NFC-based doll digital identity binding authentication method

Abstract

The application discloses a doll digital identity binding authentication method based on NFC, relates to the technical field of near field identity right confirmation, and comprises five steps: production side casting and packaging, writing a unique identification code into a chip and generating a digital doll identity card and a signature digest; first sticking and opening light binding, one-to-one strong binding with a digital wallet after verification; second sticking and non-inductive authentication, generating a session ticket and a direct service page of a fingerprint continuation; rule-driven exclusive point distribution and accounting, forming an accounting voucher and registering in an account book; user-generated content identity imprint and safe transfer, generating a content digest and a transfer session proof and completing control right migration; and the like. The method realizes integrated right confirmation, authentication and traceability of entities and numbers, supports login-free continuation, rule-based accounting and account registration, identity imprint and double-end handshake type transfer, and supports a full-chain closed-loop process of right confirmation, traceability and settlement.

Description

Technical Field

[0001] This invention relates to the field of near-field identity verification technology, specifically to a method for binding and authenticating the digital identity of a doll based on NFC. Background Technology

[0002] In recent years, trendy toys and licensed merchandise have expanded rapidly through e-commerce, offline stores, and social media platforms. A single toy often corresponds to multiple digital touchpoints, including brand mini-programs, third-party communities, trading platforms, and authentication tools. After purchase, consumers need to register separate wallets, identity accounts, and community accounts, resulting in frequent cross-application jumps and a disconnect between identity and assets. Furthermore, secondhand transactions, raffles, item redemption, and tipping require verification of authenticity, unique ownership, and verifiable records. Current processes largely rely on QR codes or easily copied serial numbers, making it difficult to achieve reliable authentication and ownership confirmation with a low-friction, hands-free experience. The production side also lacks a digital birth certificate for service from the factory, leading to increased costs for subsequent anti-counterfeiting, recalls, and channel management.

[0003] The main limitations of existing technologies are as follows: First, at the manufacturing stage, a read-only mapping and signature verification chain between the unique identification code and the doll's metadata is generally not established, making it impossible to verify the source before the first contact. Second, the first contact is mostly a one-time QR code registration, failing to achieve a strong one-to-one binding between the doll and the digital wallet and digital identity. Subsequent logins still rely on passwords or verification codes, making it difficult to use the doll as a login-free entry point. Third, subsequent contacts lack seamless activation and session continuation using a unique identification code as a token. Terminals and servers also lack risk-based verification and weak network fault tolerance, resulting in an unstable experience and susceptibility to replay effects. Fourth, the issuance and recording of exclusive points triggered by style or scarcity attributes are either absent or only exist in rewritable logs, making it difficult to support accountability in scenarios such as redemption, lottery, trading, and tipping. These defects are compounded in the purchase-first contact-re-use of rights chain, weakening repeat visits and brand trust.

[0004] Therefore, the specific technical challenges we face are as follows: in doll applications that use near-field communication as the physical entry point, we need to establish a verifiable and sustainable digital identity and account association with a unique identification code as the primary key, and form a traceable chain of ownership and behavior records, while taking into account low-friction interaction and anti-cloning security, focusing on the four stages of production certification, initial attachment binding, subsequent attachment without login, and rule-based points distribution and accounting. Summary of the Invention

[0005] (a) Technical problems to be solved

[0006] To address the shortcomings of existing technologies, this invention provides an NFC-based digital identity binding and authentication method for dolls. Through manufacturing and packaging, a unique identification code is written into the chip, generating a digital doll ID card and signature digest. Initial contact with the doll enables binding, followed by a one-to-one strong binding with a digital wallet after verification. Subsequent contact enables seamless authentication, generating a session ticket and allowing direct fingerprint access to the service page. Rule-driven exclusive points are distributed and recorded, forming accounting vouchers and registering them in the ledger. User-generated content identity imprints and secure transfers are achieved, generating content digests and transfer session proofs to complete the transfer of control. This realizes integrated ownership confirmation, authentication, and traceability of both physical and digital entities, enabling login-free continuation, rule-based accounting and ledger registration, identity imprinting, and two-way handshake-style transfer, thereby solving the technical problems described in the background section.

[0007] (II) Technical Solution

[0008] To achieve the above objectives, the present invention provides the following technical solution:

[0009] The NFC-based digital identity binding and authentication method for dolls includes writing a unique identification code into a near-field communication chip and embedding the manufacturer's identifier, generating an initial record of the digital doll's ID card on the service platform, establishing a read-only mapping of the unique identification code, the digital doll's ID card, and the doll's metadata, and registering the forging event.

[0010] Upon initial contact, the unique identification code is read, the mapped signature digest is verified, the digital doll's ID card is activated, and it is strongly bound one-to-one with the digital wallet generated for the doll, forming an activation binding relationship, and a binding certificate is returned.

[0011] When the doll is tapped again, the doll completes authentication without login by mapping the unique identification code to the digital doll ID card, generates a session ticket and continues to the doll's exclusive service page. The session ticket serves as the subsequent entry point and is stored on the disk to continue fingerprint information.

[0012] The service platform calculates the amount of exclusive points issued based on the rules mapping using the doll's metadata and interaction events, deposits the points into the digital wallet, collects them according to the exclusive point type, and generates accounting vouchers for issuance, transfer and use and records them in an immutable ledger;

[0013] When publishing content, a content summary is calculated and the digital doll ID is combined with time to form an identity imprint and archived; when transferring to a second-hand location, a transfer session certificate is generated through a near-field two-way handshake, the control of the digital doll ID is transferred and the transfer event is registered.

[0014] Furthermore, the unique identifier and the doll's metadata are encoded in a fixed field order to generate a signature digest; the signature digest is written into the user area of ​​the near-field communication chip according to the storage offset and locked, and the offset and length mapping is registered on the service platform; the signature digest fingerprint is associated with the initial record of the digital doll's ID card.

[0015] Furthermore, a manufacturer signature is generated by pairing the manufacturer key with the signature digest, and a readback comparison is performed after writing, issuing a pass indication according to the preset consistency criteria; and the forging event, together with the manufacturer signature and time stamp, is registered in the immutable ledger.

[0016] Furthermore, upon initial connection, the mobile device generates a one-time random number and device verification, and the service platform returns a binding challenge response. Within the trusted execution environment, the mobile device derives a digital wallet address based on the challenge response, unique identifier, and signature digest, and submits the address fingerprint only to the service platform.

[0017] Furthermore, a binding certificate is constructed that includes a unique identifier, digital doll ID number, digital wallet address, transfer credential seed, and binding time. The platform binding key signs and generates a binding certificate identifier, and the corresponding binding record is registered in the immutable ledger.

[0018] Furthermore, upon re-attaching, a session ticket is generated based on the unique identifier, digital doll ID number, binding certificate, timestamp, and random quantity; and a continuation fingerprint is generated based on the session ticket, digital wallet address, and device proof, and the continuation fingerprint is stored on disk along with the page status.

[0019] Furthermore, the risk level is calculated based on the device integrity score, attachment frequency, geographic location drift, and binding consistency error, and compared with the threshold to obtain an acceptance indication; when acceptance fails, it switches to mirror read-only mode, generates a local snapshot summary, and forms a reconciliation verification code for verification during recovery.

[0020] Furthermore, the rule template is loaded, and the doll metadata vector, interaction event vector, and acceptance indication are mapped to the suggested distribution amount. Then, the suggested distribution amount is trimmed according to the total limit, daily limit, and cooldown window to obtain the final distribution amount, which is then credited to the digital wallet.

[0021] Furthermore, an accounting voucher summary is generated using the digital doll's ID number, digital wallet address, exclusive points type, final distribution amount, session ticket, continued fingerprint, and distribution time. This summary and distribution record are then registered in an immutable ledger and a record identifier is returned.

[0022] Furthermore, when publishing content, the content payload is extracted and the content digest is calculated. The digital doll's ID card identifier and the content digest are written together with metadata and an invisible watermark to form an identity mark. The platform's content key is used to sign and generate a content mark certificate and save a reference pointer.

