System and method for identity authentication in meta-universe and online services using identity non-homogenization tokens

Abstract

The invention discloses a system for carrying out block chain identity authentication by using NFT. The system comprises a user interface, an identity NFT casting module and a verifiable certificate issuing module. The user interface allows a user to link a blockchain wallet and a credential wallet to the user interface and provide an online service identity identifier (online service ID) and require the user to create a signature using a blockchain wallet private key and a credential wallet signature key. The identity NFT casting module verifies an online service identity identification code (online service ID) and verifies two signatures using a block chain wallet address and a DID. The identity NFT casting module is used for casting an identity NFT on a block chain network, and storing an online service identity identification code (online service ID), a block chain wallet address and a DID in the identity NFT as metadata. The verifiable credential issuing module issues verifiable credentials to the user and triggers the identity NFT casting module to add credential metadata to the identity NFT.

Description

Technical Field

[0001] The present invention relates to identity authentication using blockchain technology; in particular, to systems and methods for identity authentication in the metaverse and online services using identity non-fungible tokens. Background Art

[0002] Authentication is a critical area of ​​cybersecurity, ensuring that individuals are who they claim to be when accessing digital services and platforms. In today’s digital environment, identity theft and fraud are prevalent, which reflects the importance of strong authentication mechanisms to protect users’ personal information and privacy.

[0003] A key consideration for identity verification is to protect the user's privacy while verifying their identity. For some traditional identity verification methods that utilize image or video capture, it is easy to deceive the verifier using a fake or stolen ID card, or even a deep fake image or other false information. In addition, in some less reputable online services, users have to disclose their complete personal information to the service, which may also be unsafe. To address these issues, users must be given greater control over the disclosure of their personal attributes.

[0004] In addition, the emergence of virtual environments (such as the metaverse and WEB3 projects, such as social ecology) has also brought new challenges to identity authentication. In these immersive digital spaces, users use digital avatars to interact with each other and participate in various activities. However, it does bring significant challenges in verifying the real identity behind these digital avatars, because existing authentication mechanisms may not be applicable to virtual environments.

[0005] Therefore, it is necessary to tailor innovative identity authentication solutions to the unique characteristics of virtual environments to maintain online security and protect users' personal information, and further ensure the security and authenticity of users' identities. Summary of the invention

[0006] According to a first aspect of the present invention, a system for blockchain identity authentication using a non-fungible token (NFT) is provided. The system includes a user interface, an identity NFT casting module, and a verifiable credential issuance module. The user interface allows a user to link a blockchain wallet and a credential wallet to the user interface, and provides an online service identity identification code (or online service ID), and is configured to request the user to create a signature using a private key of a blockchain wallet and a signature using a signature key of a credential wallet, wherein the credential wallet of the user is identified by a decentralized identifier (DID) of the user, and the blockchain wallet of the user is identified by its blockchain wallet address. The identity NFT casting module is configured to receive information, requests and signatures from the user interface, wherein the identity NFT casting module is configured to verify the online service identity identification code (online service ID) owned by the user, and use the blockchain wallet address and the DID to respectively verify the two signatures of the user, wherein the identity NFT casting module is also configured to, when the verification is successful, have the identity NFT minter cast an identity NFT on the blockchain network, thereby saving the online service identity identification code (online service ID), the blockchain wallet address and the DID as metadata in the identity NFT. The verifiable credential issuance module is configured to receive information, requests and signatures from the user interface, wherein the user interface enables the user to provide the DID and personal status information to the verifiable credential issuance module, and request the verifiable credential issuance module to issue a credential, wherein the verifiable credential issuance module is also configured to issue a verifiable credential to the user after the request issued by the user interface to the verifiable credential issuance module is confirmed, and trigger the identity NFT casting module so that the identity NFT minter adds the credential metadata related to the issued verifiable credential to the identity NFT.

[0007] According to the second aspect of the present invention, a method for blockchain identity authentication using NFT is provided. The method comprises the following steps: through a user interface, requesting a user to associate a blockchain wallet and a credential wallet to the user interface, and providing an online service identity code (online service ID); through the user interface, requesting the user to create a signature using the private key of the blockchain wallet, and to create a signature using the signature key of the credential wallet, wherein the credential wallet of the user is identified by the decentralized identifier (DID) of the user, and the blockchain wallet of the user is identified by its blockchain wallet address; the identity NFT casting module receives information, requests and signatures from the user interface; the identity NFT casting module verifies the online service identity code (online service ID) owned by the user; the identity NFT casting module uses the blockchain wallet address and the DID to verify the two identities of the user respectively. signature; the identity NFT casting module casts the identity NFT on the blockchain network through the identity NFT caster, and when the verification is successful, the online service identity identification code (online service ID), the blockchain wallet address and the DID in the identity NFT are saved as metadata; the verifiable credential issuing module receives the DID, personal status information and credential issuance request of the user through the user interface; the verifiable credential issuing module issues a verifiable credential to the user; when the request issued by the user interface to the verifiable credential issuing module is confirmed, the verifiable credential issuing module triggers the identity NFT casting module, and adds the credential metadata related to the issued verifiable credential to the identity NFT through the identity NFT caster.

