer. The user center will record the binding relationship between UserOneId and DID to complete the DID application.

[0008] Preferably, step (2) specifically includes the following steps: (2.1) Select the asset information of the VC to be claimed at the front end. The business processing end assembles the signature data OriginalData, mixes in millisecond-level timestamps and random numbers to prevent replay, and calculates the data hash Data_Hash through the SM3 algorithm. (2.2) After the user completes strong authentication by face, fingerprint or password, the business processing terminal sends UserOneId and Data_Hash to the commercial cryptographic KMS to request authorization; (2.3) The commercial cryptographic KMS finds the corresponding KeyID based on UserOneId, assembles a JWT payload containing user identity, expiration time, data hash and key ID, signs it with a pre-generated institutional-grade SM2 key pair, generates a one-time JWT authorization certificate and returns it to the business processing terminal.

[0009] Preferably, step (2) further includes the following steps: (2.4) The business processing terminal submits asset information, business agreements, and JWT authorization certificates to the centralized operation system; (2.5) The centralized operation system performs idempotency checks through business serial numbers, intercepts duplicate requests, generates business serial numbers and records business logs, and transmits the data to the user center and blockchain application after the review is approved.

[0010] Preferably, step (2) further includes the following steps: (2.6) Perform user signature. The blockchain application calls the KMS escrow signature interface and passes in the data to be signed, OriginalData, JWT authorization certificate, and UserOneId. KMS performs four verifications: JWT signature verification, validity period verification, identity verification, and data hash verification. After the verification is passed, the corresponding user's personal private key is used to perform SM2 signature on OriginalData to generate a VC document without an organization signature. (2.7) Perform institutional signing. The blockchain application calls the institutional signing interface of KMS and passes in the VC document and institutional identifier. KMS verifies that the key type is an internal private key and performs authentication. It uses the institutional private key to perform a secondary SM2 signature on the VC document to generate a complete VC document. (2.8) On-chain notarization: The blockchain application calculates the SM3 hash value of the complete VC document, and notifies the VC document on the blockchain. At the same time, the local generation and storage of the VC document are completed. If the user signs a data hosting agreement, the business layer encrypts the VC document and uploads it to the centralized storage, and synchronizes the storage file ID to the blockchain.

[0011] Preferably, the key of the commercial cryptographic KMS includes an internal private key and a personal private key. The internal private key includes an organization private key and an organization-level JTW authorization credential. The personal private key is a user DID and a VC-specific private key, which can only be used to complete proxy signing through valid JWT authorization, and is mapped one-to-one with the user UserOneId and the blockchain DID.

[0012] The system for applying for blockchain-verifiable credentials based on secure intrinsic commercial cryptography technology is characterized by the following: The front-end interaction layer retains the capabilities for biometric authentication and business interaction, and is used to receive users' DID and VC application requests. The business service layer, connected to the aforementioned front-end interaction layer, includes a business processing backend, a centralized operation middle and backend, and a user center, and is used for business process control, JWT pass-through, idempotency checks, and business log recording. The core layer of commercial cryptography, connected to the aforementioned business service layer, is a secure, intrinsic commercial cryptography KMS based on Hygon CPU. As the core key management node, it is used for generating SM2 public and private key pairs, cloud hosting of private keys, issuing JWT authorization certificates, and signing user private keys and organization private keys. The identity storage layer, connected to the aforementioned commercial cryptography core layer, serves as the back-end system of the blockchain. It is used for DID document on-chain registration, VC credential SM3 hash storage, and KMS-generated SM2 signature verification, providing a distributed and trusted identity foundation. The authentication support layer, connected to the identity storage layer, is used to verify user facial recognition and identity information, providing an identity foundation for DID application and KMS authorization.

[0013] Preferably, the commercial cryptographic KMS includes a key attribute marking unit and an access control unit, which marks all keys as internal private keys or personal private keys, and implements access control for different types of keys based on cryptographic access control policies; the commercial cryptographic KMS provides JWT generation interface, managed signature interface, institutional signature interface and key mapping management interface to the outside world.

[0014] Preferably, the commercial cryptographic KMS further includes a JWT authorization unit, which is used to generate a one-time JWT authorization credential that binds the user identity, expiration time, business data hash, and key ID, and to perform four-fold verification of JWT signature, validity period, identity, and data hash before performing managed signature.

[0015] Preferably, the identity verification layer includes an on-chain signature verification unit and a verification unit. The on-chain signature verification unit is used to verify the validity of the SM2 signature generated by the commercial cryptographic KMS, and the verification unit is used to store the SM3 hash values ​​of the DID document and VC certificate on the chain for verification, and to perform full-network query and authenticity verification of the DID and VC.

[0016] Preferably, the business processing end of the business service layer includes an SM3 hash calculation unit for calculating the hash value of the original business data; the centralized operation back-end includes an idempotency check unit for intercepting duplicate requests using the business serial number.

[0017] The device for applying for blockchain-verifiable credentials based on secure intrinsic commercial cryptography technology is characterized in that the device comprises: A processor is configured to execute computer-executable instructions; The memory stores one or more computer-executable instructions, which, when executed by the processor, implement the various steps of the method described above for applying for blockchain-verifiable credentials based on secure endogenous commercial cryptography.

[0018] The processor for applying for blockchain verifiable credentials based on secure intrinsic commercial cryptography is characterized in that the processor is configured to execute computer-executable instructions, and when the computer-executable instructions are executed by the processor, the various steps of the above-mentioned method for applying for blockchain verifiable credentials based on secure intrinsic commercial cryptography are implemented.