[0023] Furthermore, during a secondhand transfer, the seller and buyer are simultaneously positioned in a near-field environment. Based on the transfer credential seed, unique identifier, digital doll ID number, and the device certificates of both parties and the transfer time, a transfer session certificate is generated, and the transfer record is registered, pointing control to the new wallet address.

[0024] Furthermore, historical preservation includes freezing write permissions to the old wallet address associated with the digital doll ID after the control transfer is completed, while retaining query permissions, and archiving historical control entries and ledger record identifiers of transfer records in the digital doll ID's identity card.

[0025] Furthermore, write layout management includes: performing loopback write and recording loopback indication when the remaining space in the user area is insufficient to continuously write signature digests; if the near-field communication chip does not support loopback write, indented write is used and the indentation offset is recorded, and the record is consistent with the read-only mapping.

[0026] (III) Beneficial Effects

[0027] This invention provides an NFC-based method for binding and authenticating the digital identity of a doll, which has the following advantages:

[0028] Around the production side of casting and packaging, a unique identification code, manufacturer's identifier, and signature digest are solidified on both sides of the near-field communication chip and service platform, forming an initial chain of evidence. This ensures that the same physical object can be identified and has a traceable origin before its first contact. During the initial contact binding, after verifying the mapping and signature digest, a one-to-one strong binding is established between the digital doll's ID card and the digital wallet. The mobile terminal completes address derivation and minimal storage within a trusted environment, unifying the entry point and account system.

[0029] In the seamless authentication and session continuation of reconnection, the system inherits the previous binding facts based on the session ticket and continuation fingerprint, allowing users to enter the exclusive service page without logging in. This is combined with risk control judgment, mirror read-only, and reconciliation replenishment to stably handle weak networks and high-frequency connections. In the rule-driven exclusive points distribution and accounting, the system accesses the doll's metadata and interaction events through rule mapping, trims and records them, and generates accounting vouchers to be registered in an immutable ledger. This connects identity, wallet, and rights under the same anchor point.

[0030] In the process of identifying user-generated content, a content summary is extracted and associated with the digital doll's ID card and the continued fingerprint. The platform signs a content identification certificate to make the identity of the content item verifiable and the reference traceable, which facilitates unified settlement and management. In the secondary transfer process, the buyer and seller generate a transfer session certificate through a near-field two-way handshake, transferring the control of the digital doll's ID card to a new digital wallet. The transfer record and historical control are registered in the ledger to ensure consistency of records across the entire chain. Attached Figure Description

[0031] Figure 1 This is a schematic diagram of the NFC-based doll digital identity binding and authentication method of the present invention. Detailed Implementation

[0032] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0033] Please see Figure 1 This invention provides an NFC-based method for binding and authenticating the digital identity of a doll, including:

[0034] Step 1: At the factory workstation, a verifiable birth certificate is created for each doll. A read-only mapping is established between the unique identification code, the digital doll ID card, and the doll's metadata. A signature digest is generated synchronously and solidified into the chip and service platform. The certificate creation event is registered in an immutable ledger for subsequent binding, registration exemption, and traceability.

[0035] For the production end, the current practice of casting and packaging generally only involves affixing QR codes or printing serial numbers on the packaging, which cannot ensure a strong coupling between the doll and its digital identity, and does not have a verifiable manufacturer signature chain.

[0036] To ensure a trustworthy start before the initial binding, the unique identifier and the doll's metadata need to be bound in a deterministic manner on the production side. At the same time, an offline verifiable summary needs to be generated, and the storage layout and verification order need to be specified so that the binding and login-free authentication of subsequent steps have traceable upstream evidence.

[0037] After reading the unique identification code at the chip programming station, the doll's metadata is assembled in a fixed encoding order, and then input into the digest generation function along with the timestamp and batch number to obtain the signature digest. Subsequently, the digest is written to the specified location in the chip's user area according to the offset strategy and synchronized to the platform side. Finally, the manufacturer's signature is generated using the manufacturer's private key and saved together with the digest index.

[0038] To avoid the risk of easy duplication due to relying solely on unique identifiers, a combination of deterministic encoding and hierarchical digests is adopted: First, the doll's metadata is encoded in a fixed field order and then concatenated with the unique identifier, timestamp, and production batch number. Then, a hierarchical hash is used to obtain the signature digest, where:

[0039]

[0040] Among them: signature digest A fixed-length binary string, a set of fixed-bit lengths, used as a digest benchmark for manufacturer signatures and read-only mappings; hash function. , Input is a binary string of arbitrary length; output is a fixed bit length; unique identifier. : Derived from the near-field communication chip hardware sequence;

[0041] Doll metadata vector : An ordered binary representation containing fields such as series, style, number, and production date; timestamp The value is an integer in seconds or milliseconds from the production line time record; production batch number. The value is an integer or fixed-length code that identifies the batch of items for the current day or shift. Salt value, which is a batch-level random binary string generated by the platform. Its purpose is to enhance the digest's resistance to pre-computation attacks.

[0042] At the information technology workstation, the reader collects the unique identification code and calls the fixed encoder to encode the doll's metadata vector in an ordered manner. After generating a concatenated string, it is injected with hash function one and hash function two to obtain the signature digest. The digest is then filled back into the workstation task sheet and synchronized with the platform side.

[0043] When in use, through deterministic encoding and hierarchical digests, the signature digest forms an inseparable correspondence with the unique identifier, doll metadata, timestamp, and batch number, so that any subsequent read can be based on the digest for consistency checks; due to the introduction of salt, the digest is difficult to forge offline, reducing the feasibility of copying and replaying.

[0044] To reduce collisions and alignment errors when writing to the user area of ​​the chip between different batches of toys, an offset calculation based on the digest is used to write the digest to a specific location in the user area, and a verification index is reserved for devices without a read-only area.

[0045]

[0046] Where: storage offset : A non-negative integer used to determine the position of the first byte of the user area; scale factor : Values ​​are rational numbers within a closed interval, used for alignment to word boundaries or page boundaries; Modulo operator Maps the hash output to a user space length range; hash The result of hashing the signature digest again introduces diffusion; tag user area length. The value is a fixed value for the chip specifications.

[0047] Offset boundary: when When loopback is performed, loopback writing is executed and loopback indication is recorded. When reading back, the same rule is followed to restore the original state. If the chip does not support loopback writing, indentation writing is performed instead and indentation offset is recorded. The two correspond one-to-one in the workstation transfer sheet.

[0048] The workstation control program calculates the storage offset and writes the signature digest into consecutive bytes in the user area. If the chip has a read-only area, it writes the digest fingerprint and length synchronously and locks the read-only area. If there is no read-only area, it writes a triplet of digest index-digest length-digest fingerprint in the user area and locks it. The platform side records the offset and length to form a readable area mapping.

[0049] In use, the determinism of offset and layout allows any read to directly locate the digest position, reducing offset caused by differences in reader posture; the triplet structure provides a verifiable entry point for devices without a read-only area, enhancing consistency and readability.

[0050] By using hierarchical summaries and deterministic layouts, the three elements of read-only mapping, summary, and location of the doll are solidified before it leaves the factory, so that any subsequent step can be read and compared along the same path, forming a consistent verification entry point.

[0051] A mere summary is insufficient to prevent man-in-the-middle substitution. Manufacturer signatures and platform registration are needed to establish a consistent link from the production end to the platform end. At the same time, executable acceptance criteria should be provided at the workstation level to avoid relying on subjective judgment.

[0052] After the layered digest and writing are completed, the digest is signed with the manufacturer's private key, the signature and public parameters are registered on the platform side, the chip is read back for verification, a clear pass criterion is given and a signal for sealing or rollback is output, and finally the forging event is written into the immutable ledger.

[0053] Furthermore, the manufacturer's signature serves as proof that the summary is indeed the result confirmed by the manufacturer; the readback consistency criterion is used to determine on-site at the workstation whether the box can be sealed.

[0054]

[0055] Among them: Manufacturer's signature : Signature data with fixed length or structure, used to prove that the digest has been verified by the manufacturer; signature operator Mapping the digest to signature data can be done using elliptic curve digital signature families; manufacturer's private key. : The value is an element within the key space, and its function is to serve as a secret parameter for signing; : Signature summary, meaning the same as above.