[0008] Through various embodiments of the present invention, user identities can be tightly integrated with comprehensive profiles to ensure that the system has a comprehensive understanding of the user's identity. The system can verify authenticated identity IDs and credentials to ensure authenticity. Users can control the scope of public credentials and enhance their privacy. Reliable authentication through public blockchains can enhance trust. Cryptography protects privacy and prevents forgery. Real-time interaction between all parties ensures the latest verification results. Identity IDs and credentials can be seamlessly attached to user avatars. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Embodiments of the present invention will be described in detail with reference to the accompanying drawings, in which:

[0010] Figure 1 A schematic architecture of a system according to an embodiment of the present invention is shown for identity authentication using non-fungible tokens (NFTs) on a blockchain;

[0011] Figure 2A schematic diagram showing the interaction between users in the system according to one embodiment of the present invention is shown;

[0012] Figure 3 A flow chart of a minting identity NFT in stage (a) according to an embodiment of the present invention is shown;

[0013] Figure 4 A flowchart according to an embodiment of the present invention is shown, which is the issuance of a verifiable credential to an identity NFT in phase (b);

[0014] Figure 5 shows a schematic diagram of stage (b) according to an embodiment of the present invention;

[0015] Figure 6 A flow chart of generating and verifying a verifiable credential proof in phase (c) according to one embodiment of the present invention is shown;

[0016] Figure 7 A schematic diagram of the first stage of blockchain wallet private key verification according to an embodiment of the present invention is shown;

[0017] Figure 8 A schematic diagram of the second stage of zero-knowledge proof of ownership authentication according to an embodiment of the present invention is shown; and

[0018] Fig. 9 A practical scenario diagram for identity NFT ownership and verifiable credential verification according to one embodiment of the present invention is shown. DETAILED DESCRIPTION

[0019] In the following description, systems and methods for identity authentication in the metaverse and online services using non-fungible tokens (NFTs) are used as preferred examples. Those skilled in the art will appreciate that modifications, including additions and / or substitutions, may be made without departing from the scope and spirit of the invention. Specific details may be omitted so as not to obscure the invention; however, the present disclosure is written to enable those skilled in the art to practice the teachings herein without undue experimentation.

[0020] refer to Figure 1The following description is made. The system 100 has an architecture formed by deploying a user interface 110, a proof and verification module 120, a verifiable credential issuance module 130, and an identity NFT casting module 140. These functional components can usually communicate with each other through the Internet, allowing information or digital data to be passed between them. These functional components can also interact with on-chain data through smart contracts 150. For example, at least one of the functional components can perform zero-knowledge proofs (ZKP) authentication operations 152 or self-sovereign identity (SSI) verifiable credential operations 154 on the blockchain, or further upload data to the blockchain network 156 for storage.

[0021] The user interface 110 can be presented on a web browser for user operation. In one embodiment, the user interface 110 is a website browser that uses a browser extension for the user to operate a verifiable credential wallet 112 and a blockchain wallet 114, such as MetaMask, Phantom or other decentralized wallets. The user interface 110 can also be implemented as a mobile application on a portable electronic device. The prover can use the user interface 110 to initiate identity authentication. For example, the user interface 110 allows the user to link the verifiable credential wallet 112 and the blockchain wallet 114 to the user interface 110, and provide the user's online service identity identification code (online service ID, such as avatar identification code / ID). When any signature request is required, the user interface 110 can request the user to create a signature for the blockchain wallet private key and a signature for the credential wallet signing key.

[0022] According to various embodiments of the present invention, the certification and verification module 120, the verifiable credential issuance module 130, and the identity NFT casting module 140 can collaborate to provide identity NFTs to users and enable identity authentication based on the same NFT. Each identity NFT uniquely represents a user and securely connects user identities across the metaverse, online services, blockchains, and the real world. The certification and verification module 120, the verifiable credential issuance module 130, and the identity NFT casting module 140 are configured to receive information, requests, and signatures from the user interface 110, or to request required actions or information from it.

[0023] The identity NFT casting module 140 is used to issue identity NFTs for users. For example, an identity NFT caster can provide an identity NFT to a user through the identity NFT casting module 140. In one embodiment, metadata of the user's identity and verifiable credentials, such as name, national ID number, income, age, avatar ID, online service user ID, blockchain wallet address, and decentralized identifier (DID) can be stored in the issued identity NFT.

[0024] The certification and verification module 120 is used to authenticate the user holding the identity NFT after receiving the user's request. Through the certification and verification module 120, the verifier can find the identity NFT of the avatar / online service user, confirm the user's ownership of the NFT, and verify their real-world credentials.

[0025] The verifiable credential issuance module 130 is configured to receive a credential issuance request from at least one user through the user interface 110 and determine whether to issue a verifiable credential to the user. When the request is confirmed, the verifiable credential issuance module 130 also triggers the identity NFT casting module 140 to add credential metadata to the identity NFT.

[0026] exist Figure 2 The schematic diagram provided depicts the various users interacting with each other in the system 100. The following will be used as an example to further illustrate the details of the process described above. These processes include: stage (a), the identity NFT minter 220 mints the identity NFT for the user (the user is the prover 200); stage (b), the verifiable credential issuer 210 issues a verifiable credential to the user and triggers the identity NFT minter 220 to store the metadata (only metadata) of the verifiable credential in the identity NFT; stage (c), the verifier 230 generates and verifies the verifiable credential proof.

[0027] In phase (a) of minting identity NFTs, it basically involves interaction between the user and the identity NFT minter 220, such as Figure 3 The flowchart shown in FIG. 1 includes steps S100 , S110 , S120 , S130 , and S140 . These steps of stage (a) can be performed by at least the identity NFT casting module 140 .

[0028] In step S100, the user prepares a credential wallet identified by a DID (e.g., verifiable credential wallet 112), which is cryptographically associated with a wallet signing key known only to the user. The user also creates a blockchain wallet (e.g., blockchain wallet 114), which is identified by its own wallet address and is associated with a private key known only to the user. In addition, based on the example of an application involving a Metaverse platform or online service, the user has also completed registration for the Metaverse platform / online service and received an avatar ID / online server user ID corresponding to it.