[0019] The computer-readable storage medium is characterized in that it stores a computer program that can be executed by a processor to implement the various steps of the above-described method for applying for blockchain-verifiable credentials based on secure endogenous commercial cryptography.

[0020] This invention employs a method, system, device, processor, and computer-readable storage medium based on secure intrinsic commercial cryptography technology to implement blockchain-verifiable credential application. It optimizes user experience by removing a heavy client SDK, making the app lightweight, eliminating the need for users to manage private keys, and resolving backup / retrieval difficulties. DID / VC application can be completed solely through biometric authentication. The system iteration of this invention is flexible, eliminating the dependence of app releases on third-party SDKs, decoupling business processes from key management, and significantly improving system iteration efficiency. The commercial cryptographic foundation is more secure and efficient. User private keys are managed by a professional commercial cryptographic KMS, and the entire signature operation uses national cryptographic algorithms, meeting the security requirements of commercial cryptographic applications and achieving unified and compliant key management. The performance (throughput) of the signature verification function of the trusted cryptographic module within the CPU is more than three times that of current high-end encryption devices on the market, resulting in better signature verification performance. The identity of this invention is trustworthy and controllable. Blockchain provides DID / VC with tamper-proof storage and verification capabilities, while KMS provides secure signature capabilities. The combination of the two achieves dual protection of "trusted identity + compliant signature." The present invention enables large-scale application of distributed digital identity in more financial and government scenarios through its lightweight front-end design, standardized JWT authorization interface, and scalable KMS key management capabilities. Attached Figure Description

[0021] Figure 1 This is a schematic diagram of the system for applying for blockchain-verifiable credentials based on secure endogenous commercial cryptography technology, as per the present invention.

[0022] Figure 2 This is a schematic diagram of the DID application process for the method of applying for blockchain verifiable credentials based on secure intrinsic commercial cryptography technology according to the present invention.

[0023] Figure 3 This is a schematic diagram of the VC application process for the method of applying for blockchain verifiable credentials based on secure endogenous commercial cryptography technology according to the present invention. Detailed Implementation

[0024] To more clearly describe the technical content of the present invention, the following description is provided in conjunction with specific embodiments.

[0025] The method for applying for blockchain verifiable credentials based on secure intrinsic commercial cryptography of the present invention includes the following steps: (1) Initiate a blockchain digital identity (DID) application request. After identity verification, the commercial cryptography KMS generates the user's SM2 public and private key pair and manages the private key. The public key is then encapsulated in the DID document and uploaded to the blockchain system to complete the DID registration. (2) Initiate a VC application request, apply for authorization from the commercial cryptography KMS through strong authentication, the commercial cryptography KMS signs the document with the institutional-grade SM2 key pair, generates a one-time JWT authorization certificate, conducts business flow and review, the commercial cryptography KMS performs user private key signing and institutional private key signing based on the JWT authorization, generates a complete VC document, uploads the SM3 hash value of the VC document to the blockchain system to complete trusted storage, and returns the VC application result to the user.

[0026] In a preferred embodiment of the present invention, step (1) specifically includes the following steps: (1.1) To verify identity, the user front-end initiates a DID application request, and the business back-end calls the unified authentication service of the certificate to complete the verification of the user's face and identity information. After the verification is successful, the user's unique identifier UserOneId is obtained. (1.2) To generate a key, the blockchain application calls the commercial cryptographic KMS interface. KMS generates an SM2 public-private key pair for the user and marks it as a personal private key. At the KMS underlying layer, it maintains the mapping relationship between the user's unique identifier UserOneId, the personal private key number KeyID, and the public key, and returns the public key and KeyID to the blockchain application. (1.3) Register on the blockchain: The blockchain application encapsulates the user's public key into the DID document, calls the blockchain interface to complete the DID registration and on-chain, and generates the user's unique blockchain digital identity DID; (1.4) Synchronize the results. The blockchain will synchronize the DID application results to the business service layer. The user center will record the binding relationship between UserOneId and DID to complete the DID application.

[0027] In a preferred embodiment of the present invention, step (2) specifically includes the following steps: (2.1) Select the asset information of the VC to be claimed at the front end. The business processing end assembles the signature data OriginalData, mixes in millisecond-level timestamps and random numbers to prevent replay, and calculates the data hash Data_Hash through the SM3 algorithm. (2.2) After the user completes strong authentication by face, fingerprint or password, the business processing terminal sends UserOneId and Data_Hash to the commercial cryptographic KMS to request authorization; (2.3) The commercial cryptographic KMS finds the corresponding KeyID based on UserOneId, assembles a JWT payload containing user identity, expiration time, data hash and key ID, signs it with a pre-generated institutional-grade SM2 key pair, generates a one-time JWT authorization certificate and returns it to the business processing terminal.

[0028] In a preferred embodiment of the present invention, step (2) further includes the following steps: (2.4) The business processing terminal submits asset information, business agreements, and JWT authorization certificates to the centralized operation system; (2.5) The centralized operation system performs idempotency checks through business serial numbers, intercepts duplicate requests, generates business serial numbers and records business logs, and transmits the data to the user center and blockchain application after the review is approved.