[0056]

[0057] Among them: Acceptance Instructions : Takes a binary value and is used to determine whether to pass or fail; indicator operator The input is a logical expression, and the output is a binary value. Verification operator, inputs are signature, digest and manufacturer's public key, output is binary, can use elliptic curve digital signature family;

[0058] Manufacturer Public Key Its function is to publicly verify the signature; distance function The input consists of two binary strings, and the output is a non-negative integer. Its purpose is to measure the bit difference between the read-back value and the digest. The distance function used is bit Hamming distance.

[0059]

[0060] Symbol meaning: Hamming distance; According to the agreed bit length; For equal-length binary strings (such as readback values) With Abstract ).

[0061] Read back value The value is the binary string read from the chip's user area by an offset; threshold. : A non-negative integer, representing the upper limit or threshold of allowed read / write errors. Determined by random sampling at the workstation.

[0062] After the workstation control program completes the digest writing, it immediately performs a read-back operation, obtaining the read-back value based on the offset and length, and performing signature verification and distance determination locally. When the acceptance indicator is "pass," the system generates a sealable signal and registers the signature and common parameters on the platform. When it fails, a rollback procedure is triggered and an exception barcode is output so that the material can be transferred to the exception warehouse. Optional engineering path: In the signature generation and verification stage, an elliptic curve signature library and hardware security unit are used for key management; in the distance function calculation, a bit operation pipeline can be used to ensure controllable calculation latency. In use, through the dual criteria of signature and read-back, a clear pass-fail decision can be formed at the workstation, reducing the flexibility of human judgment; the signature chain and registration record together provide the root of trust for subsequent initial contact and secondary verification.

[0063] After passing the criteria, the forging event needs to be written into an immutable ledger, completing the handover loop with the warehousing system. Further, the platform constructs a transaction payload using a unique identifier, digest fingerprint, manufacturer signature, timestamp, and production batch number, and submits it to the ledger service. After the ledger returns the transaction identifier, the platform writes a handover record in the production execution system and changes the workstation status from pending review to ready for sealing. The warehousing system then generates an inbound list and prints the inner label at the sealing workstation. Ledger registration provides a verifiable chain of evidence for subsequent initial labeling and secondary circulation; the handover loop ensures that materials have only a single channel between transit and rollback, reducing inconsistencies across systems. Through manufacturer signature, read-back consistency criteria, and ledger registration, a verifiable link is constructed from the production workstation to the platform, ensuring the authenticity of the certificate's origin, the verifiability of its content, and the traceability of its process.

[0064] As a supplementary explanation, the ledger side can use services based on Byzantine fault-tolerant consensus, and transaction serialization adopts a binary serialization format; in the load construction, cubic spline interpolation can be used to correct the slight deviation between the reader clock and the platform clock for the timestamp; in the workstation arrangement, the selection of offset and sampling ratio can be given by the integer constraint solver, so that the write positions of different batches in the user area are distributed.

[0065] Step 2: Complete source verification, digital doll ID activation, and one-to-one strong binding with digital wallet in a single bonding process, making the doll a unified entry point; derive wallet address and generate binding certificate in the trusted environment of the mobile terminal, and pre-embed transfer credential seed to provide a single primary key and verifiable basis for subsequent session continuation and secure transfer.

[0066] Relying solely on a unique identifier for binding exposes the risk of cloning and replay attacks; furthermore, if the wallet address is issued unilaterally by the platform, the mobile device cannot prove that the address originated from the binding relationship. Therefore, it is necessary to establish a system based on a unique identifier... With signature digest The input is a one-time challenge process, and the challenge result is coupled with terminal security materials to derive a traceable wallet address, avoiding the binding of wallets of unknown origin with counterfeit ones.

[0067] After the mobile device is passively invoked, it reads the unique identifier. Signature digest located with digest offset Equipment verification With one-time random numbers The platform side binds the seed key. Calculate the response and issue verification tasks; the mobile terminal then uses this to generate a linked wallet address. The session materials are then packaged and prepared for the activation phase.

[0068] Furthermore, to establish trust and binding upon the initial connection, the platform uses a unique identifier. With signature digest One-time random number and equipment certificates Calculate the response volume and send it back to the mobile device to complete the consistency verification between the local device and the platform:

[0069]

[0070] Where: Unique Identifier Near-field communication chip hardware sequence, which is a fixed-length byte sequence; signature digest Layered digests generated during the factory manufacturing process, fixed-length binary strings; one-time random numbers. Generated by a mobile security environment, it is a high-entropy integer; bound to a seed key. The platform only contains key materials, which are elements within the key space;

[0071] Equipment Certificate The device status digest exported from the mobile security environment is a fixed-length binary string; among which, a one-time random number is generated by the terminal's trusted execution environment. Collect secure boot metrics, system image metrics, trusted execution environment metrics, and time freshness tags to form a metric concatenation string. Computational metric summary And generate by signing with the device's private key. The verifier uses the vendor's public key chain to verify the signature and check the time freshness.

[0072] Message verification code operator : To bind the seed key The message verification code function is a key that outputs a fixed-length binary string; where:

[0073]

[0074] Symbol meaning: Key, bit length not less than 256; :information; Collision-resistant hashing; / : External / internal fill constant, and Block length matching; : Bitwise XOR.

[0075] Submit unique identifier on mobile device Signature Summary With one-time random numbers Equipment certification The platform calculates the number of responses and sends them back. The mobile client compares this with the local calculation; if they match, a derivation process begins; otherwise, a rollback prompt is triggered. The challenge-response entry point is upgraded from a readable identifier to a secret-based authenticated session, using a one-time random number generator. Equipment certification Jointly suppress replay and cross-device impersonation, signature digest Ensure that the source is consistent with the factory records.

[0076] Furthermore, after the challenge-response verification is passed, in order to eliminate the risk of one-way addressing on the platform, the mobile terminal uses terminal security materials and response quantities. Establish a joint derivative wallet address, and use this as the sole entry point for receiving payments and confirming rights in subsequent transactions.

[0077]

[0078] Where: wallet address The text or binary address output by the address generation operator, whose values ​​are defined by the address rules; key derivation operator. : using user key materials The seed is a derived function that expands the input, and the output is a derived key. Its function is to map the input into a session key used for address generation; user key material. : Stored in the trusted execution environment on the mobile device, it is an element within the key space; response quantity Unique Identifier Signature Summary The meaning is the same as before.

[0079] Address generation operator Map the derived key to address text or binary, and output it as a wallet address. The derivation process is: extraction → expansion → public key derivation → address encoding: a. Within the trusted execution environment of the terminal, using user key material symbols... For seeds, for splicing strings a) Extract and expand to obtain the session derived key; b) Derive the public key from the derived key; c) Hash the public key to obtain the address fingerprint; d) Attach the version number and verification code, encoded as text, which is the wallet address symbol. .

[0080] The mobile device invokes the key derivation operator and address generation operator within a trusted execution environment to generate a wallet address. It only returns the plaintext representation to the page, leaving the derived key in a trusted execution environment; the platform records the wallet address. The hash fingerprint is used for subsequent consistency verification. When in use, the address is jointly determined by the interaction between the mobile terminal and the platform. The platform cannot unilaterally replace it, and the mobile terminal cannot forge the source, ensuring the consistency of who is associated with whom in address creation. The derivation process is completed in a trusted execution environment, reducing the risk of key leakage.

[0081] By connecting source verification, challenge response, and derived address into a single chain, a double guarantee of trusted entry point and trusted address is formed, providing a provable upstream prerequisite for activation actions, and anchoring all subsequent rights distribution and session continuation to the same wallet address. With unique identifier Above. Once the session materials are available, a digital doll ID number is generated and a binding certificate signed by the platform is completed. This certificate, along with the transfer credential seed, is written into an immutable record to form a verifiable binding starting point. At the same time, the activation result is displayed as a digital card and receipt visible on the front end.