[0029] In step S110, the user applies for an identity NFT from the identity NFT minter. In order to apply for an identity NFT, the user can operate the user interface 110 and provide information to the identity NFT minter 220 through the identity NFT minting module 140, including at least (1) avatar ID / online server user ID; (2) the address of the blockchain wallet 114; (3) DID; and (4) two ZKP commitment values ​​of the user's two secrets. In one embodiment, the two secrets include an identity secret and a dynamic secret, and one of the secrets is a time-limited secret. Users need to use different secrets and corresponding commitment values ​​regularly to be identified in order to facilitate identity authentication. The user can use the blockchain wallet private key to create a signature for the request by operating the user interface 110, and use the credential wallet signing key to create a signature for the request.

[0030] In step S120, the identity NFT minter 220 verifies whether the user actually owns the avatar ID / online service user ID. The verification method depends on the method supported by the metaverse / online service. In one embodiment, if the mentioned ID contains an email or phone number, the identity NFT minter 220 can send a verification code to the user via email or text message to verify the ID, and ask the user to reply to the verification code. In another embodiment, the user operates the user interface 110 on-site at the location of the identity NFT minter 220, and then logs in to the metaverse / online service to display his avatar ID / online service user ID to the identity NFT minter 220. At the same time, the identity NFT minter 220 can operate the identity NFT minting module 140 to verify the user's two signatures using the blockchain wallet address and DID respectively.

[0031] In step S130, once the identity NFT casting module 140 can be verified in step S120, step S140 follows. The identity NFT casting module is configured to cast the identity NFT on the blockchain network through the identity NFT casting module 220, and when the verification is successful, the avatar ID / online server user ID, blockchain wallet address (e.g., the wallet address of the NFT issuance) and DID (e.g., the ID of the credential wallet containing a set of verifiable credentials) are saved as metadata in the cast identity NFT. In various embodiments, the wallet address mentioned can be on Ethereum, other EVMs, Solana, BSC or any first or second layer chain. For "casting identity NFT", the identity NFT casting module 220 records the identity NFT on a private or public blockchain. The identity NFT contains a data element that indicates that the above-mentioned blockchain wallet address is the holder of the identity NFT. Once step S130 shows that the verification failed, the process is terminated. After stage (a), the user can check the status of his identity NFT in the blockchain wallet 114.

[0032] In phase (b), a verifiable credential is issued, which essentially involves interaction between the user, the verifiable credential issuer 210, and the identity NFT minter 220, such as Figure 4 The flowchart shown in FIG. Phase (b) includes steps S200, S210, S220, S230, S240, and S250. These steps of phase (b) can be performed by the verifiable credential issuance module 130 and the identity NFT casting module 140.

[0033] In step S200, the user prepares his / her identifiable credential wallet and the minted identity NFT in stage (a).

[0034] In step S210, in order to apply for the issuance of a verifiable credential, the user can provide his or her information to the verifiable credential issuer 210 by operating the user interface 110, and further request the verifiable credential issuer 210 to issue a credential with the information. In one embodiment, the information includes DID, age, income, etc.

[0035] After step S210, the verifiable credential issuing module 130 determines whether the information in step S210 is DID information. If so, it proceeds to step S220. In step S220, the verifiable credential issuer 210 verifies whether the user actually owns his DID. For example, the verifiable credential issuer 210 sends a challenge message to the user, requiring the user to sign the same challenge message using the signing key of the credential wallet. The verifiable credential issuer then verifies the signature using its DID. After the signature is verified to be correct, it proceeds to step S240.

[0036] After step S210, if the verifiable credential issuing module 130 determines that the information in step S210 is not DID information, step S230 is then executed. In step S230, the verifiable credential issuer 210 verifies the correctness of the information provided in step S210 by other methods it deems appropriate. Then, the verifiable credential issuer 210 verifies the verified information and confirms its correctness.

[0037] Once the verification result in step S220 or S230 is positive, step S240 is executed next. In step S240, since the information provided by the user has been verified (i.e., confirmed / accepted), the verifiable credential issuer 210 can use the verifiable credential issuance module 130 to issue the credential to achieve: (1) sign the credential; (2) store the credential validity status in the blockchain; (3) send the credential to the user; (4) send / forward the credential metadata to the identity NFT minter 220 through the identity NFT minting module 140.

[0038] In step S250, the user saves the credential to his credential wallet (e.g., credential wallet 112) through the user interface 110, and the identity NFT minter 220 adds the credential metadata to the identity NFT. If the result is a negative judgment (i.e., the verification is negative), the process is terminated.

[0039] Figure 5 A schematic diagram of stage (b) according to one embodiment of the present invention is shown. Labeled as "User" is an identity NFT holder and a credential wallet holder, who creates a credential wallet with a unique DID and also stores credential data in the wallet. Data storage can be implemented through any private, accessible storage method and is identified by the DID. In this regard, the DID is cryptographically associated with the master key and signing key of the holder's wallet. The wallet holder uses the signing key to prove its ownership of the DID and uses the master key to create a credential certificate.

[0040] Once the information provided by the user is verified, confirmed and accepted, the verifiable credential issuer 210 will forward the information to the identity NFT minter 220 so that the identity NFT minter 220 can interact with the identity NFT smart contract deployed in the blockchain to generate a record for the target identity NFT, thereby storing the metadata (only metadata) of the verifiable credential in the identity NFT. On the other hand, the content of the verifiable credential is also stored in the user's credential wallet. The identity NFT record includes data including the identity of its holder, the identity NFT ownership authentication settings, and the credential metadata. This data storage can be implemented by a blockchain ledger with public access rights and identified by the ID of the identity NFT (that is, each identity NFT has a unique ID). In one embodiment, the credential metadata of each identity NFT is stored in the record of the identity NFT on the blockchain. In another embodiment, the credential metadata is stored in off-chain storage. For example, Figure 2 As shown, in order to reduce the use of blockchain resources, identity NFTs can choose to store metadata in off-chain storage, such as the inter planetary filesystem (IPFS).

