System for realizing trusted authentication of financial agent based on distributed digital identity

Abstract

The invention relates to a system for realizing financial agent credible authentication based on distributed digital identity, which comprises a base layer, an identity layer, an authority layer and a business layer, and is characterized in that the base layer integrates distributed digital identity authentication service, subscription service and distributed storage service, and constructs a credible collaboration framework covering the whole life cycle; the identity layer is configured with a DID generation module, a DID verification module and a DID query module; the authority layer deploys a VC signing and issuing module, a VC verification module and a digital envelope module; the business layer comprises a client and a server between security institutions, and carries out cross-institution data calling through mutual trust verification and MCP message interaction. According to the system for realizing the credible authentication of the financial agent based on the distributed digital identity, through the fusion innovation of the distributed digital identity, the verifiable certificate and the block chain technology, the decentralization of identity authentication, the dynamic authority management and the full link of auditing and tracing are realized in a security industry agent cooperation scene.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of financial information security, in particular to the field of trusted authentication of financial agents, and specifically to a system for realizing trusted authentication of financial agents based on distributed digital identity. BACKGROUND

[0002] 1.1 Agent and MCP protocol Agent, as a core concept in the field of artificial intelligence, its development context and technological evolution are closely related. The earliest can be traced back to the 1950s, when artificial intelligence researchers proposed "rule-based systems" to achieve simple task execution through pre-set logical rules. In 1985, Marvin Minsky formally proposed the Agent theory in his book "Society of Mind", believing that individuals with environmental perception and goal-driven capabilities can solve complex problems through collaboration, which laid the foundation for subsequent technological development. After 2020, with the continuous breakthroughs in core technologies such as large language models (LLM), deep learning, reinforcement learning, and multi-modal fusion, Agent technology has moved from theoretical exploration to widespread application, and is showing a multi-dimensional and cross-disciplinary development trend.

[0003] The maturity of large language models has given Agents powerful cognitive and expressive abilities. GPT-4, Qwen, Llama3, and others, through understanding complex semantics, contextual reasoning, and generating high-quality natural language output, have achieved more natural human-machine interaction. For example, in the customer service field, LLM-driven Agents can provide personalized services based on user intent, dynamically adjust teaching strategies in the education field, and support efficient generation of news reports or technology articles in content creation. The improvement of multi-modal perception capabilities further enhances the Agent's understanding of the environment, and through the integration of visual, audio, and text information sources, it can make accurate decisions in real or simulated environments. For example, combining image recognition and language generation technologies, Agents have been widely used in behavior analysis in intelligent subscription, image interpretation in assisted medical care, and multi-sensor fusion in autonomous driving. Optimization of behavior modeling and decision-making mechanisms has driven Agents to transition to higher levels of autonomy, such as the general AI Agent Manus, which not only has language capabilities but also can autonomously plan action paths, complete complex tasks such as web operations and task scheduling, marking a shift from "passive response" to "active execution".

[0004] MCP (Model Context Protocol) is an open protocol launched by Anthropic in November 2024, aiming to provide a standardized interface for large language models (LLM) to interact with external data sources, tools, and systems. Its core goal is to address the needs of LLMs in real-world applications for real-time data acquisition, tool invocation, and context management, providing a common interface for AI to achieve efficient and flexible connections.

[0005] MCP defines a set of unified communication specifications, including task description languages, interaction interfaces, and collaboration processes, enabling seamless integration of LLMs with external resources such as databases, APIs, and local tools. For example, it supports LLMs to dynamically call tools to obtain the latest data or perform specific operations (such as file processing, web operations, etc.) when generating responses. MCP helps LLMs maintain state consistency in multi-step tasks through standardized context transfer mechanisms and supports the decomposition and distributed execution of complex tasks. The protocol not only optimizes the collaboration efficiency and consistency of multi-agent systems but also promotes the construction of cross-platform and distributed intelligent agent networks. Its ecosystem is gradually covering core functions such as task decomposition, resource scheduling, and state synchronization, becoming an important infrastructure for large-scale AI collaboration.

[0006] In the MCP message interaction framework, clients and servers establish communication through standardized interfaces. Before message interaction, identity authentication based on OAuth 2.0 / 2.1 protocol is required. The client submits identity credentials to the authentication server and requests an access token. After the server verifies and issues a token with a permission range, it ensures the legitimacy and permission boundary of subsequent interactions. After authentication is completed, the client and server can enter the message interaction phase.

[0007] 1.2 Agent applications in the securities industry In the securities industry, the integration of agents and MCP (Model Context Protocol) is driving the transformation of business models from "tool-driven" to "intelligent collaboration". Agent technology, through large language models (LLM) and task planning capabilities, has covered the entire business process of customer communication, investment management, and risk management. For example, based on prompt engineering, retrieval augmented generation (RAG) and other technologies to optimize customer interaction and improve the accuracy and speed of responses. MCP protocol, as a standardized interface connecting large models, external data sources and tools, provides real-time data calling and multi-system collaboration capabilities for agents. For example, the first "LongPort MCP" in the securities industry launched by Longbridge Group, through natural language interaction, realizes intelligent investment services and significantly improves cross-platform collaboration efficiency. Recently, the conditional order intelligent operation solution based on multiple AI agents released by Jingshen shares further demonstrates the potential of this technology combination: through the synergy of quantitative analysts (cloud backtesting), investment analysts (AI investment), and senior traders (high-level conditional orders), the learning application time of high-level conditional orders is compressed from 1.5 months to seconds, and the industry analysis is penetrated from partial fields to the entire field, breaking the inherent cognition of "personalization = high cost" and achieving a 70% reduction in business operation cost. This innovation marks the formal entry of the securities industry into the new era of AI collaborative decision-making, and its core value lies in the replacement of the traditional "instruction inputter" by the "demand execution team" of intelligent agents through standardized interaction with MCP.