[0082] The binding process requires verifiable credentials from a third party to avoid the uncertain situation where an address has been generated but the binding is not effective. At the same time, pre-setting transfer credential seeds during the activation process can reduce the additional costs and risks of subsequent secondary transfers.

[0083] The platform creates digital doll ID numbers. Gathering unique identification codes Wallet address With transfer credentials seed The binding timestamp constitutes the binding credential payload. And bind the private key to the platform. Sign; subsequently, the platform registers the transaction in the ledger and sends the binding receipt back to the mobile device, where the mobile device displays a digital card and stores the minimum necessary record on the disk; if any verification fails, a rollback is performed.

[0084] Furthermore, the platform uses a unique identification code. -Digital doll ID number - Wallet address - Transfer credentials seed - The concatenated payload of the bound timestamp is used as the binding credential payload. And generate a binding signature, where:

[0085]

[0086] In the formula: binding signature : The signature result of the binding credential; signature operator : Using platform-bound private keys The signature function for the key outputs the bound signature. This allows any party to bind a public key to a platform. Verification is required;

[0087] Binding credential load : by unique identifier Digital doll ID number Wallet address Transfer of certificate seed A sequential concatenation of the bound timestamp; platform-bound private key. Platform binding public key Defined in the platform's key management procedures, it is an element within the key space;

[0088] Among them, the platform generates digital doll ID numbers. And assign it to this unique identifier. Then construct the binding credential payload. And sign as a binding signature The system sends both the digital card and the receipt number back to the mobile device, simultaneously registers the binding event in the ledger and writes back the transaction identifier; the mobile device displays the digital card and wallet address, and caches the binding credential payload. The fingerprint is used for offline verification. When in use, the bound credentials are verifiable externally and searchable internally, including the digital doll's ID number. Become the unique digital identity throughout the subsequent process; transfer credential seed This is fixed at this stage, providing a safe starting point for subsequent second-hand transfers.

[0089] To clearly determine whether the binding was successful at the end of the initial connection, the platform performs signature chain verification and device verification scoring threshold judgment, and provides clear acceptance instructions, including:

[0090]

[0091] In the formula: acceptance instruction : A binary quantity, taking the value of pass or fail; an indicator operator : An indicator function for logical decisions, with a binary output;

[0092] Verification Operator : Using the manufacturer's public key Verify manufacturer signature With signature digest The output is a binary quantity; verify the operator. : Bind public key to platform Verify binding signature With binding credential load The output is a binary quantity;

[0093] Equipment integrity scoring function Equipment certification The score is obtained by performing rule mapping, and the output is a non-negative real number;

[0094]

[0095] in: The equipment integrity score is output, and its value is a non-negative real number. Weights, which are non-negative real numbers and can be normalized; : Security boot verification result flag, with a value of two; : System image integrity verification flag, with a value of two; : A valid flag for a trusted execution environment, with a value of two. : The time difference between the device certificate and the current time on the platform, with a value that is a non-negative real number; : Time decay coefficient, which takes the value of a positive real number.

[0096] Threshold Platform-defined access thresholds and acceptance criteria; manufacturer's public key. Manufacturer's signature Signature Summary Equipment certification The meaning is the same as before.

[0097] The platform first uses the manufacturer's public key Verify the source, then bind the platform's public key. Verify the binding credentials, and finally calculate the device integrity score and compare it with the threshold. Comparison, and acceptance instructions. If successful, the mobile app will display "Consecrated" and the user can access the service page, where the binding receipt and timestamp will be written to the page status. If unsuccessful, a rollback prompt will be triggered and the failure reason code will be recorded.

[0098] The scoring function can be generated by the rule engine and solidified into a finite state machine to avoid operational ambiguity. When in use, the acceptance decision covers the three dimensions of source, binding credential, and device status in one go, avoiding partial binding and false pass, and making the final state of the first attachment clear, verifiable, and traceable.

[0099] Thus, by establishing a closed loop of signed verifiable binding credentials, ledger registration, acceptance of judgment, and front-end receipt, the digital doll's identification number is ultimately established. Wallet address Binding credential load With binding signature This forms a binding fact that can be verified by a third party.

[0100] Step 3: Using the sticker as the login-free key, a short-term session ticket is generated based on the unique identification code and the digital doll's ID card, and a follow-up fingerprint is derived to directly access the doll's exclusive service page; when risk control is triggered or the network is weak, the mirror is entered into read-only mode and local snapshots and reconciliation materials are retained. After the network is restored, the session and data consistency are closed.

[0101] When reconnecting, a single link is built between the mobile device and the platform, consisting of local initial verification, challenge verification, short-term session ticket generation, and fingerprint continuation, so as to complete direct access to the service page without entering an account password.

[0102] If re-attaching relies solely on the unique identifier, it is susceptible to replay attacks; if it depends entirely on platform-issued tickets, the session and terminal are decoupled, lacking verifiable pre-existing evidence. Therefore, it is necessary to use the unique identifier... Signature Summary Digital doll ID number With binding signature The process is uniformly incorporated into the conversation derivation process and coupled with a one-time time random quantity, so that each reconnection can be specifically pointed to a certain doll-a certain terminal-a certain time window.

[0103] After being passively invoked on the mobile device, the signature digest is read based on the offset positioning. With unique identifier At the same time, the binding credential payload from the previous step is retrieved. Binding signature With digital doll ID number Mobile devices generate one-time random variables. And retrieve the current time stamp. Subsequently, the platform side was connected based on the bound seed key. A challenge verification will be conducted; upon successful verification, the platform and the mobile device will jointly determine the short-term session ticket. Mobile devices can then derive and continue fingerprint authentication based on this. It is also stored on disk for direct page access and permission loading.

[0104] Furthermore, upon re-attaching, a short-term session ticket is constructed using four elements: identity, binding, time, and terminal, to prevent replay and cross-device abuse.

[0105]

[0106] Where: Short-term session ticket The short-term token used during the continuation phase is a fixed-length binary string that drives subsequent permission loading and direct page access; it is also bound to a seed key. The key materials stored on the platform are elements within the key space, serving as the secret quantity for message verification codes; unique identifiers. Near-field communication chip hardware; digital doll ID number Digital identity identifier, a fixed-length number; bound to a signature. : The signature of the binding credential generated in the previous step, the signature structure; the current timestamp. : The current time derived from the time synchronization between the mobile device and the platform, representing a specific point in time within the time domain; a one-time random time variable. High-entropy random numbers generated by the trusted execution environment on the mobile device, with values ​​in the large integer range, are used to resist replay.

[0107] Mobile terminal aggregated unique identifier Digital doll ID number Binding signature Current time stamp With one-time time random quantity They challenged the platform; the platform used a seed key to bind the user. Calculate short-term session tickets The results are then sent back; the mobile device performs the same calculation locally for verification, and if both are consistent, the result is considered passed.

[0108] When used, short-term session tickets By integrating identity, binding, time, and terminal randomness into a single token, each connection renewal is made unique and verifiable; since the participation token includes the binding signature... The bill is strongly coupled with the facts bound in the previous step.

[0109] Furthermore, to render short-term session tickets as a downloadable credential for the front end, the mobile device uses short-term session tickets. Wallet address Equipment certification Derived fingerprint continuation:

[0110]

[0111] Among them: fingerprint continuation Fingerprints used for page routing and permission loading, binding tickets, wallets, and device status; hash operators. Collision-resistant hash function, input is a binary string of arbitrary length, output is a fixed-length digest; short-term session ticket. Wallet address Equipment certification The meanings are respectively: continuation token, asset entry, and device status summary.

[0112] Mobile devices compute continuation fingerprints within a trusted execution environment It is then passed to the front-end router as a direct parameter for the page; the front-end uses the continued fingerprint as a reference. Load the current doll's service page and permission set, and display a notification that the connection has been renewed in the page's corner; the platform records the renewal fingerprint value for traceability.

[0113] When using, continue fingerprinting. By unifying the three elements of tickets, wallets, and devices into a single page loading anchor, the consistency between direct access to service pages and permission loading is ensured, reducing intermediate redirects and state mismatches. Through the continuous derivation of short-term session tickets and recurring fingerprints, a self-consistent session basis is formed, ensuring that subsequent risk control decisions and weak network mirroring have a unified input and data storage basis (short-term session tickets). With fingerprint continuation ).