[0041] That is, the user and the verifiable credential issuer 210 call the functions of the SSI verifiable credential utility within the SSI verifiable credential operation 154 to achieve decentralized management of digital identity. The SSI verifiable credential operation 154 enables users to manage their verifiable credentials themselves without relying on third-party providers to store and centrally manage data. Specifically, the SSI verifiable credential operation 154 for SSI management includes: (1) the verifiable credential issuer 210 issues real-world credentials to users; (2) users control the disclosure of their own real-world credentials; (3) users disclose the content of their own verifiable credentials or only prove that their own verifiable credentials meet certain standards; (4) verifiable credential verification is protected by blockchain security.

[0042] After stage (b), the state is defined as the user already owns the identity NFT, where the function of the identity NFT is to manage and verify digital identities and credentials. Specifically, the empowerment of identity NFTs includes: authenticating the ownership of identity NFTs using zero-knowledge proofs; storing holder IDs (avatar IDs / online service user IDs, blockchain wallet addresses, DIDs); storing verifiable credential metadata (personal information). In this way, NFT holders can establish identities in three realms (i.e., the metaverse / online services, blockchains, and the real world). Identity NFTs can provide multi-factor authentication to verify NFT ownership, which supports the issuance and verification of verifiable credentials and is non-transferable (e.g., soul-bound tokens).

[0043] In phase (c), a verifiable credential proof is generated and verified, which essentially involves interaction between the user, the identity NFT minter 220, and the verifier 230, such as Figure 6 Flowchart shown. Phase (c) includes steps S300, S310, S320, and S330. These steps of phase (c) are performed by the proof and verification module 120. In phase (c), the goal is to provide an identity NFT ownership authentication mechanism that can be protected by using blockchain public key encryption and multi-factor authentication based on zero-knowledge proof; at the same time, the mechanism provided also includes enabling the verifier to locate the identity NFT of its virtual image / online service user, and authenticate the user's ownership of the identity NFT, as well as verify the user's real-world credentials.

[0044] In step S300, the user already owns the identity NFT minted in stage (a) and has stored the information as described above in stage (b). In this regard, when the identity NFT minter 220 mints the identity NFT, the identity NFT holder may create two secret values ​​and apply zero-knowledge proof to generate two corresponding commitment values, which are stored inside the identity NFT by the identity NFT minter 220. In one embodiment, the identity NFT minter 220 may perform ownership authentication to verify the user's proof and commitment value before storing the commitment value in the identity NFT.

[0045] In step S310, the user who is the holder of the identity NFT can first log in to the metaverse world and the WEB 3 project environment, and then become a prover 200, and present the identity NFT to the verifier 230 to complete the authentication step of ownership. When the verifier 230 encounters the prover 200 on the corresponding metaverse or online service, the verifier 230 can retrieve the avatar ID or online service user ID of the prover 200. In one embodiment, the verifier 230 searches the blockchain for an identity NFT containing the avatar ID or online service user ID of the prover 200. In another embodiment, the prover 200 provides the verifier 230 with the ID of its own identity NFT, which contains the paired avatar ID or online service user ID.

[0046] Verifier 230 verifies ownership of the identity NFT by prover 200. Prover 200 needs to prove that it has the private key of a blockchain wallet (e.g., blockchain wallet 114) and that the identity NFT is held in this wallet. Prover 200 signs the statement using its blockchain wallet private key, which contains the challenge message from verifier 230. This signature is also verified by verifier 230 using the blockchain wallet address in the identity NFT.

[0047] Then, the prover 200 proves that it knows the two secrets behind the two commitment values ​​in the identity NFT, which can start from the verifier 230 sending a one-time challenge code to the prover 200; accordingly, the prover 200 uses zero-knowledge proof cryptography to create a ZKP proof using the two secret values ​​and the challenge code. After creating the ZKP proof, the verifier 230 verifies the ZKP proof by applying zero-knowledge proof cryptography to verify the ZKP proof against the two commitment values ​​and the challenge code.

[0048] In one embodiment, in order to prove the ownership of the identity NFT, a multi-factor authentication of ownership of the identity NFT based on zero-knowledge proof can be adopted. For this, the prover 200 needs to go through two stages, including "blockchain wallet private key verification" in stage I and "zero-knowledge proof ownership authentication" in stage II.

[0049] Figure 7 A schematic diagram of blockchain wallet private key verification in phase I according to an embodiment of the present invention is shown. Phase I includes steps S400, S410, and S420. In step S400, the verifier 230 sends a one-time challenge code to the prover 200. In step S410, the prover 200 signs the one-time challenge code from the verifier 230 using its own blockchain wallet private key and sends the signature back to the verifier 230; for example, Figure 7 In the content, it is shown that the prover 200 has a blockchain wallet with an address of "0x9e..." and a private key "zb0t...". In step S420, the verifier 230 verifies the signature using the blockchain wallet address in the identity NFT to confirm that the prover 200 has the corresponding private key. In the accompanying drawings, a one-time challenge code is used to prevent the signature from being used twice.