[0008] However, current technology applications still face multiple challenges:

Challenge 1: Centralized identity authentication

[0009]

Challenge 2: Static permission management, lack of fine-grained management capabilities

[0010]

Challenge 3: Lack of audit traceability

[0011] 1.3 Distributed Digital Identity Technology (DID) and Verifiable Credentials (VC) Decentralized Identifier (DID) is an identity management framework based on blockchain or distributed ledger technology, aiming to achieve user self-control and cross-platform trusted verification of digital identity through decentralized mechanisms. The core features of DID are uniqueness and decentralization. Its identifier is composed of a string, ensuring uniqueness without relying on centralized registration authorities, and recording identity metadata through a distributed ledger, allowing users to generate, manage, and verify identity identifiers autonomously. DID achieves specific functional extensions through DID documents (DID Document), which are metadata collections bound to DID and are typically stored in JSON-LD format. The core role of the DID document is to describe the identity attributes, verification methods, and associated services of the DID subject. Its structure includes public key information, identity verification methods (such as digital signatures), and other fields, ensuring that DID holders can autonomously control identity data through encryption mechanisms. For example, users can sign identity statements through the public key in the DID document, and verification parties can complete identity verification by analyzing the verification method in the DID document without relying on centralized authorities.

[0012] The technical architecture of DID is based on the concept of "self-sovereign identity" (SSI), and realizes the trusted exchange of identity data through the mechanism of verifiable credentials (VC). Verifiable credentials are encrypted and secure versions of paper or digital credentials, which are jointly involved by the issuer, holder and verifier, and have the characteristics of tamper resistance, traceability and selective disclosure. The combination of DID and VC solves the trust problem in traditional identity authentication: users can associate multiple VCs (such as educational credentials, financial account information, etc.) through DID identifiers, and provide encrypted and verifiable fragments to the verifier without exposing complete data. For example, in the financial field, users can present income proof VC issued by a third-party certification agency to the bank without sharing complete financial records. The international mainstream DID framework (such as Sovrin, Blockstack) has widely supported the VC standard, promoting the seamless migration of identity data between different platforms without the need for repeated registration or reliance on third-party authorization. In China, the combination of real-name DID and VC is explored to explore the trusted data flow mode in government service and supply chain management scenarios. SUMMARY

[0013] The purpose of the present application is to overcome the above-mentioned shortcomings of the prior art, and to provide a system for realizing trusted authentication of financial agents based on distributed digital identity, which meets the requirements of high efficiency, good security and wide application range.

[0014] In order to achieve the above-mentioned purpose, the system for realizing trusted authentication of financial agents based on distributed digital identity according to the present application is as follows: The system for realizing trusted authentication of financial agents based on distributed digital identity, wherein the main feature is that the system comprises a basic layer, an identity layer, a permission layer and a business layer, the basic layer, the identity layer, the permission layer and the business layer are connected in sequence, the basic layer is used for integrating distributed digital identity authentication service, subscription service and distributed storage service, and a trusted collaboration framework covering the whole life cycle is constructed; the identity layer is used for configuring DID generation, DID verification and DID query modules; the permission layer is used for deploying VC issuance, VC verification and digital envelope modules, and realizes fine-grained permission control; and the business layer comprises a client and a server between securities institutions, and cross-institution data calling is realized through mutual trust verification and MCP message interaction.

[0015] Preferably, the base layer includes a distributed digital identity service and an industry cloud infrastructure, the distributed digital identity service integrates digital identity distributed authentication, subscription services and distributed storage services for configuring user management, node management and evidence management, and the industry cloud infrastructure provides a trusted data sharing cloud storage space for encrypted shared transmission of the VC to realize VC exchange between agencies in the cloud.

[0016] Preferably, the identity layer includes a DID generation module, a DID verification module and a DID query module, the DID verification module is connected to the DID generation module, the DID query module is connected to the DID verification module, the DID generation module is used to accept an identity registration request and generate a decentralized identifier and a corresponding DID document, the DID query module is used to obtain DID metadata of a server in real time, and the DID verification module is used to check validity of a server DID or validity of a client DID.

[0017] Preferably, the permission layer includes a VC issuing module, a VC verification module and a digital envelope module, the VC verification module is connected to the VC issuing module, and the digital envelope module is connected to the VC verification module, the VC issuing module is used to generate a verifiable credential VC, encode permission information into an encrypted credential and associate the encrypted credential to a target DID, the VC verification module is used to verify validity of the credential, and the digital envelope module is used to realize point-to-point encrypted sharing of the VC file.

[0018] The method for realizing trusted authentication of a financial intelligent agent based on a distributed digital identity by using the system has the following main features: (1) Intelligent agent identity authentication is performed according to a distributed digital identity DID; (2) Intelligent agent dynamic permission management is performed according to a verifiable credential VC.

[0019] Preferably, the step (1) specifically includes the following steps: (1.1) An identity registration request is initiated through a DID application interface to generate a decentralized identifier DID in accordance with a W3C specification, the generated DID is bound to a blockchain ledger through a smart contract, and a DID document is associated; (1.2) An identity declaration is digitally signed through a private key bound in the DID document, and an identity verification is completed by a verification party through analysis of public key information in the DID document and a verification method; (1.3) If intelligent agent permission is changed or identity is invalid, a DID state is updated through a preset control right verification process; otherwise, the step (2) is continued.