[0114] Once the invoice and fingerprint are ready, a closed-loop control system is completed, encompassing risk control judgment, mode switching, mirror read-only mode, and reconciliation replenishment, ensuring a balance between user experience and security in high-frequency contact and weak network environments.

[0115] Re-attachment often occurs in environments with unstable signals or dense crowds. Without risk control and mirroring strategies, unauthorized operations or user experience interruptions can easily occur. A unified acceptance decision needs to be made based on quantitative inputs such as device integrity score, attachment frequency, location drift, and binding consistency. After network recovery, a verifiable checksum should be used to complete link closure.

[0116] The platform calculates the risk value based on the device integrity scoring function and the risk quantification function, and compares it with the threshold to give an acceptance instruction; when the acceptance conditions are not met, it switches to image read-only and writes a local snapshot to disk; after the network is restored, it performs consistency verification according to the reconciliation and replenishment verification code to complete the replenishment of balance and record.

[0117] Furthermore, the platform aggregates device integrity scores, docking frequency, geographical drift, and binding consistency errors into a risk value, and compares it with a threshold to obtain an acceptance indication.

[0118]

[0119] Among them: Admission Instructions : A binary quantity, taking the value of pass or fail; Equipment integrity scoring function Equipment certification The mapping is to a non-negative real number score, which is a closed interval and measures the trustworthiness of the device; threshold The score passes the threshold, and the value is a non-negative real number. Its function is to serve as the lower limit for acceptance.

[0120] Risk quantification function : Regarding the contact frequency Geographical drift Binding consistency error A function that performs monotonic summation, outputting non-negative real numbers; where:

[0121]

[0122] in: Risk value, a non-negative real number; : Estimated contact frequency per unit time, a non-negative real number; : Geographical drift between adjacent locations, non-negative real number; : Binding consistency error (e.g., for Consistency comparison differences), non-negative real numbers; Weight, a non-negative real number; Geographic drift power exponent, with a value greater than or equal to 1.

[0123] Threshold Risk ceiling threshold, a non-negative real number; contact frequency. : An estimate of the number of times a device touches another object per unit time, a non-negative real number; geographical drift : Positional change between adjacent mating points, a non-negative real number; Binding consistency error : by unique identifier Digital doll ID number With binding credential load The error derived from the comparison results is a non-negative real number;

[0124] The platform receives connection renewal fingerprints submitted by mobile devices. Calculate the device integrity score and correlate it with relevant quantities and thresholds. The comparison simultaneously summarizes the attachment frequency, geographical drift, and binding consistency error using a risk quantification function; when an acceptance instruction is given... If the request passes, the front-end unlocks all interactive entry points; if it fails, it switches to mirror read-only mode and displays the reason in a prominent position on the page.

[0125] The risk quantification function can be implemented using a piecewise linear function or a logarithmic-power hybrid function, and is fixed into a finite state machine to avoid runtime ambiguity. In use, trusted device-behavioral pattern-binding consistency is merged into a unified decision, avoiding race conditions caused by separate verifications and ensuring security controllability and continuous experience in high-frequency and weak network scenarios.

[0126] Furthermore, to ensure availability in the event of weak network conditions or failure to pass a judgment, mobile devices use short-term session tickets. Continuing fingerprint Generate a reconciliation verification code with the local snapshot summary, and perform a consistency check after network recovery:

[0127]

[0128] Where: Reconciliation and replenishment verification code : Used for consistency verification during reconciliation and remediation; fixed-length binary string; hash operator Collision-resistant hash function, input is a binary string of arbitrary length, output is a fixed-length digest; short-term session ticket. Continuing fingerprint The meanings are the same as before, namely session token and page load anchor; local snapshot summary. : A summary of assets and permissions cached when the image is read-only, a fixed-length binary string, used to record offline status; restore timestamps : A time marker indicating when the network is restored, within the time domain.

[0129] Among them, when accepting instructions If the request fails, the mobile device immediately enters read-only mode of the image and generates a local snapshot summary. And calculate the reconciliation verification code. After the network is restored, the mobile device will carry the reconciliation verification code. With local snapshot summary A request for data recovery is initiated. After the platform verifies the data, it issues incremental records and completes the write-back of the balance and history. Time alignment can be achieved by using cubic spline interpolation to correct for clock drift between the mobile device and the platform. Conflict handling employs top-down transaction replay and idempotency verification.

[0130] When in use, the mirror is read-only to ensure basic availability under weak network conditions, and the reconciliation and verification codes are replenished. By strongly binding offline snapshots to sessions, the determinism and auditability of backup records are guaranteed. A unified acceptance decision covers the three dimensions of device, behavior, and binding, and read-only mirroring and reconciliation backup verification codes run through the entire process from weak network to restored network. This ensures that connection restoration is not only reachable, but also verifiable, recoverable, and traceable.

[0131] Step 4: Input the doll's metadata and interaction events into the rules engine to form a suggested distribution amount, and then trim it into the final distribution amount under the constraints of total amount, daily limit and cooldown window, and deposit it into the digital wallet; at the same time, generate accounting vouchers and register them in the immutable ledger, so that identity, wallet and rights are aggregated under a unified anchor point and the audit trail is retained.

[0132] Using a combined input of identity, session, event, and rule, the system calculates the current amount of exclusive points to be distributed and performs constraint pruning. This ensures that the distribution reflects the differences between the doll's metadata and user behavior, while maintaining controllability and auditability within the same time window. Relying solely on a single event to trigger a fixed amount can easily lead to over-issuance and rule bypassing; relying entirely on manual configuration in the backend makes it impossible to generate a definitive result at the moment. Therefore, it is necessary to map the doll's metadata vector and interaction event vector to a suggested distribution amount, and use a cooldown and capping mechanism for pruning, while also providing an acceptance indicator. As an entry condition, it allows the issuance action to achieve a balance between availability and controllability.

[0133] The service platform receives the digital doll's ID number. Wallet address Short-term session tickets Continuing fingerprint With acceptance instructions Call the rule template and read the doll's metadata vector. With interaction event vectors The system outputs a suggested distribution amount; then it is trimmed based on the total limit, daily limit, and cooldown time, and the blacklist and circuit breaker status are checked; those that pass the trimming process enter the accounting stage, while those that fail are only recorded for the audit reasons.

[0134] In accordance with the acceptance guidelines Under the premise of using rule template identifier Doll metadata vector (Including series, style, number, production date, and hidden item markers) and interaction event vectors (Including event markers and times for consecration completion, task achievement, and event participation) are mapped to suggested distribution amounts and categorized by specific point types. Output:

[0135]

[0136] Among them: Recommended distribution amount The rule mapping output is the number of recommendations issued in this instance, a non-negative real number, which serves as input for subsequent pruning; the rule mapping function. : Rule template identifier Doll metadata vector Interaction event vectors With digital doll ID number A function that maps to non-negative real numbers can achieve piecewise mapping and weight superposition.

[0137] Where: regular mapping function For the joint mapping of templated weight table + condition trigger table: a. Template selection: based on rule template identifier Load the weight table and condition table versions; b. Weight evaluation: evaluate the doll's metadata vector. (Series, Style, Item Number, Production Date, Hidden Item Marking) and Interaction Event Vectors (Event category, occurrence time) Calculate and sum the values ​​of each item; c. Condition judgment: If a prohibited condition is met (such as batch freezing, event blacklist), output zero; otherwise, output the weighted sum.

[0138] Rule template identifier : Points to the template number configured in the backend, with values ​​belonging to a finite set, used to select the rule structure; Doll metadata vector : An ordered vector containing series, style, number, production date, and hidden item markers; it is a fixed-length structure used to determine scarcity and batch impact; interactive event vector. : An ordered vector containing event types and times, with a fixed-length structure;

[0139] Digital doll ID number : Identifier, fixed-length number, used to bind the object to which the rule applies; acceptance instruction The result of the risk control decision is again attached, and the value is two.