[0050] Figure 8 A schematic diagram of zero-knowledge proof ownership authentication in Phase II according to an embodiment of the present invention is shown. In one embodiment, in this phase, secrets and commitments are used, but the identity NFT only stores the zero-knowledge proof commitment (i.e., it does not store the secret itself), and the identity secret and dynamic secret are reserved only for the prover. For example, the authorized issuer stores two zero-knowledge proof commitment values ​​in the prover's identity NFT), and: (1) the identity secret, whose range ∈ Zp set; and (2) the dynamic secret, whose range ∈ Zp set, and which is never disclosed to any verifier. In the accompanying figure, the blocks marked "ZKP Transformation" are operations used for zero-knowledge proof calculations. These blocks are constructed using elliptic curve point addition / multiplication for transformations: P 1 +P s ,nP,discrete log p n; for example, z = SHA2(n) mod(p)*G + 2m*P1 .

[0051] Phase II includes steps S500, S510, and S520. In step 500, the prover sends a message to the verifier to declare that the prover owns the target identity NFT. In step S510, the verifier sends a challenge code {0,1} n＝<Zpspace , used to verify the prover's knowledge of the committed secret, including: knowledge of the identity secret and the dynamic secret. In one embodiment, a challenge-response protocol is applied to prevent the proof from being used twice. In step S520, the prover proves the knowledge of the two secrets to the verifier. In one embodiment, the prover can also prove knowledge by using a new dynamic secret, which is optional; for example, if the verifier is an authorized issuer, the verifier can adopt a new dynamic secret. In this regard, for better protection, the dynamic secret is regularly updated with a new secret. In one embodiment, each secret (e.g., an identity secret) is designed to contain multiple sub-secrets, thereby increasing the difficulty of hacker attacks, where the sub-secrets can be combined into a single secret with a corresponding secret commitment. After step S520, the verifier verifies the proof from the prover and outputs a result indicating whether the proof is valid or invalid. Once the proof from the prover is verified, the prover's status of owning the two secrets is verified, and the ownership of the identity NFT can also be authenticated.

[0052] Phase II can be built using zero-knowledge proof mathematical foundations, such as elliptic curve cryptography curve: y 2 =x 3 +ax+bmod(p), the order is n, the cofactor is h, the base point is G, and the domain size is p. The setting information related to this will be described here.

[0053] Identity NFTs contain two commitment values ​​that can be added to them when minted. The commitment values ​​are generated as follows.

[0054] (1) The prover sets two secrets and keeps them secret. The secrets are: a) keep your identity secret, The prover calculates the identity secret commitment through ZKP transformation 1: Z = k·G; b) dynamic secret, The prover calculates the dynamic secret commitment through ZKP transformation 2: X = r·G;

[0055] (2) The prover discloses commitments Z and X to the identity NFT minter, who stores them in the identity NFT and makes them available to the public.

[0056] Certification and Verification Procedures:

[0057] When the prover then asserts ownership of the identity NFT to the verifier, the following actions are performed: (a) The prover asserts ownership of the identity NFT; (b) The verifier chooses a challenge code and passed to the prover; (c) The prover applies ZKP transformation 3 to the two secrets and the challenge code and generates the following proof: y = (k·e+r) mod p; (d) The verifier retrieves the two commitments (Z and X) in the identity NFT and then applies the proof to the subsequent ZKP Transformation 4 operation: res = y·Ge·Z; (e) The verifier checks whether “res” and X are the same; if so, the proof is valid. Here's why res and X should be the same: y·Ge·Z=(ke+r)·Ge·k·G=e·k·G+r·Ge·k·G=r·G=X

[0058] In one embodiment, if the dynamic secret has been set for a long time, the prover can change his own dynamic secret r to further enhance security.

[0059] refer to Figure 6 , after step S310, when the verifier 230 verifies the ownership of the identity NFT of the prover 200 and succeeds, step S320 is entered next. In step S320, the verifier 230 checks the credential metadata in the identity NFT to obtain a list of credentials (i.e., the name and type of the credential). For each credential, the verifier 230 will request the prover to provide proof of the complete content of the credential or proof of a credential that meets certain requirements. Similarly, the request contains a unique challenge code to prevent secondary use of the proof. In step S330, the prover 200 can generate a proof using the verifier's proof request, the credential metadata stored in the identity NFT, and the credential from the prover's credential wallet. After step S330, once the verifier 230 verifies that the proof from the prover 200 is true, phase (c) (i.e., generating and verifying a verifiable credential proof) is deemed successful; otherwise, the verification fails.

[0060] In one embodiment, in steps S320 and S330, the verifier 230 verifies the prover's ownership of the DID stored in the identity NFT by issuing a challenge to the prover 200, which includes requesting the prover 200 to sign the challenge message using the credential wallet signing key. The verifier 230 then verifies the signature using the DID. The verifier 230 also requests the prover 200 to create a verifiable credential proof that confirms its own DID value. In addition, the verifier 230 can continue to verify the real-world information of the prover 200 by requesting the prover to disclose the prover's credentials. In one embodiment, the verifier 230 requests the prover 200 to disclose the entire contents of the verifiable credential subset and generate a proof of another verifiable credential subset to prove that they meet specific requirements.

[0061] In phase (c), the credential proof cannot be constructed or is rejected by the proof and verification module 120 if: (a) the certificate is inconsistent with the contents of the issued certificate; or (b) the credential is constructed from a credential that has been revoked by the credential issuer; or (c) the credential proof is constructed from the credentials of another DID owned by the prover; or (d) the credential is constructed from a credential issued by an unrecognized credential issuer; or (e) the credentials are constructed from the credentials of another user; or (f) the credential is a copy of the credential of another individual / organisation; or (g) The credential proves that it has been modified and is linked to the validity state of another user's credential (in the blockchain).