[0020] Preferably, the step (2) specifically includes the following steps: (2.1) issuing a VC by a VC issuing module, and associating the VC to the target's distributed digital identity DID; (2.2) uploading the VC to an industry cloud platform after digitally envelope encryption, and synchronously storing the cloud ID and the VC unique identifier on a chain; (2.3) real-time acquisition of the cloud ID and the VC identifier by a blockchain subscription module, downloading the digital envelope from the cloud platform based on the cloud ID and completing decryption verification.

[0021] (2.4) if the intelligent agent initiates a data access request, the system extracts the DID and the VC ID in the request, calls a blockchain node to verify the validity of the VC, if the verification is passed, the system automatically executes the operation and records the log; if the permission is insufficient or the VC is invalid, the request is rejected and an alarm is triggered.

[0022] The device for realizing trusted authentication of a financial intelligent agent based on a distributed digital identity, which mainly comprises: a processor configured to execute computer executable instructions; a memory storing one or more computer executable instructions, which, when executed by the processor, realize each step of the method for realizing trusted authentication of a financial intelligent agent based on a distributed digital identity.

[0023] The processor for realizing trusted authentication of a financial intelligent agent based on a distributed digital identity, which mainly comprises:

[0024] The computer readable storage medium, which mainly comprises:

[0025] The system for realizing trusted authentication of financial agents based on distributed digital identity adopts the fusion and innovation of distributed digital identity (DID), verifiable credential (VC) and blockchain technology, and realizes the decentralization of identity authentication, the dynamicization of permission management and the full-link tracing of audit in the agent cooperation scene of the securities industry. The DID of the application replaces the traditional OAuth mode, solves the single point failure risk of centralized identity verification and the cross-institutional repeated verification problem. Specifically, the financial agent completes identity mutual trust verification through the DID document stored by the blockchain, and can realize "one authentication, full-link trust" without relying on third-party institutions. The application realizes the fine-grained division and real-time update of permissions based on the encryption credential mechanism of VC. The permission information is dynamically issued and verified through the smart contract, supports on-demand authorization and temporary permission configuration, effectively solves the redundancy or deficiency problem of the traditional static permission system in the business scene adaptation. In addition, the permission state is bound with the blockchain evidence, ensuring the instant synchronization and traceability of permission changes, and significantly enhancing the security and response efficiency of permission management. The application realizes the full life cycle storage of the agent operation log through the blockchain, ensures that the supervisory agencies can subscribe and trace the AI model behavior in real time. The key operations such as tool calling and result feedback in agent interaction are written into the blockchain in the form of structured log, combined with the automatic audit rules of the smart contract, significantly improves the compliance evaluation and risk control ability, and provides an unalterable technical support for financial supervision. BRIEF DESCRIPTION OF DRAWINGS

[0026] Figure 1 The overall architecture of the system for realizing trusted authentication of financial agents based on distributed digital identity.

[0027] Figure 2 The identity determination and permission application process schematic diagram of the system for realizing trusted authentication of financial agents based on distributed digital identity.

[0028] Figure 3 The agent request process schematic diagram of the system for realizing trusted authentication of financial agents based on distributed digital identity.

[0029] Figure 4 The workflow diagram schematic diagram of the system for realizing trusted authentication of financial agents based on distributed digital identity. DETAILED DESCRIPTION

[0030] In order to more clearly describe the technical content of the application, the following further describes in combination with specific embodiments.

[0031] The system for realizing trusted authentication of financial agents based on distributed digital identity, wherein the system comprises a basic layer, an identity layer, a permission layer and a business layer, the basic layer, the identity layer, the permission layer and the business layer are sequentially connected, the basic layer is used for integrating distributed digital identity authentication service, subscription service and distributed storage service, and a trusted cooperation framework covering the whole life cycle is constructed; the identity layer is used for configuring DID generation, DID verification and DID query modules; the permission layer is used for deploying VC issuing, VC verification and digital envelope modules, and fine-grained permission control is realized; and the business layer comprises a client and a server between securities institutions, and cross-institution data calling is performed through mutual trust verification and MCP message interaction.

[0032] As a preferred embodiment of the application, the basic layer comprises distributed digital identity service and industry cloud infrastructure, the distributed digital identity service integrates digital identity distributed authentication, subscription service and distributed storage service, and is used for configuring user management, node management and evidence management, and the industry cloud infrastructure provides a trusted data sharing cloud storage space for encrypted shared transmission of VC, and realizes VC exchange between institutions in the cloud.

[0033] As a preferred embodiment of the application, the identity layer comprises a DID generation module, a DID verification module and a DID query module, the DID verification module is connected with the DID generation module, the DID query module is connected with the DID verification module, the DID generation module is used for accepting an identity registration request, and generating a decentralized identifier and a corresponding DID document, the DID query module is used for acquiring DID metadata of a server in real time, and the DID verification module is used for verifying validity of a server DID or validity of a client DID.

[0034] As a preferred embodiment of the application, the permission layer comprises a VC issuing module, a VC verification module and a digital envelope module, the VC verification module is connected with the VC issuing module, the digital envelope module is connected with the VC verification module, the VC issuing module generates a verifiable credential VC, encodes permission information into an encrypted credential and associates the encrypted credential to a target DID, the VC verification module verifies validity of the credential, and the digital envelope module realizes point-to-point encrypted sharing of the VC file.

[0035] The method for realizing trusted authentication of financial agents based on distributed digital identity by using the above system, wherein the method comprises the following steps: (1) performing agent identity authentication according to a distributed digital identity DID; (2) performing dynamic permission management of the agent according to a verifiable credential VC.