[0140] Therefore, the regular mapping function In the rule template identifier Within the selected template, the weighted table and condition table are used for joint evaluation, and the evaluation is linked with the hidden item marker to output the suggested distribution amount. If the instruction is accepted Not approved; suggested distribution amount It's directly zero. The suggested distribution volume is determined through a joint mapping of identity, metadata, events, and templates. It is sensitive to differences in both dolls and behaviors, thus avoiding a one-size-fits-all fixed denomination.

[0141] Furthermore, in order to determine the recommended distribution amount Constraints are kept within a controllable range, and a total limit is introduced. , daily upper limit With cooling window and superimposed with a blacklist flag. With the circuit breaker status The final amount distributed is obtained as follows:

[0142]

[0143] Where: Final disbursement amount : The quantity issued after constraint trimming, a non-negative real number; the upper limit of the total quantity. : The cumulative limit for a specific type of points over a certain period, a non-negative real number; cumulative amount issued. : Historical cumulative number of issues issued, a non-negative real number, used to correlate with the total upper limit. Collaboration; Daily Limit : Daily cumulative limit, a non-negative real number, used to suppress short-term concentrated distribution;

[0144] Daily output : The cumulative number of items sent today, a non-negative real number, used to determine the daily limit. Linkage; Current Time : Current timestamp, value is a point in time within the time domain; last issuance time : The last issuance time of this identity or wallet, with the value being a specific time point within the time domain; Cooling-off window Minimum interval time, a non-negative real number; blacklist flag. : A flag indicating whether the circuit breaker has been hit, with a binary value; Circuit breaker status. : A flag indicating whether the system is in a circuit breaker state, with a value of two.

[0145] Therefore, the platform can query the cumulative number of sent messages. Compared with the amount of hair already spun on that day Combined with the current time Compared to the last distribution time Determine the cooling window Whether it meets the requirements, and at the same time check the blacklist flag. With the circuit breaker status The final amount distributed is obtained when all conditions are met. Otherwise the final amount distributed Set the final distribution amount to zero and record the reason. Through a coordinated pruning process involving the upper limit, cooling-off period, list allocation, and circuit breaker, the final distribution volume is determined. The system remains under constant control, reducing the risk of abuse and malicious exploitation. The final distribution volume is calculated using a rule-mapping and constraint-pruning structure. .

[0146] Furthermore, in the final distribution amount Once confirmed, accounting vouchers are generated, ledger entries are completed, and in weak network or delayed scenarios, the reconciliation verification code closes the link, ensuring that the issuance fact, ledger anchor point, and page receipt are consistent and traceable.

[0147] If only one change record is kept in the database, it is difficult to defend against inconsistencies caused by rollbacks or concurrency. If it is only recorded in the ledger without being bound to the session and page anchor, the user cannot determine the correspondence between this distribution and its session. Therefore, it is necessary to generate an accounting voucher by combining identity, wallet, points type, final distribution amount and session anchor, and send it back to the front end with ledger record identification, while pre-setting a reconciliation and replenishment path.

[0148] The platform uses digital doll ID numbers Wallet address Exclusive Points Categories Final disbursement amount Short-term session tickets Continuing fingerprint With issuance time stamp Generate accounting vouchers, submit them to the ledger and obtain the ledger record identifier; then send the issuance receipt-ledger record identifier-page prompt back to the front end. If it is in a mirror read-only or weak network, the verification code will be closed during recovery.

[0149] Furthermore, to ensure consistency between accounting entries and session anchors, a collision-resistant hash operator is used to generate accounting vouchers, which are then used as the core summary of the ledger's accounting load.

[0150]

[0151] In the formula: accounting voucher A summary of the core elements of this issuance, a fixed-length binary string, serving as the common anchor point for ledger registration and receipt verification; hash operator. Collision-resistant hash function: Input is a binary string of arbitrary length, output is a fixed-length digest; Digital doll ID number Wallet address These are the entry points for identity and assets, respectively.

[0152] Exclusive Points Categories The identifier for the points category, whose value is a finite set of elements, serves to distinguish different benefits; the final amount distributed. : Quantity of entries; Short-term session notes Continuing fingerprint Session tokens and page anchors during the continuation phase; issuance of time stamps. The time stamp for this issuance is a time point within the time domain.

[0153] The platform structure includes accounting vouchers The registered load is submitted to the ledger service to obtain a ledger record identifier; at the same time, the ledger record identifier is linked to the accounting voucher. The text fingerprint is sent back to the front end for page display and user retention.

[0154] The ledger side can adopt Byzantine fault-tolerant consensus; time alignment can be completed according to time synchronization procedures, and minor drifts can be corrected by interpolation methods when necessary. (Accounting vouchers) By binding identity, wallet, amount, session, and time into a single summary, ledger record identifiers enable any subsequent party to trace a unique record, improving verifiability.

[0155] Furthermore, if the front-end is in read-only mode or on a weak network, the connection must be closed after recovery using the reconciliation verification code. To uniquely link the reconciliation process to this distribution, the platform uses a function operator to compare the reconciliation verification code. Accounting vouchers With short-term session tickets Give an acceptance signal:

[0156]

[0157] In the formula: acceptance mark The result of accepting the replenishment request has a binary value and its function is to determine whether to replenish the balance and transaction history; the decision operator. Verification code for reconciliation and replenishment Accounting vouchers With short-term session tickets The function that performs consistency checks outputs a binary value. Its purpose is to confirm that the resubmission request and the registration record belong to the same issuance instance.

[0158]

[0159] in, Consistency determination output, binary; the meanings of the other symbols are the same as those described above (all have been defined in steps three and four and can be collected by the front end / platform).

[0160] Reconciliation and replenishment verification code : Checksum from the previous read-only mirroring stage; accounting voucher Short-term session tickets The meaning is the same as before.

[0161] After the network is restored, the front end carries the reconciliation and replenishment verification code. Initiating a recovery, the platform calculates the acceptance flag using the judgment operator. If successful, the incremental transaction record corresponding to the ledger record will be added to the front-end page, and a message indicating that the update is complete and the record is aligned will be displayed. If unsuccessful, a message indicating that the update failed and the record should be re-aligned will be displayed, while the audit entry will be retained.

[0162] When using, use the acceptance flag. By strongly linking the re-registration process to the original registration, duplicate or erroneous entries are avoided, ensuring that the issuance facts in weak network scenarios can be traced and verified. The sequence of accounting voucher-ledger registration-re-re-registration verification closes the gap between the online system and the front end.

[0163] Step 5: When publishing content, generate a content summary and establish an identity imprint with the digital doll's ID card and continued fingerprints, and sign a certificate; when transferring second-hand items, generate a transfer session certificate through a near-field two-end handshake, register the transfer record and transfer control, so that content, identity and assets are connected through the same evidence chain, supporting the traceability of genuine products and safe circulation.

[0164] On the publishing end, content is strongly coupled with identity, conversation, and accounting anchors. Through summaries, signatures, and visibility presentation, each piece of content naturally carries a verifiable identity imprint and can be directly referenced by subsequent settlement and traceability.

[0165] If content and identity are only associated with the page, it's easy for materials to be transferred but the identity to be lost; if only a file summary is stored without introducing identity and session anchors, it's difficult to prove that the content truly belongs to a specific instance associated with a particular identity. Therefore, it's necessary to use a digital doll's ID number. Continuing fingerprint Accounting vouchers Using this as an anchor point, the content summary is bound to the identity verification certificate, forming a unified entry point that is visible and verifiable on the front end.

[0166] When the front-end is triggered by a publish action, it collects the binary string of the content payload and layout information, extracts the content summary, and combines it with the digital doll's ID number. Continuing fingerprint The system uses time stamps to calculate identity imprint tags and applies for signing from the platform. The platform generates a signed document and returns a credential summary, which is then presented on the front end as an icon and text. At the same time, a watermark reference is embedded in the content metadata to achieve a dual-track expression of visible display and invisible index.