[0062] Fig. 9 The following is a diagram of an actual scenario according to an embodiment of the present invention, which verifies the ownership and verifiable credentials of an identity NFT. In the scenario, the prover is set to have DID: abc34; Name: Bob; Age: 21; Salary: 45k, which are all stored in the credential wallet, and the prover owns the identity NFT. In order to verify, first, the prover operates the user interface (for example, Figure 1 The user interface 110 of the embodiment of the present invention presents Alice with its identity NFT (i.e., the identity NFT of the prover), and Alice is the verifier in the scenario. The proof and verification module (e.g., Figure 1The proof and verification module 120) receives the presentation from the prover. The verifier then verifies the ownership of the prover's identity NFT through the proof and verification module that interacts with the blockchain network, and ensures that the prover's ID matches the ID recorded in this identity NFT. After verifying the ownership of the identity NFT and receiving the result from the blockchain network by the proof and verification module, the verifier can request proof from the prover through the user interface and the proof and verification module. The proof includes: DID: abc34; Name: Bob; Age>=18; Salary>=30k. The prover then retrieves the identity NFT from the blockchain network by operating the user interface. The result of the identity NFT retrieval is sent back from the blockchain network to calculate the proof using the credential wallet content. Thereafter, the prover presents the proof to the verifier, which can be received and displayed by the proof and verification module: DID: abc34; Name: Bob; Age>=18; Salary>=30k. In the final stage, the verifier requests necessary information (e.g., credential metadata, credential validity status) from the blockchain and verifies it using the prover and verifier modules; the verifier then checks whether the verification succeeded or failed.

[0063] In various embodiments, the certification and verification module (e.g., Figure 1 The proof and verification module 120) is configured to reject or defend against possible attacks by counterfeiters, including ownership theft of identity NFTs, verifiable credential proof forgery, verifiable credential proof with incorrect credential information, verifiable credential proof inconsistent with issued credentials, verifiable credential proof constructed from issued credentials that have been revoked by the credential issuer, verifiable credential proof constructed from credentials of another DID owned by the same prover, verifiable credential proof constructed from credentials issued by an unrecognized credential issuer, verifiable credential proof theft, using another user's credential proof as the prover's own credential, using another user's credentials to build a proof, establishing a credential proof but linking it to the validity status (in the blockchain) of another user's credential.

[0064] With regard to preventing ownership theft of identity NFTs, various embodiments of the present invention provide the following multi-factor authentication of ownership. (a) Encrypted private key authentication of identity NFT holder: The identity NFT holder needs to sign the verifier's challenge message using a blockchain wallet private key that only he or she knows. The verifier can verify the authentication code using the blockchain wallet address marked in the identity NFT. (b) Ownership authentication of zero-knowledge proof (ZKP): The identity NFT contains two unique digital codes, called commitments, which are encrypted and generated by two secret values ​​that only the identity NFT holder knows; the identity NFT holder needs to use zero-knowledge proof cryptography to create a ZKP proof using these two secret values; the ZKP proof can be verified by the other party by applying zero-knowledge proof cryptography to prove the two commitments.

[0065] Regarding preventing identity forgers from guessing secrets, in various embodiments of the present invention, a time-limited secret can be provided in one of the secrets. The holder needs to periodically assign different secrets and corresponding commitment values ​​for identification by the verifier.

[0066] Regarding preventing an identity forger from reusing another user's ZKP certificate, various embodiments of the present invention provide that each ZKP certificate is constructed from a one-time unique challenge code specified by the verifier. A second-use ZKP certificate detected by the verifier will not match the challenge code.

[0067] Regarding preventing credential proof forgery, in various embodiments of the present invention, rules are provided: (a) verifiable credentials must be issued by a credential issuer recognized by the verifier; (b) the verifiable credential prover must use a one-time unique code specified by the verifier to create the proof.

[0068] For (a) the verifiable credential is issued by a credential issuer recognized by the verifier, there are four possible situations and corresponding results. (ai) The verifiable credential proof is inconsistent with the content of the issued credential: When the credential data content claimed by the prover is inconsistent with the credential content signed by the credential issuer, the proof cannot be generated. (a-ii) Verifiable credential proof constructed by a credential that has been revoked by the credential issuer: The verifier can detect invalidity by verifying it with the credential validity status in the blockchain. (a-iii) Verifiable credential proof constructed by a credential of another DID owned by the prover: The verifier will be able to verify this situation because this proof cannot be proved by the DID belonging to the identity NFT. (a-iv) Verifiable credential proof constructed by a credential issued by an unidentified credential issuer: The proof detected by the verifier is not constructed by a credential issued and signed by the credential issuer specified by the verifier.

[0069] For (b) verifiable credentials, the prover is required to create a proof using a one-time unique code specified by the verifier. There are three possible situations and corresponding results. (bi) Using another user's credential proof as one's own proof: Each credential proof is constructed based on a one-time unique challenge code specified by the verifier. Therefore, the verifier will detect the secondary use of the credential proof because this proof does not match the challenge code specified by the verifier. (b-ii) Using other users' credentials to build a proof: The credentials of other users are cryptographically incompatible with the prover's credential wallet and master key. Therefore, the prover can neither store the credentials in the prover's credential wallet nor successfully build a proof using the prover's master key. (b-iii) Building a credential proof and then manually linking it to the validity status of other users' credentials (in the blockchain): In a maliciously modified proof, the changed validity status link will make the proof inconsistent with the cryptographic fingerprint of the proof. The verifier can detect that this proof is invalid.