[0029] In a preferred embodiment of the present invention, step (2) further includes the following steps: (2.6) Perform user signature. The blockchain application calls the KMS escrow signature interface and passes in the data to be signed, OriginalData, JWT authorization certificate, and UserOneId. KMS performs four verifications: JWT signature verification, validity period verification, identity verification, and data hash verification. After the verification is passed, the corresponding user's personal private key is used to perform SM2 signature on OriginalData to generate a VC document without an organization signature. (2.7) Perform institutional signing. The blockchain application calls the institutional signing interface of KMS and passes in the VC document and institutional identifier. KMS verifies that the key type is an internal private key and performs authentication. It uses the institutional private key to perform a secondary SM2 signature on the VC document to generate a complete VC document. (2.8) On-chain notarization: The blockchain application calculates the SM3 hash value of the complete VC document, and notifies the VC document on the blockchain. At the same time, the local generation and storage of the VC document are completed. If the user signs a data hosting agreement, the business layer encrypts the VC document and uploads it to the centralized storage, and synchronizes the storage file ID to the blockchain.

[0030] As a preferred embodiment of the present invention, the key of the commercial cryptographic KMS includes an internal private key and a personal private key. The internal private key includes an institutional private key and an institutional-level JTW authorization credential. The personal private key is a user DID and a VC-specific private key, which can only be used to complete proxy signing through valid JWT authorization, and is mapped one-to-one with the user UserOneId and the blockchain DID.

[0031] The present invention discloses a system for applying for blockchain-verifiable credentials based on secure intrinsic commercial cryptography, wherein the system comprises: The front-end interaction layer retains the capabilities for biometric authentication and business interaction, and is used to receive users' DID and VC application requests. The business service layer, connected to the aforementioned front-end interaction layer, includes a business processing backend, a centralized operation middle and backend, and a user center, and is used for business process control, JWT pass-through, idempotency checks, and business log recording. The core layer of commercial cryptography, connected to the aforementioned business service layer, is a secure, intrinsic commercial cryptography KMS based on Hygon CPU. As the core key management node, it is used for generating SM2 public and private key pairs, cloud hosting of private keys, issuing JWT authorization certificates, and signing user private keys and organization private keys. The identity storage layer, connected to the aforementioned commercial cryptography core layer, serves as the back-end system of the blockchain. It is used for DID document on-chain registration, VC credential SM3 hash storage, and KMS-generated SM2 signature verification, providing a distributed and trusted identity foundation. The authentication support layer, connected to the identity storage layer, is used to verify user facial recognition and identity information, providing an identity foundation for DID application and KMS authorization.

[0032] As a preferred embodiment of the present invention, the commercial cryptographic KMS includes a key attribute marking unit and an access control unit, which marks all keys as internal private keys or personal private keys, and implements access control for different types of keys based on cryptographic access control policies; the commercial cryptographic KMS provides JWT generation interface, managed signature interface, institutional signature interface and key mapping management interface to the outside world.

[0033] As a preferred embodiment of the present invention, the commercial cryptographic KMS further includes a JWT authorization unit, which is used to generate a one-time JWT authorization credential that binds the user identity, expiration time, business data hash, and key ID, and to complete the four-fold verification of JWT signature, validity period, identity, and data hash before performing escrow signing.

[0034] In a preferred embodiment of the present invention, the identity storage layer includes an on-chain signature verification unit and a storage unit. The on-chain signature verification unit is used to verify the validity of the SM2 signature generated by the commercial cryptographic KMS, and the storage unit is used to store the SM3 hash values ​​of the DID document and VC certificate on the chain for evidence storage, and to perform full-network query and authenticity verification of the DID and VC.

[0035] In a preferred embodiment of the present invention, the business processing terminal of the business service layer includes an SM3 hash calculation unit for calculating the hash value of the original business data; the centralized operation back-end includes an idempotency check unit for intercepting duplicate requests using the business serial number.

[0036] The apparatus of the present invention for applying for blockchain verifiable credentials based on secure intrinsic commercial cryptography technology, wherein the apparatus comprises: A processor is configured to execute computer-executable instructions; The memory stores one or more computer-executable instructions, which, when executed by the processor, implement the various steps of the method described above for applying for blockchain-verifiable credentials based on secure endogenous commercial cryptography.

[0037] The present invention discloses a processor for applying for blockchain verifiable credentials based on secure endogenous commercial cryptography, wherein the processor is configured to execute computer-executable instructions, and when the computer-executable instructions are executed by the processor, the various steps of the method for applying for blockchain verifiable credentials based on secure endogenous commercial cryptography are implemented.

[0038] The computer-readable storage medium of the present invention stores a computer program that can be executed by a processor to implement the various steps of the above-described method for applying for blockchain verifiable credentials based on secure endogenous commercial cryptography.

[0039] This invention relates to the fields of blockchain technology, secure intrinsic commercial cryptography, and digital identity authentication. Specifically, it relates to a blockchain-based decentralized identity and VC-verifiable credential application method and system based on secure intrinsic commercial cryptography, applicable to scenarios requiring high security and high compliance for digital identity registration and credential issuance.

[0040] I. Introduction to the Solution The core of this solution is to migrate the signing action in digital identity scenarios from the client side to the server-side proprietary KMS, while simultaneously uploading identity and credential information to the blockchain system. The legality of KMS signing operations is ensured through the JWT authorization mechanism, and the blockchain is responsible for the trusted storage and verification of identity / credentials, forming a division of labor system where "KMS manages keys / signatures, and the blockchain manages identity / storage".

[0041] (I) Core Architecture Layers Front-end interaction layer: business processing front-end and user APP, only retain biometric authentication (face / fingerprint / password) capabilities, remove all cryptographic SDKs, and realize lightweight interaction.

[0042] Business service layer: business processing backend, centralized operation middle and backend, user center, responsible for business process control, JWT pass-through, idempotency check, and business log recording.