[0167] Furthermore, to avoid identity loss caused by simple document summaries, imprint tags are generated using a four-element combination of content-identity-session-time:

[0168]

[0169] In the formula: content summary A summary of the content and identity session union, a fixed-length binary string; a hash operator. Collision-resistant hash function, input is a binary string of arbitrary length, output is a fixed-length digest; content payload The pre-processed binary payload from the publishing end includes image frames or text encoding; the digital doll's ID number. : Identification identifier, meaning the same as before; Continuation of fingerprints : Page load anchor from step three, meaning the same as before; publication time stamp : The point in time after local time synchronization.

[0170] The front end assembles the content payload in a fixed order. Digital doll ID number Continuing fingerprint With publication time stamp Input hash operator , obtain content summary Subsequently, a watermark reference pointer is written into the image or video frame using frequency domain embedding; this pointer only stores a content summary. The truncated fragment and the digital doll's ID number Indexing to reduce visibility distortion. When using, content summary... By directly embedding identity and session anchors into the digest construction, any copy that leaves the system can still refer back to the identity when the digest is extracted; watermarking ensures the dual goals of being visible yet imperceptible and invisible yet verifiable.

[0171] Furthermore, to enable third parties to verify the imprint and source, a signature is generated using the platform's content signing private key, and a credential digest is sent back for front-end display and external verification.

[0172]

[0173] Among them: content signature The platform's signature result for this content imprint is the signature structure; signature operators. Private key for signing platform content A signature function for the key; digital doll ID number. Content Summary Accounting vouchers Publication time stamp The meaning is the same as before, including accounting vouchers. This is taken from step four and is used to associate the content with rights and interests events.

[0174] The image / video uses a block-shaped discrete cosine domain intermediate frequency coefficient shifting method, which shifts the intermediate frequency coefficients in the selected intermediate frequency sub-band. Truncation fragments and Index bit encoding; embedding strength is adjusted within a preset threshold using the minimum visible distortion criterion; in case of failure, rollback to metadata embedding only (without changing pixels) + mark certificate display;

[0175] The front end carries the digital doll's ID number. Content Summary Accounting vouchers With publication time stamp Request signing; platform generates content signature. It returns the voucher summary text and verification entry point; the front end displays a verifiable voucher icon on the content card, and clicking it displays the voucher summary and verification entry point.

[0176] When using, content signature This eliminates the reliance on internal databases for signature verification, allowing any third party to verify the consistency of content, identity, and rights events simply by holding the platform's public key. At the same time, the credential digest unifies the information required for user-side display and external verification.

[0177] By linking the summary-signature-presentation sequence into a single chain, we can ensure the usability of the creation process, provide a verifiable entry point for settlement and rights protection, and prepare content-side evidence for subsequent source tracing and dispute resolution.

[0178] Furthermore, in the event of a secondary transfer, a unique session proof of the transfer action is generated based on the two-way near-field handshake and the transfer credential seed. After the ledger is registered, the transfer of control and historical preservation are completed, ensuring consistency between physical handover, digital migration and evidence retention.

[0179] If the transfer relies solely on account operations, inconsistencies may arise where the item is located but the ownership exists elsewhere; if ownership is rewritten simply by scanning, it is highly susceptible to misuse. Therefore, it is necessary to simultaneously collect proof of the seller's and buyer's devices under near-field conditions, and introduce a transfer credential seed to ensure a traceable link between this transfer and the activation process; subsequently, a ledger record is used to bind the old address, new address, time, and session proof, and a transfer receipt is generated on the front end.

[0180] When the seller and buyer simultaneously come into close contact with the same plush toy in a near-field environment, the system reads the unique identification code. With digital doll ID number The seller and buyer each generate device proof and submit it to the platform; the platform and both parties jointly use the transfer credential seed. Calculate the handshake proof and return the transfer session tag; then register it in the ledger and send back the record identifier, the front end displays the receipt and executes the control transfer or sub-wallet transfer; if any step fails to verify, the transfer action is not effective and the audit evidence is retained.

[0181] To ensure the connection between this transfer and the consecration ceremony, and to prevent one-sided forgery, a transfer credential seed is introduced. (Originating from step two, combined with a unique identifier) Digital doll ID number Seller's equipment certificate Buyer's equipment certificate With transfer time stamp Generate handshake proof:

[0182]

[0183] In the formula: handshake proof The unique session proof for this transfer, a fixed-length binary string, is used to bind both parties to the physical item; message verification code operator. : Transfer key The message verification code function is used as the key;

[0184] Transfer Key : by transfer credential seed The key symbol is obtained by mapping with the platform key material and takes the value as an element within the key space; By transfer credential seed symbol The platform key material is obtained through key derivation mapping; if the handshake fails or the clock drift exceeds the limit, a rollback will be performed and only the audit record will be retained; historical preservation is achieved by freezing the write permissions of the old address and retaining the read permissions.

[0185] Unique Identifier Digital doll ID number Same meaning as above; Seller's equipment certificate Buyer's equipment certificate : Derived from trusted execution environments at both ends, each value is a fixed-length binary string;

[0186] Transfer time stamp The timing of this handshake. Processing method: After both parties are connected, they each submit device verification, and the platform transfers the key. Calculate handshake proof The results are simultaneously returned to both parties; both parties then calculate and compare the results locally using the same formula. If the results match, the registration process begins. Handshake proof. By combining the same physical item—with both ends present and the source under control—into a single verifiable tag, the possibility of remote misuse and one-end forgery is significantly reduced.

[0187] To ensure that session proofs are recorded as traceable records and that the history after a transfer of control can be preserved and audited, a collision-resistant hash operator is used to generate a digest of the transfer record and register it in the ledger:

[0188]

[0189] Where: Transfer record summary A summary of the core elements of this transfer, a fixed-length binary string, serving as the common anchor point for ledger entries and front-end receipts; hash operator. Collision-resistant hash function: Input is a binary string of arbitrary length, output is a fixed-length digest; Digital doll ID number Identity identifier; old wallet address : The wallet address that held control before the transfer; the new wallet address : The wallet address corresponding to the transferred control; handshake proof Transfer time stamp The meaning is the same as before.

[0190] Collision-resistant hash operators Used to generate signature digest Continuing fingerprint Reconciliation and replenishment verification code Accounting vouchers Content Summary Summary of transfer records etc. Among them:

[0191]

[0192] Symbol meaning: Outputs a fixed-length binary string; its values ​​are a set of fixed-bit lengths; its function is to act as input. Fingerprints. : No. A collision-resistant hash instance; the input is a binary string of arbitrary length; the output is a fixed-length digest; in the engineering implementation, it is possible to choose different domain isolations within the same family or different named instances within the same implementation. Messages assembled in a fixed order as defined in each place (e.g.) (etc.), the source and order have been clarified in the corresponding steps.

[0193] The platform uses transfer record summaries After constructing the registration payload and submitting it to the ledger, and obtaining the record identifier, execute the control transfer: assign the digital doll's ID number. Control points to the new wallet address To preserve historical data, you can choose to freeze the old wallet address. Write permissions associated with this identity are restricted, while query permissions are retained. The front end simultaneously displays the transfer completion receipt and ledger record identifier, and adds historical control entries to the identity card.

[0194] When using it, transfer the record summary. By unifying identity, address, time, and handshake proof as a single anchor point, control transfer and historical preservation are completed on the same chain of evidence, facilitating verification and evidence presentation in disputed scenarios. The near-field two-way handshake, session proof, ledger registration, control transfer, and historical preservation are linked into a closed loop, ensuring that physical handover and digital migration are implemented simultaneously.