[0070] According to the above configuration, the present invention provides several positive benefits. First, the close integration of multiple user identities is emphasized to create a comprehensive user identity profile. This ensures a more comprehensive understanding of the user's identity. In addition, the present invention is able to verify the user's authentication identity ID and credentials, thereby ensuring their authenticity. Importantly, the user retains control over the scope of the credentials disclosed to the verifier, thereby enhancing privacy protection. In addition, the present invention provides reliable identity authentication to the public through a public blockchain, thereby enhancing trust and transparency. By utilizing encryption technology, the present invention effectively protects privacy while preventing identity forgery and theft. Furthermore, real-time interaction between credential issuers, identity holders, and verifiers ensures that verification is based on the latest information. Moreover, the present invention allows identity IDs and credentials to be attached to avatars without distorting their images, thereby seamlessly integrating identities into virtual environments.

[0071] Computing devices, computer processors or electronic circuits can be used to implement the functional units and modules of the apparatus and methods according to the embodiments disclosed herein, including but not limited to application-specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), microcontrollers and other programmable logic devices configured or programmed according to the teachings of the present disclosure. Those skilled in the art of software or electronics can easily prepare computer instructions or software codes running in computing devices, computer processors or programmable logic devices based on the teachings of the present disclosure.

[0072] All or part of the method according to the embodiment may be executed in one or more computing devices, including server computers, personal computers, laptop computers, mobile computing devices (such as smart phones and tablet computers).

[0073] Embodiments may include computer storage media, transient and non-transitory memory devices having stored therein computer instructions or software codes, which may be used to program or configure a computing device, a computer processor, or an electronic circuit to perform any of the processes of the present invention. Storage media, transient and non-transitory memory devices may include, but are not limited to, floppy disks, optical disks, Blu-ray disks, DVDs, CD-ROMs, magneto-optical disks, ROMs, RAMs, flash memory devices, or any type of medium or device suitable for storing instructions, codes, and / or data.

[0074] Each functional unit and module according to various embodiments may also be implemented in a distributed computing environment and / or a cloud computing environment, where all or part of a machine instruction can be executed in a distributed manner by one or more processing devices interconnected by a communication network, such as an intranet, a wide area network (WAN), a local area network (LAN), the Internet, and other forms of data transmission media.

[0075] The above description of the present invention is provided for the purpose of illustration and description. It is not intended to be exhaustive or to limit the present invention to the precise form disclosed. For those skilled in the art, many modifications and variations will be apparent.

[0076] The embodiments were chosen and described in order to best explain the principles of the invention and its practical applications, thereby enabling others skilled in the art to understand the invention for various embodiments and with various modifications as are suited to the particular use contemplated.

Claims

1. A system, characterized in that: Using non-fungible tokens NFT) for blockchain identity authentication, including: A user interface that allows a user to link a blockchain wallet and a credential wallet to the user interface and provide an online service identification code, and is configured to request the user to create a signature using a private key of a blockchain wallet and to create a signature using a signing key of a credential wallet, wherein the credential wallet of the user is identified by a decentralized identifier (DID) of the user and the blockchain wallet of the user is identified by its blockchain wallet address; an identity NFT minting module configured to receive information, requests, and signatures from the user interface, wherein the identity NFT minting module is configured to verify the online service identity identification code owned by the user, and to verify the two signatures of the user respectively using the blockchain wallet address and the DID, wherein the identity NFT minting module is further configured to, upon successful verification, mint an identity NFT on a blockchain network by the identity NFT minter, thereby storing the online service identity identification code, the blockchain wallet address, and the DID as metadata in the identity NFT; and A verifiable credential issuing module, configured to receive information, requests and signatures from the user interface, wherein the user interface enables the user to provide the DID and personal status information to the verifiable credential issuing module and request the verifiable credential issuing module to issue a credential, wherein the verifiable credential issuing module is also configured to issue a verifiable credential to the user after the request issued by the user interface to the verifiable credential issuing module is confirmed, and trigger the identity NFT minting module, so that the identity NFT minter adds credential metadata related to the issued verifiable credential to the identity NFT.

2. The system according to claim 1, characterized in that The identity NFT minting module mints the identity NFT, and the identity NFT includes a data element indicating that the blockchain wallet address is the holder of the identity NFT.

3. The system according to claim 1, characterized in that After successfully verifying the user's ownership of the DID, the verifiable credential issuer module accepts the user interface's request to the verifiable credential issuer module.

4. The system according to claim 3, characterized in that During verification of the user's ownership of the DID, the verifiable credential issuing module sends a challenge message to the user and requires the user to sign the challenge message using the signing key of the credential wallet, and the verifiable credential issuing module is also configured to verify the signature of the challenge message using the DID.

5. The system according to claim 3, characterized in that The verifiable credentials include: Credential metadata, including credential name and type; a validity status, which indicates whether the credential is valid or has been revoked; and Credential data that is associated with the information provided by the user.

6. The system according to claim 5, characterized in that The verifiable credential issuing module is further configured to: forwarding the credential metadata to the identity NFT minting module for storage in the identity NFT; storing the validity state in a blockchain network accessible to public access; as well as The credential data is forwarded to the user for storage in the credential wallet of the user, making the user the holder of the credential.

7. The system according to claim 1, characterized in that The user interface is also configured to request the user to create two secret values ​​and apply zero-knowledge proof (ZKP) to generate two corresponding commitment values ​​to be stored by the identity NFT minter inside the identity NFT, and the identity NFT minting module is also configured to mint the identity NFT, which includes the two corresponding commitment values.

8. The system according to claim 7, characterized in that Also includes: A proof and verification module configured to request the user to prove, through the user interface, his knowledge of the two secrets behind the corresponding commitment values ​​in the identity NFT.

9. The system according to claim 8, characterized in that The certification and verification module is further configured to: sending a one-time challenge code to the user via the user interface; Requesting the user to create a ZKP proof using the two secret values ​​and the challenge code using zero-knowledge proof cryptography; as well as The ZKP proof is verified by applying zero-knowledge proof cryptography to verify the ZKP proof against two of the corresponding commitment values ​​and the challenge code.