[0036] As a preferred embodiment of the present application, the step (1) specifically comprises the following steps: (1.1) generate a decentralized identifier (DID) conforming to the W3C specification by initiating an identity registration request through a DID application interface, bind the generated DID to a blockchain ledger through a smart contract, and associate a DID document; (1.2) digitally sign the identity declaration through the private key bound in the DID document, and complete identity verification by the verifier through the public key information and verification method in the DID document; (1.3) if the agent's authority is changed or the identity is invalid, trigger the DID state update through the preset control verification process; otherwise, continue to step (2).

[0037] As a preferred embodiment of the present application, the step (2) specifically comprises the following steps: (2.1) issue a VC through a VC issuing module and associate it to the target distributed digital identity (DID); (2.2) upload the VC to an industry cloud platform after digitally enveloping it, and synchronize the cloud ID and the VC unique identifier to the chain for storage; (2.3) real-time obtain the cloud ID and the VC identifier through a blockchain subscription module, download the digital envelope from the cloud platform based on the cloud ID and complete decryption verification.

[0038] (2.4) if the agent initiates a data access request, the system extracts the DID and the VC ID in the request, calls the blockchain node to verify the validity of the VC, and if the verification is passed, the system automatically executes the operation and records the log; if the authority is insufficient or the VC is invalid, the request is rejected and an alarm is triggered.

[0039] The device for realizing trusted authentication of financial agents based on distributed digital identity according to the present application, wherein the device comprises: a processor configured to execute computer executable instructions; a memory storing one or more computer executable instructions, wherein the computer executable instructions are executed by the processor to realize each step of the method for realizing trusted authentication of financial agents based on distributed digital identity.

[0040] The processor for realizing trusted authentication of financial agents based on distributed digital identity according to the present application, wherein the processor is configured to execute computer executable instructions, and the computer executable instructions are executed by the processor to realize each step of the method for realizing trusted authentication of financial agents based on distributed digital identity.

[0041] The computer readable storage medium of the present application has a computer program stored thereon, which can be executed by a processor to implement the steps of the above-mentioned method for realizing trusted authentication of a financial agent based on a distributed digital identity.

[0042] In the detailed description of the present application, a cross-institutional financial agent trusted identity authentication and permission management system based on a distributed digital identity (DID) is provided, aiming to solve the problems of high trust cost, rigid permission control and lack of audit traceability in multi-agent cooperation in the securities industry. This model integrates DID, verifiable credentials (VC) and blockchain technology to realize decentralized identity verification, dynamic fine-grained permission control and operation on-chain evidence recording functions, supporting secure and efficient cooperation of financial agents (Agents) in cross-institutional scenarios. Specifically, the model generates a globally unique and decentralized identity for the financial agent based on the DID standard defined by W3C, and completes the mutual trust verification of the agent identity between institutions based on a blockchain smart contract. At the same time, the VC-based permission management mechanism encodes permission information into encrypted credentials, supports fine-grained control policies, and can update permission status in real time through a smart contract, effectively solving the problems of redundancy or deficiency caused by traditional static permission configuration. In addition, the model combines the tamper-proof nature of the blockchain to write the operation logs of the agent into the distributed ledger in real time, and the regulatory authorities can trace the operation records throughout the life cycle through on-chain evidence recording, meeting the requirements of financial regulatory compliance. The present application realizes the full-process automation of identity authentication, permission management and audit traceability through a unified architecture, improves the efficiency of agent permission configuration, realizes on-chain storage of regulatory logs, and provides a safe and compliant technical paradigm for intelligent cooperation in the securities industry.

[0043] I. Model design The present application proposes a financial agent trusted authentication system based on a distributed digital identity, which has an architecture as shown in Figure 1 The model adopts a hierarchical design idea and covers four core modules: business layer, permission layer, identity layer and foundation layer, which realize the identity authentication, permission management and data evidence recording functions of cross-institutional agents through standardized interfaces and basic components.

[0044] 1. Overall architecture The system is based on the securities industry alliance chain and industry cloud infrastructure, integrates distributed digital identity authentication services, subscription services and distributed storage services, and builds a trusted cooperation framework covering the entire life cycle.

[0045] The identity layer is equipped with DID generation, verification and query modules, relying on the DID standard defined by W3C and blockchain technology to ensure the global uniqueness and decentralization of identity identification; the permission layer deploys VC issuance, verification and digital envelope modules to achieve fine-grained permission control; the business layer includes clients and servers between securities institutions, and completes cross-institutional data calls through mutual trust verification and MCP message interaction.

[0046] Basic layer: distributed digital identity services and industry cloud infrastructure The industry's distributed digital identity service integrates distributed digital identity authentication, subscription services, and distributed storage services, and is equipped with user management, node management, and evidence management modules. Based on blockchain technology, all DID registrations, VC issuances, and data access behaviors generate immutable transaction records, allowing regulators to access audit evidence in real time through the log management interface. For example, when an intelligent agent performs a data query, the system automatically generates an evidence entry containing the DID identifier, VC permission hash, and operation results, meeting financial regulatory compliance requirements. The industry cloud infrastructure provides securities institutions with trusted data sharing cloud storage space, primarily used for encrypted shared transmission of VCs, facilitating cloud-based VC exchange between institutions.

[0047] Figure 1 The blockchain infrastructure in this context refers to distributed digital identity services. Distributed digital identity services are built on the basis of blockchain infrastructure.

[0048] Identity layer: DID generation, verification and query The system uses a distributed identity service to improve the information interaction logic of intelligent agents. Both the client and server of the intelligent agent must initiate identity registration requests to the industry's distributed digital identity service through the "DID Application" interface, generating a decentralized identifier and corresponding DID document that complies with the W3C specification. The client can obtain the server's DID metadata in real time through the DID query module and verify the validity of the server's DID through the DID verification module. After receiving the client's request, the server can also verify the validity of the client's DID through the DID verification module, completing mutual trust verification without relying on third-party authoritative institutions.