[0043] Commercial cryptography core layer: Based on Hygon CPU chip's secure built-in commercial cryptography KMS, it serves as the core key management node, responsible for public-private key pair generation, private key custody, JWT issuance, cloud-based signing (user / organization), and maintaining the mapping relationship between keys and user identities.

[0044] Identity Verification Layer: The back-end system of the blockchain, responsible for DID document on-chain registration, VC certificate hash verification, and full-network verification of identity / certificate, providing a distributed and trusted identity foundation.

[0045] Authentication Support Layer: Authentication and Unified Authentication Service completes the verification of user face and identity information, providing the identity foundation for DID application and KMS authorization.

[0046] (II) Core Integration Points (III) Key Classification and Management System As the core key management node, KMS employs an attribute-based tagging and permission-isolation key management strategy to meet the signature requirements of blockchain digital identities. It consists of two types of keys: Internal private key: Institutional private key, which can only be directly accessed by trusted systems (IP / AK / SK authentication), and is prohibited from being directly accessed. It is used to generate JWT authorization and institutional signatures for blockchain VC.

[0047] Personal private key: The user's exclusive private key for DID / VC, which is strictly prohibited from being directly accessed. It can only be used to complete the signing through valid JWT authorization, and is mapped one-to-one with the user's UserOneId and the blockchain DID.

[0048] II. Technical Implementation This solution revolves around two core processes of distributed digital identity: DID application and VC application / issuance. It enables collaborative interaction between blockchain and commercial cryptographic KMS, and uses the national cryptographic SM2 algorithm to complete signature / key generation, the SM3 algorithm to complete data hash calculation, and JWT to complete signature authorization.

[0049] (a) The pre-process preparations are as follows: Commercial cryptography KMS generates organization-grade SM2 key pairs for JWT issuance and verification and VC organization signing; Establish an interaction interface between KMS and blockchain applications to achieve real-time synchronization of key generation and signature results; The business processing terminal has added SM3 hash calculation capability to ensure the uniqueness of business data hashes.

[0050] (II) The specific steps for DID application (blockchain on-chain + KMS key generation) are as follows: As a user's unique digital identity on the blockchain, the public key of a DID is generated by KMS and encapsulated in a DID document, and finally uploaded to the blockchain system, while the private key is hosted in the cloud by KMS.

[0051] Identity verification: The user initiates a DID application on the front end, and the back end calls the unified authentication service of the certificate to complete the verification of face and identity information. After the verification is successful, the user's unique identifier UserOneId is obtained.

[0052] Key generation: The blockchain application calls the commercial cryptographic KMS interface. KMS generates an SM2 public-private key pair for the user, marks it as an individual private key, and maintains the mapping relationship between UserOneId, KeyID, and public key in KMS. It then returns the public key and KeyID to the blockchain application.

[0053] On-chain registration: Blockchain applications encapsulate the user's public key into a DID document, call the on-chain interface to complete the DID registration and on-chain, and generate the user's unique blockchain digital identity DID; Result Synchronization: The blockchain synchronizes the DID application results to the business service layer, and the user center records the binding relationship between UserOneId and DID, thus completing the DID application.

[0054] (III) The specific steps for VC application (KMS authorized signature + blockchain notarization) are as follows: VC (Verifiable Credential) is the asset / identity credential corresponding to a user's DID. KMS completes the signing of the user's private key and the institution's private key, and finally the VC hash is uploaded to the blockchain to achieve trusted evidence storage. The core relies on the JWT authorization mechanism to ensure the legality of the signature.

[0055] Step 1: User Authorization and JWT Application (Business Processing Terminal + KMS) Users select the asset information for the VC to be claimed on the front end. The business processing end assembles the required signature data OriginalData and forcibly mixes it in with millisecond-level timestamps / random numbers (to prevent replay). The data hash Data_Hash is calculated using SM3.

[0056] After a user completes strong authentication via face / fingerprint / password, the business processing terminal sends UserOneId and Data_Hash to the commercial cryptographic KMS to request authorization.

[0057] KMS looks up the corresponding KeyID based on UserOneId, assembles the JWT payload (binding user identity, expiration time, data hash, and key ID), performs SM2 signing using an organization-level key, generates a one-time valid JWT (valid for 300 seconds), and returns it to the business processing terminal.

[0058] Step 2: Business Processing and Approval (Business Service Layer) The business processing terminal submits asset information, agreements, and JWT tokens to the centralized operation system; The centralized operation system performs business idempotency checks (intercepting duplicate requests using serial numbers), generates business serial numbers and records them in the log. After approval, the data is transparently transmitted to the user center / blockchain application.

[0059] Step 3: KMS Authorization Signature and Blockchain Notification (KMS + Blockchain) User Signature: The blockchain application calls the KMS escrow signature interface, passing in OriginalData, JWT Token, and UserOneId; KMS completes four verifications of JWT signature / validity period / identity / data hash. After the verification is successful, the user's personal key is used to perform an SM2 signature on OriginalData to generate a VC document without an organization signature.

[0060] Institutional Signature: The blockchain application calls the KMS institutional signature interface, passing in the VC document and institutional identifier; after KMS verifies that the key type is an internal private key and the caller is authenticated by IP / AK / SK, it uses the institutional private key to complete the secondary signature of the VC document and generate a complete VC document.

[0061] On-chain evidence storage: The blockchain application stores the hash value of the complete VC document on the blockchain, and at the same time completes the generation and storage of the VC document; if the user signs a data hosting agreement, the business layer encrypts the VC document and uploads it to centralized storage, and synchronizes the storage file ID to the blockchain.