10. The system according to claim 9, characterized in that The certification and verification module is further configured to: creating a verifiable credential proof confirming the DID of the user; and verifying the user's real-world information by requesting the user to disclose the user's credentials through the user interface; wherein the attestation and verification module is allowed to request the user to disclose, through the user interface, all contents of a subset of verifiable credentials possessed by the user, and generate an attestation of another subset of the verifiable credentials possessed by the user to prove that the verifiable credentials meet specific requirements; The certification and verification module refuses to construct the verifiable credential certification when: The verifiable credential is inconsistent with the issued credential from the verifiable credential issuing module; or The verifiable credential is constructed from a credential that has been revoked by the verifiable credential issuing module; or The verifiable credential is constructed from the credentials of another DID owned by the user; or The verifiable credential is constructed from a credential issued by an unrecognized credential issuer, or The verifiable credentials are constructed from the credentials of another user; or The verifiable credential is a certified copy of another individual or organization's credential; or The validity status of a verifiable credential in a blockchain network is modified and linked to another user's credential.

11. A method, characterized in that Using non-fungible tokens NFT; NFT) for blockchain identity authentication, including: Requesting, through a user interface, a user to associate a blockchain wallet and a credential wallet to the user interface and to provide an online service identification code; Requesting the user, through the user interface, to create a signature using a private key of the blockchain wallet and to create a signature using a signing key of a credential wallet, wherein the credential wallet of the user is identified by a decentralized identifier (DID) of the user, and the blockchain wallet of the user is identified by its blockchain wallet address; The identity NFT minting module receives information, requests and signatures from the user interface; The identity NFT minting module verifies the online service identity identification code owned by the user; The identity NFT casting module verifies the two signatures of the user using the blockchain wallet address and the DID respectively; The identity NFT casting module casts the identity NFT on the blockchain network through the identity NFT caster, and when the verification is successful, saves the online service identity identification code, the blockchain wallet address and the DID in the identity NFT as metadata; The verifiable credential issuance module receives the DID, personal status information and a credential issuance request from the user through the user interface; The verifiable credential issuing module issues a verifiable credential to the user; When the request sent by the user interface to the verifiable credential issuing module is confirmed, the verifiable credential issuing module triggers the identity NFT casting module, and the credential metadata related to the issued verifiable credential is added to the identity NFT through the identity NFT caster.

12. The method according to claim 11, characterized in that The identity NFT minting module mints the identity NFT, and the identity NFT includes a data element indicating that the blockchain wallet address is the holder of the identity NFT.

13. The method according to claim 11, characterized in that After successfully verifying the user's ownership of the DID, the verifiable credential issuer module accepts the user interface's request to the verifiable credential issuer module.

14. The method according to claim 13, characterized in that During verification of the user's ownership of the DID, the verifiable credential issuing module sends a challenge message to the user and requires the user to sign the challenge message using the signing key of the credential wallet, and the verifiable credential issuing module is also configured to verify the signature of the challenge message using the DID.

15. The method according to claim 13, characterized in that The verifiable credentials include: Credential metadata, including credential name and type; a validity status, which indicates whether the credential is valid or has been revoked; and Credential data that is associated with the information provided by the user.

16. The method according to claim 15, characterized in that Also includes: The credential metadata is forwarded to the identity NFT casting module through the verifiable credential issuance module, To be stored in the identity NFT; storing the validity status in a blockchain network accessible to public visitors via the verifiable credential issuance module; as well as The credential data is forwarded to the user through the verifiable credential issuing module to be stored in the credential wallet of the user, so that the user becomes the holder of the credential.

17. The method according to claim 11, characterized in that Also includes: Through the user interface, the user is requested to create two secret values ​​and apply zero-knowledge proof (ZKP) to generate two corresponding commitment values ​​to be stored inside the identity NFT by the identity NFT minter, and the identity NFT minting module is also configured to mint the identity NFT, which includes the two corresponding commitment values.

18. The method according to claim 17, characterized in that Also includes: Through the proof and verification module and the user interface, the user is requested to prove his knowledge of the two secrets behind the corresponding commitment values ​​in the identity NFT.

19. The method according to claim 18, characterized in that Also includes: sending a one-time challenge code to the user via the attestation and verification module and the user interface; Requesting, by the proof and verification module, the user to create a ZKP proof using the two secret values ​​and the challenge code using zero-knowledge proof cryptography; as well as The ZKP proof is verified by the proving and verification module and also by applying zero-knowledge proof cryptography to verify the ZKP proof against two of the corresponding commitment values ​​and the challenge code.

20. The method according to claim 19, characterized in that Also includes: Creating, by the attestation and verification module, a verifiable credential attestation that confirms the DID of the user; and requesting the user to disclose the user's credentials, thereby verifying the user's real-world information, through the attestation and verification module and the user interface; wherein the attestation and verification module is allowed to request the user to disclose, through the user interface, all contents of a subset of verifiable credentials possessed by the user, and generate an attestation of another subset of the verifiable credentials possessed by the user to prove that the verifiable credentials meet specific requirements; The certification and verification module refuses to construct the verifiable credential certification when: The verifiable credential is inconsistent with the issued credential from the verifiable credential issuing module; or The verifiable credential is constructed from a credential that has been revoked by the verifiable credential issuing module; or The verifiable credential is constructed from the credentials of another DID owned by the user; or The verifiable credential is constructed from a credential issued by an unrecognized credential issuer, or The verifiable credentials are constructed from the credentials of another user; or The verifiable credential is a certified copy of another individual or organization's credential; or The validity status of a verifiable credential in a blockchain network is modified and linked to another user's credential.

Images