[0049] Authority layer: VC issuance and verification, digital envelope service Based on the DID identity system, a dynamic permission management mechanism is constructed, and the server generates a verifiable credential (VC) through a VC issuing module, encodes the permission information into an encrypted credential, and associates it to the target DID. When the client accesses, the server verifies the validity of the credential through the VC verification module. For example, when a certain securities company needs to open the query permission of a specific agency account, it needs to issue a VC with a timestamp and operation range restriction through the system, and the permission status is updated to the blockchain in real time. The system proposed in the application supports encrypted intercommunication of VC, and realizes point-to-point encrypted sharing of VC files through industry cloud infrastructure, digital envelope technology and blockchain subscription service, ensuring the security of VC.

[0050] 3. Technical advantages The application realizes three major breakthroughs through the hierarchical architecture of the foundation layer, the identity layer, the permission layer and the business layer. Cross-institutional identity interconnection: based on DID, the single-point failure risk of traditional OAuth mode is eliminated, and the intelligent agent realizes "one authentication, full-chain trust" between different platforms.

[0051] Dynamic permission adaptation: combined with the encryption credential mechanism of VC, on-demand authorization and real-time update are supported, and the permission configuration efficiency is improved.

[0052] Full-link traceability: blockchain storage ensures that operation logs cannot be tampered with, can meet the rapid response audit needs of regulatory agencies, and significantly reduce compliance costs.

[0053] II. Core points The application realizes a financial intelligent agent trusted authentication system based on distributed digital identity. The application has three core points: 2.1 Intelligent agent identity authentication mechanism based on distributed digital identity (DID) The application proposes an intelligent agent identity authentication mechanism based on distributed digital identity (Decentralized Identifier, DID), which aims to replace traditional OAuth and other centralized authentication modes, and solve the single-point failure risk and high trust cost problem in cross-institutional cooperation in the securities industry. The mechanism stores identity metadata through blockchain, so that the financial intelligent agent (Agent) can complete identity registration, verification and update without relying on third-party institutions, and realizes "one authentication, full-chain trust" identity interconnection.

[0054] 2.1.1 Technical implementation and process DID generation and binding: The system adopts the DID standard defined by W3C to improve the identity authentication mode of the client and server in the traditional MCP protocol. Financial agents (such as broker clients and research and analysis modules) initiate an identity registration request to the industry distributed digital identity service through the DID application interface, generating a decentralized identifier (DID) that meets the W3C specification. The DID is composed of a string, such as did:agent:123456789abcdefghi, and its generation algorithm ensures global uniqueness without relying on a centralized registration authority. The generated DID is bound to the blockchain ledger through a smart contract and is associated with a DID document (DIDDocument) that records public key information, identity verification methods (such as digital signatures), and service endpoints (Service Endpoint) metadata.

[0055] Identity verification and mutual trust verification: In cross-border transactions, cross-platform data sharing, and other cross-institutional collaboration scenarios, financial agents digitally sign their identity statements through the private key bound in the DID document, and the verifier completes identity verification by analyzing the public key information and verification methods in the DID document. For example, when an agent of institution A needs to access the data services of institution B, institution B calls the DID verification interface, extracts the public key from institution A's DID document, and verifies the digital signature provided by institution A, thereby achieving mutual trust verification between institutions without relying on third-party authentication institutions. The verification result is synchronized in real-time to the blockchain node, ensuring that the identity status is traceable and tamper-proof.

[0056] Dynamic update and permission stripping: DID documents support dynamic updates, such as when an agent's permissions change or the identity is invalid, the system triggers a DID status update through a pre-set control verification process (such as multi-signature consensus). For example, when an AI trading module of a certain broker needs to revoke its permissions due to security vulnerabilities, its DID document can be automatically marked as "disabled" through a smart contract and synchronized to all chain nodes, avoiding the risks caused by permission stripping delays in traditional centralized systems.

[0057] 2.1.2 Technical advantages Reduced cross-institutional trust costs: Replace OAuth with DID to eliminate repeated identity verification processes and reduce cross-platform identity mutual recognition delays.

[0058] Improved anti-single-point failure capability: DID metadata is distributedly stored in blockchain nodes, ensuring identity service availability even if some nodes fail, avoiding the vulnerability of centralized authentication systems.

[0059] In summary, the agent identity authentication mechanism based on distributed digital identity (DID) proposed in the application can effectively solve the challenge of centralized identity authentication in financial agent calling.

[0060] 2.2 Agent dynamic permission management mechanism based on verifiable credentials (VC) The application constructs a dynamic permission management model based on verifiable credentials (VC), realizes fine-grained permission control and real-time update through an encryption credential mechanism, and solves the problems of redundancy or deficiency caused by traditional static permission configuration. The mechanism encodes the permission information into an encrypted credential, binds it to a DID identifier, and dynamically adjusts the permission state through a smart contract to ensure that the permission adapts to business changes.

[0061] 2.2.1 Technical implementation and process VC issuance and permission encoding: The permission management module adopts the W3C VC data model, encodes the permission information (such as "only allow reading the balance of user X's account" and "valid until T+1 day") into a structured JSON-LD format, and generates a VC through the signature of the issuer's private key. The institution can issue a VC through the VC issuance module and associate it with the target DID.