[0062] Results returned: The blockchain synchronizes the VC application results to the business service layer, and the front end displays the list of available VCs to the user, completing the VC application.

[0063] III. Key Technologies and Innovations This solution is based on the built-in cryptographic module of Hygon CPUs, using secure, inherent commercial cryptographic technology as its core foundation. It deeply integrates blockchain distributed identity capabilities and KMS cloud hosting capabilities, natively embedding cryptographic technology into the entire lifecycle of digital identity (DID / VC) in key generation, authorization, signing, storage, and verification. This not only solves the pain points of the original client-side solution, such as SDK dependence and difficult key management, but also achieves deep coupling between cryptographic security and business processes. The following is a summary of the core technologies and innovations: (I) The key technologies are as follows: 1. Secure intrinsic commercial cryptography technology: Leveraging the advantages of secure intrinsic cryptography technology in terms of performance and security, the SM2 and SM3 national cryptographic algorithms are embedded into all core components of the solution. From KMS key generation, JWT issuance, and user / organization signatures, to business data hash calculation on the business side, and then to blockchain signature verification and hash storage, the entire process uses national cryptographic algorithms as the underlying cryptographic support. This not only meets the security assessment requirements for commercial cryptographic applications, but also satisfies the business's needs for low latency and high concurrency.

[0064] 2. KMS key escrow and classification management technology: The KMS system is designed with cryptographic security as its inherent principle, enabling high-security cloud-based hosting of user private keys and natively building capabilities for key attribute tagging, mapping management, and permission isolation: at the underlying level, it inherently maintains the UserOneId<->KeyID<->public key mapping relationship, supporting fast key addressing; it tags all keys with native attributes of internal private key / personal private key, and implements call control for different types of keys based on cryptographic permission policies, preventing unauthorized key use from the kernel level.

[0065] 3. JWT hash binding signature authorization technology: The design incorporates a JWT authorization mechanism based on the national cryptographic SM2 algorithm. This mechanism intrinsically binds information such as data hash, user identity, key ID, and validity period into the JWT payload. The issuance and verification of the JWT are accomplished through the KMS system key (SM2 key pair), achieving cryptographic-level intrinsic binding between "authorization credential generation and signature operation execution." This ensures that only valid JWTs that pass cryptographic verification can trigger the KMS signature operation.

[0066] 4. Collaborative verification and evidence storage technology combining blockchain and secure intrinsic commercial cryptography: To achieve native cryptographic collaboration between blockchain and KMS, KMS, as the intrinsic signature source, completes the SM2 signature of users / organizations and synchronizes the signature result to the blockchain. The blockchain, with its intrinsic cryptographic verification capability, verifies the validity of the SM2 signature result of KMS and stores the SM3 hash value of business data and VC credentials on the chain, realizing a cryptographic closed loop of "KMS intrinsic signature - blockchain intrinsic signature verification and storage" to ensure the credibility of identity and credentials.

[0067] 5. Inherent decoupling technology between lightweight client-side interaction and server-side cryptographic capabilities: All cryptographic capabilities are completely stripped from the client-side APP / frontend and integrated into the server-side KMS and business side. The frontend only retains the interaction capability of biometric authentication (face / fingerprint / password) and connects with the server-side cryptographic capabilities through a lightweight interface, realizing "no cryptographic capabilities on the client side, and a closed loop of cryptographic capabilities on the server side". This solves the problems of heavy integration and difficult maintenance of client-side SDKs from the kernel level.

[0068] (II) The innovative points are summarized as follows: Innovation 1: Intrinsically lightweight transformation with complete decoupling of client-side cryptographic capabilities. For the first time, all cryptographic capabilities in distributed digital identity scenarios are migrated from the client-side to the server-side and internally closed-loop. The heavy client-side cryptographic SDK (5-6M) is completely removed, retaining only biometric authentication interaction capabilities. This eliminates the need for the client-side to handle any cryptographic operations such as key generation, signing, and hash calculation. It fundamentally solves the pain points of the original solution, such as SDK dependency, App release binding, and difficulty in client-side key backup. While achieving client-side lightweighting, it centralizes cryptographic security control on the server-side, improving overall cryptographic compliance.

[0069] Innovation Two: A Secure, Intrinsically-Generated Triple Precise Binding Mechanism for "Key-Identity-Business". A native triple binding system is constructed using secure intrinsic cryptography technology, achieving deep coupling between cryptographic security and business scenarios: Key-Identity Binding (KMS intrinsically maintains the mapping between UserOneId and KeyID), Identity-Business Binding (JWT binds UserOneId to the business Data_Hash), and Key-Business Binding (JWT binds KeyID to the business Data_Hash). This ensures that every signing operation corresponds to a unique user, a unique key, and a unique business, eliminating issues such as unauthorized signing, cross-business signing, and identity impersonation at the cryptographic kernel level.

[0070] Innovation Three: The integrated legal non-repudiation evidence chain construction of blockchain + secure intrinsic cryptography relies on secure intrinsic cryptography technology to construct a complete and tamper-proof evidence chain of "user operation - password authorization - password signature - on-chain storage": user biometric authentication triggers password authorization (JWT generation), KMS records the password operation log of JWT issuance and signing, the business end records the business flow, and the blockchain records the signature verification result and hash storage information. All links form traceable digital evidence with cryptographic technology as the core, which solves the core problem of "how to prove that cloud signature is the user's true intention" from a legal perspective, and achieves dual protection of password security and legal compliance.