[0195] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0196] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0197] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0198] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0199] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for binding and authenticating the digital identity of a doll based on NFC, characterized in that: include, At the factory workstation, a verifiable birth certificate is created for each doll. After the unique identification code is read at the chip programming workstation, the doll's metadata is assembled in a fixed encoding order, and along with the timestamp and batch number, it is input into the digest generation function to obtain a signature digest. Then, the digest is written to a designated location in the chip's user area according to the offset strategy and synchronized to the platform side. Finally, a manufacturer's signature is generated using the manufacturer's private key and saved together with the digest index. The platform constructs a transaction payload using the unique identification code, digest fingerprint, manufacturer's signature, timestamp, and production batch number, and submits it to the ledger service. After the ledger returns the transaction identifier, the platform writes a handover record in the production execution system. Upon initial contact, after the mobile device is passively invoked, it reads the unique identifier and the signature digest of the digest offset location, collects device proof and a one-time random number, and the platform calculates the response using the binding seed key and issues a verification task. Based on this, the mobile device generates a derived wallet address and encapsulates the session materials, preparing to enter the activation phase. The platform creates a digital doll ID number, gathers the unique identifier, wallet address, transfer credential seed, and binding timestamp to form the binding credential payload, and signs it with the platform's binding private key. Subsequently, the platform registers the binding in the ledger and sends the binding receipt back to the mobile device, which then displays the digital card and stores the minimum necessary record on disk. Upon re-attaching, the mobile device is passively invoked and reads the signature digest and unique identification code based on the offset positioning. Simultaneously, it retrieves the binding credential payload, binding signature, and digital doll ID number from the previous step. The mobile device generates a one-time random time value and takes the current time stamp, then performs a challenge verification with the platform based on the binding seed key. After successful verification, the platform and mobile device jointly determine a short-term session ticket. The mobile device uses this ticket to derive a continuation fingerprint and stores it on disk for direct page access and permission loading. The front-end loads the current doll's service page and permission set based on the continuation fingerprint. The service platform receives the digital doll's ID number, wallet address, short-term session ticket, renewal fingerprint, and acceptance instructions; The system calls the rule template, reads the doll's metadata vector and interaction event vector, and outputs the suggested distribution amount. Then, it prunes the distribution based on the total limit, daily limit, and cooldown time, and checks the blacklist and circuit breaker status. Those that pass the pruning process enter the accounting stage, while those that fail are only recorded for the audit reason. The platform constructs a registration payload containing accounting vouchers and submits it to the ledger service to obtain the ledger record identifier. When publishing content, the front-end collects the binary string and layout information of the content payload, extracts the content summary, and combines the digital doll's ID number, fingerprint, and time stamp to calculate the identity mark label and apply to the platform for signature. The platform generates a signature and returns a certificate summary, which the front-end presents as an icon and text, while embedding a watermark reference in the content metadata to achieve a dual-track expression of visible display and invisible index. When transferring second-hand items, the seller and buyer simultaneously place the same doll in a near-field environment. The system reads the unique identification code and the digital doll's ID number, and the seller and buyer respectively generate device certificates and submit them to the platform. The platform and both parties jointly calculate the handshake proof based on the transfer credential seed and return the transfer session label; The ledger is then registered and a record identifier is sent back. The front end displays the receipt and executes the control transfer or sub-wallet transfer.

2. The NFC-based digital identity binding and authentication method for dolls according to claim 1, characterized in that: First, the doll's metadata is encoded in a fixed field order and concatenated with a unique identifier, timestamp, production batch number, and salt value. Then, a layered hash is used to obtain the signature digest, where the salt value is a batch-level random binary string generated by the platform. The signature digest is written to the user area of ​​the near-field communication chip according to the storage offset and locked. The platform records the offset and length to form a readable area mapping. If the chip has a read-only area, the digest fingerprint and length are written synchronously and the read-only area is locked. If there is no read-only area, a triplet of digest index-digest length-digest fingerprint is written to the user area and locked. Write layout management includes: when the remaining space in the user area is insufficient to continuously write the signature digest, loopback writing is performed and the loopback indication is recorded. When reading back, the same rule is restored. If the near-field communication chip does not support loopback writing, indented writing is used and the indentation offset is recorded. The two correspond one-to-one in the workstation transfer sheet.

3. The NFC-based digital identity binding and authentication method for dolls according to claim 2, characterized in that: After the layered digest and writing are completed, the digest is signed with the manufacturer's private key, and the signature and public parameters are registered on the platform side. At the same time, the chip is read back for verification, and a clear pass criterion is given, and a sealable or rollback signal is output. After the station control program completes the digest writing, it immediately performs the readback operation, obtains the readback value based on the offset and length, and performs signature verification and distance determination locally. When the acceptance indicator is passed, the system generates a sealable signal and registers the signature and public parameters on the platform. When it fails, the rollback procedure is triggered and an exception barcode is output so that the material can be transferred to the exception database. The platform constructs a transaction payload with a unique identifier, digest fingerprint, manufacturer signature, timestamp, and production batch number and submits it to the ledger service.

4. The NFC-based digital identity binding and authentication method for dolls according to claim 1, characterized in that: During the initial connection, the mobile device generates a one-time random number and device proof. The platform calculates the response quantity based on the unique identifier, signature digest, one-time random number, and device proof, and sends it back to the mobile device to complete the consistency verification between the local device and the platform. The mobile device derives a digital wallet address based on the response quantity, unique identifier, and signature digest within the trusted execution environment, and submits the address fingerprint only to the service platform.

5. The NFC-based digital identity binding and authentication method for dolls according to claim 4, characterized in that: Construct a binding certificate containing a unique identifier, digital doll ID number, digital wallet address, transfer credential seed and binding timestamp, which is signed by the platform binding key. The platform sends both of them, along with the receipt number, back to the mobile terminal, and at the same time registers the binding event in the ledger and writes back the transaction identifier.

6. The NFC-based digital identity binding and authentication method for dolls according to claim 1, characterized in that: When the device is reattached, a short-term session ticket is generated based on the unique identifier, digital doll ID number, binding certificate, timestamp, and random number. A renewal fingerprint is then generated based on the short-term session ticket, digital wallet address, and device proof. The renewal fingerprint is stored on disk along with the page status.

7. The NFC-based digital identity binding and authentication method for dolls according to claim 6, characterized in that: The risk amount is calculated based on the attachment frequency, geographical location drift, and binding consistency error, and compared with the threshold to obtain an acceptance indication; when the acceptance fails, it switches to mirror read-only, generates a local snapshot summary, and forms a reconciliation verification code for verification during recovery.

8. The NFC-based digital identity binding and authentication method for dolls according to claim 7, characterized in that: Load the rule template, map the doll metadata vector, interaction event vector and acceptance indication to the suggested distribution amount; then trim the suggested distribution amount according to the total limit, daily limit and cooldown window, and deposit the final distribution amount into the digital wallet.

9. The NFC-based digital identity binding and authentication method for dolls according to claim 8, characterized in that: The system generates an accounting voucher summary using the digital doll's ID number, digital wallet address, exclusive points type, final distribution amount, short-term session ticket, renewal fingerprint, and distribution time stamp. This summary, along with the distribution record, is then recorded in an immutable ledger, and a record identifier is returned.

10. The NFC-based digital identity binding and authentication method for dolls according to claim 1, characterized in that: When publishing content, the content payload is extracted and a content digest is calculated. The front end concatenates the content payload, digital doll ID number, continuation fingerprint, and publication timestamp in a fixed order, inputs a hash operator, and obtains the content digest. Then, a watermark reference pointer is written into the image or video frame using frequency domain embedding. This pointer only stores a truncated fragment of the content digest and the index of the digital doll ID number. The front end requests a signature with the digital doll ID number, content digest, accounting voucher, and publication timestamp. The platform generates a content signature and returns the voucher digest text and verification entry.

11. The NFC-based digital identity binding and authentication method for dolls according to claim 10, characterized in that: When transferring a second-hand item, the seller and buyer simultaneously place the same doll in a near-field environment. The system reads the unique identification code and the digital ID number of the doll, and the seller and buyer respectively generate equipment certificates and submit them to the platform. The platform and both parties jointly calculate the handshake proof based on the transfer credential seed and return the transfer session label; A collision-resistant hash operator is used to generate a transfer record digest and register it in the ledger. The platform constructs a registration payload with the transfer record digest and submits it to the ledger. After obtaining the record identifier, it performs a control transfer: the control of the digital doll's ID number is transferred to a new wallet address.

12. The NFC-based digital identity binding and authentication method for dolls according to claim 11, characterized in that: Historical preservation includes freezing write permissions for the old wallet address associated with the digital doll ID after the control transfer is completed, while retaining query permissions, and archiving historical control entries and ledger record identifiers of transfer records in the digital doll ID's identity card.

Images