[0062] VC encrypted transmission: Due to the sensitivity of financial industry data, the transmission process of VC needs to be encrypted for protection. The application uses digital envelope technology combined with industry cloud and blockchain subscription mechanism to realize secure transmission. The specific process is as follows: after the VC is encrypted by digital envelope, it is uploaded to the industry cloud platform, and the cloud ID and VC unique identifier are simultaneously stored on the chain; the target agent obtains the cloud ID and VC identifier in real time through the blockchain subscription module, downloads the digital envelope from the cloud platform based on the cloud ID, and completes the decryption verification. This scheme ensures the traceability of the transmission path through blockchain, and uses digital envelope technology to ensure the confidentiality and integrity of the data in the transmission process.

[0063] Dynamic permission verification and execution: When the agent initiates a data access request, the system extracts the DID and VC ID in the request and calls the blockchain node to verify the validity of the VC. The verification process includes: Signature verification: verify the integrity of the VC signature through the public key in the DID document.

[0064] State query: call the smart contract to check whether the VC is revoked or expired.

[0065] Permission matching: compare the request operation with the permission range defined in the VC (such as "only allow reading the balance").

[0066] If the verification is passed, the system automatically performs the operation and records the log; if the permission is insufficient or the VC is invalid, the request is rejected and an alarm is triggered.

[0067] 2.2.2 Technical advantages and effects Efficiency of permission configuration is improved: the VC is automatically issued and updated by the smart contract, reducing the manual approval link, and the permission approval process is compressed from manual intervention to second-level response.

[0068] Minimize disclosure principle: the VC supports only verifying necessary information, reducing the risk of data leakage.

[0069] Enhanced risk control capability: the dynamic permission update mechanism can block unauthorized operations in real time. For example, after an AI model is marked due to abnormal behavior, its VC permission can be revoked immediately to prevent data misuse.

[0070] In summary, the intelligent agent dynamic permission management mechanism based on verifiable credentials (VC) proposed in the application can effectively solve the challenge of

static permission management, lack of fine-grained management capability

[0071] 2.3 Blockchain storage and audit mechanism design for intelligent agent calling record The application proposes a blockchain-based intelligent agent calling record storage and audit framework, which realizes the full-link solidification of operation log through smart contract, ensures that regulatory agencies can subscribe to AI model behavior in real time, and meets the compliance requirements of the financial industry.

[0072] 2.3.1 Technical implementation and process Call log generation and chaining: Each interaction of the intelligent agent generates a structured log entry, including the following fields: (1) timestamp: operation timestamp.

[0073] (2) DID: initiator identity.

[0074] (3) VCHash: associated permission credential hash value.

[0075] (4) action: operation type (such as data query, model training).

[0076] (5) resultHash: operation result data hash.

[0077] The log entry is written into the blockchain through the smart contract, generating an unalterable timestamp and operation chain.

[0078] On-chain storage and real-time audit: The regulatory agency or enterprise can call the blockchain node through the API interface to obtain a tamper-proof copy of the operation log in real time. For example, in a high-frequency trading scenario, if an AI model triggers an abnormal order, the regulatory system can immediately retrieve its full life cycle log, including: For example, in a high-frequency trading scenario, if an AI model triggers an abnormal order, the regulatory system can immediately retrieve its full life cycle log, including: (1) DID document parsing records in the identity verification stage.

[0079] (2) VC signature and status query in the permission verification stage.

[0080] (3) Log and result feedback in the call execution stage.

[0081] Abnormal operation traceability: The blockchain storage mechanism ensures that the operation log has legal effect. For example, when an AI trading system of a securities company causes loss due to algorithm error, the following key information can be traced back through the on-chain log: (1) DID and VC permission of the operation initiator.

[0082] (2) Log record in the call execution process.

[0083] 2.3.2 Technical advantages and effects Audit traceability efficiency is improved: through the storage function in the distributed digital identity service, the chain log call time is reduced from minutes to seconds in traditional systems.

[0084] Regulatory compliance is enhanced: on-chain storage ensures that operation records are tamper-proof, meeting the hard requirements of relevant laws and regulations on financial data traceability.

[0085] Abnormal processing cost is reduced: automated audit rules and real-time subscription reduce the human investment in subsequent investigations.

[0086] In summary, the blockchain storage audit mechanism designed for intelligent agent call records can effectively solve the challenge of

audit traceability absence

[0087] The workflow diagram of the present application is shown in Figure 4 This intelligent agent identity authentication and permission management workflow provides an efficient and reliable communication mechanism for cross-institutional financial intelligent agents, enhancing the security of financial intelligent agents.

[0088] Step 1: VC application and transmission The agency A client submits an identity authentication request to the alliance chain node A, obtains a client DID, discovers a service end DID in a distributed digital identity service, and applies for an access VC to the alliance chain node A. The VC is encrypted through the digital envelope technology, and the access VC is forwarded to the alliance chain node B through the industry cloud and the blockchain subscription.

[0089] Step 2: Cross-chain identity verification and mutual trust establishment The alliance chain node B calls the smart contract to parse the DID document of the agency A, verifies the validity of the public key and the identity state, and verifies the validity and expiration time of the VC. If the verification is passed, and it is confirmed that it has access rights, the agency B service end applies for an authorized VC to the alliance chain node B, and the authorized VC is encrypted and transmitted to the node A in the same way.

[0090] The alliance chain node B calls the smart contract to parse the DID document of the agency A, verifies the validity of the public key and the identity state, and verifies the validity and expiration time of the VC. If the verification is passed, and it is confirmed that it has access rights, the agency B service end applies for an authorized VC to the alliance chain node B, and the authorized VC is encrypted and transmitted to the node A in the same way.

[0091] Step 3: Standardized message exchange starts After receiving the authorized VC, the agency A client verifies the validity of the authorized VC. After passing, the formal intelligent body message interaction based on HTTP is started, and the access VC and the authorized VC are included in the request at the same time. Only when both of them are valid, the service end can answer the data.