[0071] Innovation 4: The transformation of commercial cryptographic capabilities in distributed identity scenarios into native services transforms commercial cryptographic capabilities from local operations on the client side to standardized interface services on the server side. Through KMS, standardized cryptographic service interfaces such as JWT generation, escrow signatures, and institutional signatures are provided, allowing blockchain, business processing, centralized operation and other systems to call them on demand. This realizes the service-oriented and scalable transformation of commercial cryptographic capabilities, supports the large-scale application of distributed digital identity in more financial and government scenarios, and provides a reusable service-oriented model for the implementation of commercial cryptographic technology in the field of distributed identity.

[0072] IV. Core Challenges and Solutions To address the two core challenges of legal non-repudiation and stateless replay prevention in blockchain + KMS integrated applications, targeted solutions are formulated: (a) Legal repudiation: proving that the cloud signature represents the user's true intention. Challenge: On-device signing is a local operation by the user, while cloud-based KMS signing can easily lead to legal disputes regarding whether it reflects the user's intentions.

[0073] Solution: Strong intention trigger: JWT requests must be completed by the user on the front end through biometric authentication / password authentication, forming a chain of "user active operation → authorization signature"; Strong data binding: A unique business data hash and timestamp are bound in the JWT to ensure that the signature operation is only valid for the specified business and to prevent tampering and proxy signing; Strong audit traceability: KMS logs record "JWTID Authorization KeyID", which, combined with business transaction records and blockchain evidence logs, forms a complete evidence chain of user operation-authorization-signature-evidence storage, which can be traced in accordance with the law.

[0074] (ii) Anti-replay and idempotency: Solving the problem of duplicate requests in KMS without state. Challenge: KMS is stateless and cannot record business state; JWT may be maliciously replayed within its validity period.

[0075] Solution: Root cause deduplication prevention: The business processing end mixes timestamps / random numbers into the original data to ensure that each Data_Hash is globally unique. Even if the JWT is stolen, it cannot be used to sign other business data. Business duplication prevention: The centralized operation system intercepts duplicate requests by using the business serial number and business status, and directly rejects serial numbers that are "processing" or "completed", thus preventing replay at the business level.

[0076] To achieve deep integration of blockchain and commercial cryptographic KMS, targeted modifications are needed to the existing business systems, blockchain systems, and KMS systems. The core modifications revolve around interface adaptation, adding new capabilities, and process restructuring. The key points of the modifications for each system are as follows: As the core of the solution, the commercial cryptographic KMS system (core transformation) needs to add interfaces and capabilities adapted to blockchain digital identity, following the principles of statelessness and key isolation. 1. Added JWT generation interface: Input parameters are Data_Hash and UserOneId, output parameter is standard JWT Token, and signature is completed based on SM2; 2. Added escrow signature interface: The input parameters are OriginalData, JWT Token, and UserOneId. After completing four-fold verification, it is signed using the user's personal private key. 3. Added an institutional signature interface: The input parameters are OriginalData and KeyID. After completing the key type and caller authentication, the institution's private key is used for signing. 4. Added key mapping management capability: Maintains the mapping relationship between UserOneId<->KeyID<->public key in the underlying storage, supporting fast addressing; 5. Added key attribute tagging capability: Tag all keys with Type A / Type B to achieve access control isolation.

[0077] The blockchain application system has abandoned the original SDK signature verification logic and added an interaction interface with KMS to enhance on-chain evidence storage and signature verification capabilities. 1. Added KMS key generation call interface: adapted to the public and private key generation requirements during DID application; 2. Added KMS signature call interface: adapted for user-managed signatures and organization signatures respectively; 3. Modify the identity authentication interface: Replace the original Authentication Service (IAS) with a unified authentication service to provide an identity foundation for KMS authorization; 4. Enhance on-chain signature verification capabilities: Enable fast signature verification for KMS SM2 signatures, and support full-network query and authenticity verification of VC / DID.

[0078] Business service layer transformation (business processing / centralized operation / user center) 1. Business processing end: Added SM3 hash calculation capability, restructured DID / VC application process, removed SDK call logic, and added KMS JWT application interface; 2. Centralized Operation System: Expand the VC application interface fields, add a JWT Token pass-through field, and add business serial number and idempotency check capabilities; 3. User Center: Adapts to the transparent transmission of UserOneId and JWT Token, and synchronously updates the DID / VC application interface to achieve synchronization of identity information with blockchain and KMS.

[0079] The front-end layer (APP / business processing front-end) completely removes the original cryptographic SDK, retaining only biometric authentication (face / fingerprint / password) and business interaction capabilities, thereby achieving APP lightweighting (solving the 5-6M integration problem) and eliminating the APP release's dependence on the SDK.

[0080] This invention aims to provide a secure, compliant, and independently controllable blockchain digital identity solution. Through deep integration of commercial cryptographic algorithms, the following effects are achieved: Compliant DID generation and management: Using "Hygon CPU chip + national cryptographic algorithm" to generate DID and associated key pairs, ensuring independent control of core cryptographic technologies.

[0081] Trusted key security mechanism: A key management system (hereinafter referred to as "KMS") based on secure intrinsic cryptography is used to manage the signing key throughout its entire lifecycle to prevent key leakage.

[0082] Secure VC Issuance and Verification: Utilizing national cryptographic digital signature algorithms and JWT token verification mechanisms to ensure the integrity, authenticity, and non-repudiation of VCs, and supporting privacy enhancement technologies such as zero-knowledge proofs.

[0083] Secure and efficient signature method: Relying on Hygon CPU chip and commercial cryptographic KMS to realize the secure cloud hosting of user private keys, and using national cryptographic algorithms (SM2 / SM3) to complete core commercial cryptographic operations such as key generation and signing, the system is lightweight by removing the heavy cryptographic SDK on the client side.

[0084] For the specific implementation scheme of this embodiment, please refer to the relevant descriptions in the above embodiments, which will not be repeated here.

[0085] It is understood that the same or similar parts in the above embodiments can be referred to each other, and the contents not described in detail in some embodiments can be referred to the same or similar contents in other embodiments.

[0086] It should be noted that in the description of this invention, the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance. Furthermore, in the description of this invention, unless otherwise stated, "a plurality of" means at least two.

[0087] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process, and the scope of the preferred embodiments of the invention includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as will be understood by those skilled in the art to which embodiments of the invention pertain.

[0088] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution device. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0089] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The corresponding program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiments.

[0090] Furthermore, the functional units in the various embodiments of the present invention can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0091] The storage media mentioned above can be read-only memory, disk, or optical disk, etc.

[0092] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0093] This invention employs a method, system, device, processor, and computer-readable storage medium based on secure intrinsic commercial cryptography technology to implement blockchain-verifiable credential application. It optimizes user experience by removing a heavy client SDK, making the app lightweight, eliminating the need for users to manage private keys, and resolving backup / retrieval difficulties. DID / VC application can be completed solely through biometric authentication. The system iteration of this invention is flexible, eliminating the dependence of app releases on third-party SDKs, decoupling business processes from key management, and significantly improving system iteration efficiency. The commercial cryptographic foundation is more secure and efficient. User private keys are managed by a professional commercial cryptographic KMS, and the entire signature operation uses national cryptographic algorithms, meeting the security requirements of commercial cryptographic applications and achieving unified and compliant key management. The performance (throughput) of the signature verification function of the trusted cryptographic module within the CPU is more than three times that of current high-end encryption devices on the market, resulting in better signature verification performance. The identity of this invention is trustworthy and controllable. Blockchain provides DID / VC with tamper-proof storage and verification capabilities, while KMS provides secure signature capabilities. The combination of the two achieves dual protection of "trusted identity + compliant signature." The present invention enables large-scale application of distributed digital identity in more financial and government scenarios through its lightweight front-end design, standardized JWT authorization interface, and scalable KMS key management capabilities.

[0094] In this specification, the invention has been described with reference to specific embodiments thereof. However, it will be apparent that various modifications and variations can be made without departing from the spirit and scope of the invention. Therefore, the specification and drawings should be considered illustrative rather than restrictive.

Claims

1. A method for applying for blockchain-verifiable credentials based on secure intrinsic commercial cryptography, characterized in that, The method includes the following steps: (1) Initiate a blockchain digital identity (DID) application request. After identity verification, the commercial cryptography KMS generates the user's SM2 public and private key pair and manages the private key. The public key is then encapsulated in the DID document and uploaded to the blockchain system to complete the DID registration. (2) Initiate a VC application request, apply for authorization from the commercial cryptography KMS through strong authentication, the commercial cryptography KMS signs the document with the institutional-grade SM2 key pair, generates a one-time JWT authorization certificate, conducts business flow and review, the commercial cryptography KMS performs user private key signing and institutional private key signing based on the JWT authorization, generates a complete VC document, uploads the SM3 hash value of the VC document to the blockchain system to complete trusted storage, and returns the VC application result to the user.

2. The method for applying for blockchain verifiable credentials based on secure intrinsic commercial cryptography technology according to claim 1, characterized in that, Step (1) specifically includes the following steps: (1.1) To verify identity, the user front-end initiates a DID application request, and the business back-end calls the unified authentication service of the certificate to complete the verification of the user's face and identity information. After the verification is successful, the user's unique identifier UserOneId is obtained. (1.2) Key generation is performed. The blockchain application calls the commercial cryptographic KMS interface. KMS generates an SM2 public-private key pair for the user and marks it as a personal private key. At the KMS underlying layer, the mapping relationship between the user's unique identifier UserOneId, the personal private key number KeyID, and the public key is maintained, and the public key is returned to the blockchain application. (1.3) Register on the blockchain: The blockchain application encapsulates the user's public key into the DID document, calls the blockchain interface to complete the DID registration and on-chain, and generates the user's unique blockchain digital identity DID; (1.4) Synchronize the results. The blockchain will synchronize the blockchain digital identity DID application results to the business service layer. The user center records the binding relationship between the user's unique identifier UserOneId and the blockchain digital identity DID, thus completing the blockchain digital identity DID application.

3. The method for applying for blockchain verifiable credentials based on secure intrinsic commercial cryptography technology according to claim 1, characterized in that, Step (2) specifically includes the following steps: (2.1) Select the asset information of the VC to be claimed at the front end. The business processing end assembles the signature data OriginalData, mixes in millisecond-level timestamps and random numbers to prevent replay, and calculates the data hash Data_Hash through the SM3 algorithm. (2.2) After the user completes strong authentication by face, fingerprint or password, the business terminal sends the user's unique identifier UserOneId and data hash Data_Hash to the commercial cryptographic KMS to request authorization; (2.3) The commercial cryptographic KMS looks up the corresponding KeyID based on the user's unique identifier UserOneId, assembles a JWT payload containing the user's identity, expiration time, data hash, and key ID, and signs it with a pre-generated institutional-grade SM2 key pair to generate a one-time JWT authorization certificate and returns it to the business processing terminal.

4. The method for applying for blockchain verifiable credentials based on secure intrinsic commercial cryptography technology according to claim 3, characterized in that, Step (2) further includes the following steps: (2.4) The business processing terminal submits asset information, business agreements, and JWT authorization certificates to the centralized operation system; (2.5) The centralized operation system performs idempotency checks through business serial numbers, intercepts duplicate requests, generates business serial numbers and records business logs, and transmits the data to the user center and blockchain application after the review is approved.