[0092] Step 4: Operation record on-chain notarization The key operations (such as DID verification, VC check, session establishment) of the whole identity determination process are written into the blockchain through the smart contract, to generate an unalterable timestamp and operation chain, to ensure that the whole life cycle behavior is traceable, and to meet the regulatory compliance requirements.

[0093] The technical solution focuses on the cross-agency cooperation scene of financial intelligent agents in the securities industry, and solves the problems of intelligent agent identity authentication, permission management and operation traceability.

[0094] In terms of technical architecture, the technical solution adopts a four-layer hierarchical architecture (basic layer, identity layer, permission layer and business layer), supports through the basic layer supported by the blockchain and the industry cloud, and forms a full-link trusted cooperation framework through the business layer interaction of the MCP protocol.

[0095] In terms of core mechanism, the technical solution includes the intelligent agent identity mutual trust verification based on DID, the dynamic permission update bound by VC and smart contract, and the operation log whole life cycle on-chain notarization mechanism.

[0096] The technical solution generates a DID conforming to the W3C specification for a financial agent, binds a blockchain through a smart contract, and supports cross-institutional identity verification based on the MCP protocol. The DID technology is applied to a financial agent for the first time, solving the identity trust problem of cross-institutional collaboration of agents and breaking through the limitations of the traditional OAuth mode.

[0097] The technical solution encodes permission information based on VC encryption credentials, realizes point-to-point encryption transmission of VC by combining digital envelope technology, and realizes real-time synchronization of permission status through a blockchain subscription service, realizing fine-grained division and real-time adjustment of permissions, meeting the needs of temporary permission authorization and high-frequency transaction permission changes in the securities industry, and improving business flexibility.

[0098] The operation log (including DID verification, VC verification, and data interaction) of the agent is written into the blockchain through a smart contract, supports real-time auditing by regulatory agencies, provides tamper-proof technical support for financial regulation, solves the compliance traceability problem of autonomous decision-making of agents, and reduces regulatory costs.

[0099] The basic layer of the technical solution integrates blockchain and industry cloud, and the identity layer, permission layer, and business layer cooperate through standardized interfaces, supporting end-to-end trusted collaboration of cross-institutional agents, building a complete technical framework for financial agent collaboration, realizing seamless connection of identity, permission, and business, and improving system scalability and security.

[0100] The specific implementation scheme of the embodiment can be referred to the related description in the above-mentioned embodiments, which will not be repeated here.

[0101] It can be understood that the same or similar parts in the above-mentioned embodiments can be mutually referred to, and the contents not described in detail in some embodiments can be referred to the same or similar contents in other embodiments.

[0102] It should be noted that in the description of the present application, the terms "first", "second", etc. are only for the purpose of description, and cannot be understood as indicating or implying relative importance. In addition, in the description of the present application, unless otherwise specified, the meaning of "a plurality of" is at least two.

[0103] Any process or method descriptions in the flowcharts or otherwise described herein, represent an example of executable instructions for performing a certain function or set of functions and can be understood as representing a module, segment, or portion of code that comprises one or more executable instructions for implementing the specified logical function or set of functions. The scope of preferred embodiments of the present application includes additional implementation in which the functions are performed in a different order, in substantially simultaneous fashion, or in reverse order, according to the functions involved, which should be understood by those skilled in the art to which the embodiments of the present application belong.

[0104] It should be understood that aspects of the application can be implemented in hardware, software, firmware or a combination thereof. In the above embodiments, various steps or methods can be implemented in software or firmware that is stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, and in another embodiment, any of the following techniques can be used to implement the hardware: discrete logic circuitry having logic gates for implementing logic functions upon data signals, application specific integrated circuits having appropriate combinational logic gates, programmable gate arrays (PGA), field programmable gate arrays (FPGA), and / or other implementations known to those of skill in the art.

[0105] Those of skill in the art would understand that all or a portion of the exemplary methods described above can be carried out by a programmed computer or a specialized computer system. In an embodiment, the program is stored in a computer readable storage medium, which can be implemented in any of a variety of ways, including as a computer program product stored on a computer storage medium.

[0106] In addition, each functional unit in the various embodiments of the present application can be integrated in one processing module, or each unit can exist physically, or two or more units can be integrated in one module. The above-mentioned integrated module can be realized in the form of hardware or in the form of a software function module. If the integrated module is realized in the form of a software function module and sold or used as an independent product, it can also be stored in a computer readable storage medium.

[0107] The above-mentioned storage medium can be a read-only memory, a magnetic disk or an optical disk, etc.

[0108] In the description of the present specification, the description of the terms "one embodiment", "some embodiments", "an example", "a specific example" or "some examples" etc. means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. In the present specification, the illustrative description of the above terms does not necessarily mean the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0109] The system for realizing trusted authentication of financial agents based on distributed digital identity adopts the fusion and innovation of distributed digital identity (DID), verifiable credential (VC) and blockchain technology, realizes the decentralization of identity authentication, the dynamicization of permission management and the full-link tracing of audit in the agent cooperation scene of the securities industry. The application replaces the traditional OAuth mode with DID, solves the single point failure risk of centralized identity verification and the problem of cross-institutional repeated verification. Specifically, the financial agent completes identity mutual trust verification through the DID document stored by the blockchain, and can realize "one authentication, full-link trust" without relying on third-party institutions. Based on the encryption credential mechanism of VC, the application realizes the fine-grained division and real-time update of permissions. The permission information is dynamically issued and verified through the smart contract, supports on-demand authorization and temporary permission configuration, effectively solves the redundancy or deficiency problem of the traditional static permission system in the business scene adaptation. In addition, the permission state is bound with the blockchain evidence, ensuring the instant synchronization and traceability of permission changes, and significantly enhancing the security and response efficiency of permission management. The application realizes the full life cycle storage of the operation log of the agent through the blockchain, ensures that the supervisory agencies can subscribe and trace the AI model behavior in real time. The key operations such as tool calling and result feedback in the agent interaction are written into the blockchain in the form of structured log, combined with the automatic audit rules of the smart contract, significantly improves the compliance evaluation and risk control ability, and provides unalterable technical support for financial supervision.