5. The method for applying for blockchain verifiable credentials based on secure intrinsic commercial cryptography technology according to claim 4, characterized in that, Step (2) further includes the following steps: (2.6) Perform user signature. The blockchain application calls the KMS escrow signature interface and passes in the data to be signed, OriginalData, JWT authorization certificate, and user unique identifier UserOneId. KMS performs four verifications: JWT signature verification, validity period verification, identity verification, and data hash verification. After the verification is passed, the corresponding user's personal private key is used to perform SM2 signature on OriginalData to generate a VC document without an organization signature. (2.7) Perform institutional signing. The blockchain application calls the institutional signing interface of KMS and passes in the VC document and institutional identifier. KMS verifies that the key type is an internal private key and that the caller performs authentication. It then uses the institutional private key to perform a secondary SM2 signature on the VC document to generate a complete VC document. (2.8) On-chain notarization: The blockchain application calculates the SM3 hash value of the complete VC document, and notifies the VC document on the blockchain. At the same time, the local generation and storage of the VC document are completed. If the user signs a data hosting agreement, the business layer encrypts the VC document and uploads it to the centralized storage, and synchronizes the storage file ID to the blockchain.

6. The method for applying for blockchain verifiable credentials based on secure intrinsic commercial cryptography technology according to claim 1, characterized in that, The KMS key includes an internal private key and a personal private key. The internal private key mainly refers to an institutional-level key pair, and the personal private key is the user's DID and the VC's exclusive private key. It can only be signed by proxy through valid JWT authorization and is mapped one-to-one with the user's unique identifier UserOneId and the blockchain DID.

7. A system for applying for blockchain-verifiable credentials based on secure intrinsic commercial cryptography technology, implementing the method of claim 1, characterized in that, The system includes: The front-end interaction layer retains the capabilities for biometric authentication and business interaction, and is used to receive users' DID and VC application requests. The business service layer, connected to the aforementioned front-end interaction layer, includes a business processing backend, a centralized operation middle and backend, and a user center, and is used for business process control, JWT pass-through, idempotency checks, and business log recording. The core layer of commercial cryptography, connected to the aforementioned business service layer, is a secure, intrinsic commercial cryptography KMS based on Hygon CPU. As the core key management node, it is used for generating SM2 public and private key pairs, cloud hosting of private keys, issuing JWT authorization certificates, and signing user private keys and organization private keys. The identity storage layer, connected to the aforementioned commercial cryptography core layer, serves as the back-end system of the blockchain. It is used for DID document on-chain registration, VC credential SM3 hash storage, and KMS-generated SM2 signature verification, providing a distributed and trusted identity foundation. The authentication support layer, connected to the identity storage layer, is used to verify user facial recognition and identity information, providing an identity foundation for DID application and KMS authorization.

8. The system for applying for blockchain-verifiable credentials based on secure intrinsic commercial cryptography technology according to claim 7, characterized in that, The commercial cryptographic KMS includes a key attribute marking unit and an access control unit. It marks all keys as internal private keys or personal private keys and implements access control for different types of keys based on cryptographic access control policies. The commercial cryptographic KMS provides JWT generation interface, managed signature interface, institutional signature interface and key mapping management interface to the outside world.

9. The system for applying for blockchain-verifiable credentials based on secure intrinsic commercial cryptography technology according to claim 7, characterized in that, The aforementioned commercial cryptographic KMS also includes a JWT authorization unit, which is used to generate a one-time JWT authorization credential that binds user identity, expiration time, business data hash, and key ID, and to perform four-fold verification of JWT signature, validity period, identity, and data hash before executing managed signature.

10. The system for applying for blockchain-verifiable credentials based on secure intrinsic commercial cryptography technology according to claim 7, characterized in that, The identity verification layer includes an on-chain signature verification unit and a certificate storage unit. The on-chain signature verification unit is used to verify the validity of the SM2 signature generated by the commercial cryptographic KMS. The certificate storage unit is used to store the SM3 hash values ​​of the DID document and VC certificate on the chain for verification and to perform full-network query and authenticity verification of the DID and VC.

11. The system for applying for blockchain-verifiable credentials based on secure intrinsic commercial cryptography technology according to claim 7, characterized in that, The business processing terminal of the business service layer includes an SM3 hash calculation unit, which is used to calculate the hash value of the original business data; the centralized operation back-end includes an idempotency check unit, which is used to intercept duplicate requests by business serial number.

12. A device for applying for blockchain-verifiable credentials based on secure intrinsic commercial cryptography technology, characterized in that, The device includes: A processor is configured to execute computer-executable instructions; The memory stores one or more computer-executable instructions, which, when executed by the processor, implement the steps of the method for applying for a blockchain-based verifiable credential based on secure endogenous commercial cryptography, as described in any one of claims 1 to 6.

13. A processor for applying for blockchain-verifiable credentials based on secure intrinsic commercial cryptography technology, characterized in that, The processor is configured to execute computer-executable instructions, which, when executed by the processor, implement the steps of the method for applying for a blockchain-verifiable credential based on secure endogenous commercial cryptography, as described in any one of claims 1 to 6.

14. A computer-readable storage medium, characterized in that, It stores a computer program that can be executed by a processor to implement the various steps of the method for applying for blockchain verifiable credentials based on secure endogenous commercial cryptography, as described in any one of claims 1 to 6.

Images