[0110] In this specification, the application has been described with reference to its particular embodiments. It is clear, however, that various modifications and changes can be made without departing from the spirit and scope of the application. Therefore, the specification and drawings should be considered illustrative rather than restrictive.

Claims

1. A system for implementing trusted authentication of financial intelligent entities based on distributed digital identity, characterized in that: The system includes a basic layer, an identity layer, a permission layer and a business layer. The basic layer, identity layer, permission layer and business layer are connected in sequence. The basic layer is used to integrate distributed digital identity authentication services, subscription services and distributed storage services to build a trusted collaboration framework covering the entire life cycle; the identity layer is used to configure DID generation, DID verification and DID query modules; the permission layer is used to deploy VC issuance, VC verification and digital envelope modules to achieve fine-grained permission control; the business layer includes clients and servers between securities institutions, and cross-institutional data calls are carried out through mutual trust verification and MCP message interaction.

2. The system for implementing trusted authentication of financial intelligent entities based on distributed digital identity according to claim 1, characterized in that: The basic layer includes distributed digital identity services and industry cloud infrastructure. The distributed digital identity services integrate digital identity distributed authentication, subscription services and distributed storage services, and are used to configure user management, node management and evidence management. The industry cloud infrastructure provides trusted data sharing cloud storage space for encrypted shared transmission of VC, realizing VC exchange between institutions in the cloud.

3. The system for implementing trusted authentication of financial intelligent entities based on distributed digital identity according to claim 1, characterized in that: The identity layer includes a DID generation module, a DID verification module and a DID query module. The DID verification module is connected to the DID generation module, and the DID query module is connected to the DID verification module. The DID generation module is used to accept identity registration requests and generate a decentralized identifier and a corresponding DID document. The DID query module obtains the DID metadata of the server in real time. The DID verification module verifies the validity of the server DID or verifies the validity of the client DID.

4. The system for implementing trusted authentication of financial intelligent entities based on distributed digital identity according to claim 1, characterized in that: The permission layer includes a VC issuance module, a VC verification module and a digital envelope module. The VC verification module is connected to the VC issuance module, and the digital envelope module is connected to the VC verification module. The VC issuance module generates a verifiable certificate VC, encodes the permission information into an encrypted certificate and associates it with the target DID. The VC verification module verifies the validity of the certificate, and the digital envelope module realizes point-to-point encrypted sharing of VC files.

5. A method for implementing trusted authentication of financial intelligent entities based on distributed digital identity based on the system of claim 1, characterized in that: The method comprises the following steps: (1) Authentication of intelligent entities based on distributed digital identities (DIDs); (2) Dynamic authority management of intelligent entities based on verifiable credentials VC.

6. The method for implementing trusted authentication of financial intelligent entities based on distributed digital identity according to claim 5, characterized in that: The step (1) specifically includes the following steps: (1.1) Initiate an identity registration request through the DID application interface to generate a decentralized identifier (DID) that complies with the W3C specification. Bind the generated DID to the blockchain ledger through a smart contract and associate it with the DID document. (1.2) The identity statement is digitally signed using the private key bound to the DID document. The verifier completes identity verification by parsing the public key information and verification method in the DID document. (1.3) If the agent's permissions change or its identity becomes invalid, the DID status update is triggered through the preset control verification process; otherwise, continue with step (2).

7. The method for implementing trusted authentication of financial intelligent entities based on distributed digital identity according to claim 5, characterized in that: The step (2) specifically includes the following steps: (2.1) Issue VC through the VC issuance module and associate it with the target's distributed digital identity DID; (2.2) Encrypt the VC in a digital envelope and upload it to the industry cloud platform, and simultaneously store the cloud ID and VC unique identifier on the chain; (2.3) Obtain the cloud ID and VC identification in real time through the blockchain subscription module, download the digital envelope from the cloud platform based on the cloud ID and complete decryption verification; (2.4) If the agent initiates a data access request, the system extracts the DID and VC ID in the request and calls the blockchain node to verify the validity of the VC. If the verification is successful, the system automatically executes the operation and records the log; if the authority is insufficient or the VC is invalid, the request is rejected and an alarm is triggered.

8. A device for implementing trusted authentication of financial intelligent entities based on distributed digital identity, characterized in that: The device comprises: a processor configured to execute computer-executable instructions; A memory storing one or more computer-executable instructions, wherein when the computer-executable instructions are executed by the processor, the steps of the method for realizing trusted authentication of a financial intelligent entity based on a distributed digital identity as described in any one of claims 5 to 7 are implemented.

9. A processor for implementing trusted authentication of financial intelligent entities based on distributed digital identity, characterized in that: The processor is configured to execute computer-executable instructions. When the computer-executable instructions are executed by the processor, the various steps of the method for realizing trusted authentication of financial intelligent entities based on distributed digital identity as described in any one of claims 5 to 7 are implemented.

10. A computer-readable storage medium, characterized in that A computer program is stored thereon, and the computer program can be executed by a processor to implement the various steps of the method for realizing trusted authentication of financial intelligent entities based on distributed digital identity as described in any one of claims 5 to 7.

Images