Distributed identity association and verification method and system combining alliance chain and trusted CA

Abstract

The invention discloses a distributed identity association and verification method and system combining an alliance chain and a trusted CA (Certificate Authority). The method comprises the following steps: firstly, guiding a user to complete identity verification in a trusted third-party authentication center to obtain an authoritative verifiable certificate; based on the certificate, the back end of the system automatically applies for signing and issuing an operation certificate for on-chain interaction to the alliance chain. The system constructs a distributed identity document aggregating verifiable credentials and public key information for a user. A user imports an operation certificate and a private key into a block chain wallet, signs a transaction in person, and registers a DID and a document thereof into an on-chain smart contract, so that the problems that in an existing block chain identity system, an on-chain identity is separated from an entity identity, roots of trust are not uniform, and interoperability is poor are solved; unified and non-tampering on-chain association of a user entity identity, an on-chain operation identity and a standardized DID is realized, an identity system with a trusted CA as a root of trust is established, the sovereignty and security of the user are guaranteed while supervision requirements are met, and the identity interoperability is improved.

Description

Technical Field

[0001] This invention belongs to the fields of blockchain technology, distributed identity (DID) and network security technology, and specifically relates to a distributed identity association and verification method and system that combines consortium blockchain and trusted CA. Background Technology

[0002] With the deepening of digital transformation, mapping real-world identities and assets to the digital space has become a key trend. Blockchain technology, with its decentralized, immutable, and traceable characteristics, offers unprecedented opportunities for building a new generation of digital identity systems. However, existing digital identity solutions still face many challenges: First, in highly regulated and high-value scenarios such as finance, government affairs, and supply chains, there are extremely high requirements for the authenticity, uniqueness, and traceability of identities. Traditional public blockchain anonymity or pseudonym identity models, lacking effective anchoring to real-world entities, are unable to meet the compliance and risk control needs of these scenarios.

[0003] Secondly, while consortium blockchains address the issue of participant identity authorization through access control mechanisms, their identity systems are typically closed and non-standardized. A user's identity credentials within "Consortium A" cannot be recognized or trusted by "Consortium B" or other external applications, creating new "identity silos" that violate the open and interoperable spirit of Web3.0.

[0004] Furthermore, existing identity authentication processes often struggle to strike a balance between user experience and security. Requiring users to manage multiple sets of complex credentials (such as platform passwords, on-chain certificates, and identity verification documents) not only increases the cognitive burden and operational difficulty for users but also introduces several potential security risks.

[0005] Furthermore, in the process of linking on-chain identities with physical identities, ensuring user data sovereignty and privacy, avoiding excessive control of user identity data by centralized platforms, and guaranteeing the security, reliability, and unforgeability of the linking process are pressing challenges that current technologies need to address. For example, simply storing users' on-chain addresses and real-name information in a centralized database lacks public verifiability and carries the risk of identity information leakage or tampering due to attacks on the centralized database.

[0006] Therefore, it is necessary to design a novel technical solution that can strongly associate an entity identity certified by an authoritative third party with a user-controlled, internationally standardized on-chain distributed identity within a regulatory-compliant consortium blockchain environment, and provide a registration and login process that balances security, compliance, and user experience. Summary of the Invention

[0007] To address the problems existing in the prior art, this invention provides a distributed identity association and verification method and system that combines a consortium blockchain with a trusted CA (Certificate Authority). Through a one-step registration process orchestrated by a backend service, three different levels of identity credentials are unified and aggregated: the user's entity identity (proven by a third-party CA), the on-chain operation identity (proven by a chain CA), and the application layer sovereign identity (represented by a DID). These credentials are securely and reliably anchored together, and this association is immutably recorded on the consortium blockchain in the form of a smart contract.

[0008] To achieve the above objectives, in a first aspect, the present invention provides a distributed identity association and verification method combining a consortium blockchain and a trusted CA, comprising the following steps: S1, based on the user's registration operation, generates a unified public-private key pair; S2, based on the public key of the unified public-private key pair and the entity identity information submitted by the user, generate the first certificate signing request, and submit the first certificate signing request to a trusted third-party certification center through the server to obtain a third-party CA certificate that encodes the entity identity information in the extended fields, so as to verify the credentials; S3. Based on the public key of the unified public-private key pair and the organization identity information required by the consortium blockchain, generate a second certificate signing request, and submit the second certificate signing request to the consortium blockchain certification center, which serves as the access control for the consortium blockchain, through the server to obtain an on-chain operation certificate for operation on the consortium blockchain. S4, construct a distributed identity document for the user, wherein the distributed identity document aggregates the public key information of the unified public-private key pair and the verifiable credential information represented by the third-party CA certificate; S5, guide the user to import the on-chain operation certificate and the private key of the unified public-private key pair associated with it into their blockchain wallet; S6. Using the wallet, sign an on-chain transaction for registering the distributed identity, and write the distributed identity and its distributed identity document into the distributed identity registration smart contract on the consortium blockchain to complete the association between the user's on-chain identity and the entity user. S7, User login verification, login is allowed after successful verification.

[0009] Furthermore, in S2, based on the public key of the unified public-private key pair and the entity identity information submitted by the user, a first certificate signing request is generated, and the first certificate signing request is submitted to a trusted third-party certification center through the server to obtain a third-party CA certificate that encodes the entity identity information in the extended fields. This also includes: creating a user master account in the database of the server to store the custom account information, the user entity identity information, and the association relationship with the on-chain operation certificate and the distributed identity.

[0010] Furthermore, the third-party CA certificate is an X.509 digital certificate that encodes the user entity's identity information in the Subject Alternate Name extension.

[0011] Furthermore, user login verification includes the following steps: S71, Receive a user's login request, the login request including a signature made by a challenge code generated by the user's wallet and the user's distributed identity; S72, by initiating a read-only call to the consortium blockchain node, query the DID registration smart contract to obtain the DID document associated with the user's distributed identity, and parse the public key information associated with the unified public-private key pair from the DID document; S73, Using the public key information, verify the validity of the signature and confirm the user's control over the distributed identity; S74, after the signature verification is successful, a login session is established for the user.

[0012] Furthermore, logging in after verification includes: S75: Parse the verifiable credentials stored in the DID document; S76: Query the current validity status of the verifiable credential in real time from a trusted third-party certification authority via an online certificate status protocol or certificate revocation list; S77: Confirm successful user login only if the verifiable credential status is valid.

[0013] Secondly, the present invention provides a distributed identity association and verification system combining a consortium blockchain and a trusted CA, characterized in that the method for executing the above-mentioned distributed identity association and verification method combining a consortium blockchain and a trusted CA includes: The front-end interaction module uses HTML, CSS, and JavaScript front-end technologies and the VUE framework to build the user interface. It runs on the user client and provides a dialog window for users to complete entity identity information verification. It generates a unified public-private key pair locally and provides a dialog window for users to interact with smart contracts through wallets after obtaining on-chain operation certificates. The backend processing module uses the JAVA language combined with the Spring framework and runs on the server side. It is used to orchestrate the registration process, perform user real identity verification, interact with trusted third-party certification centers and the consortium blockchain certification center via API, obtain user credentials, and process user login verification requests. The smart contract module, deployed on the consortium blockchain, provides an on-chain registry for distributed identity, storing the mapping relationship between DID and its DID document; The database module uses MySQL to store user tables, which store user account information, user entity identity information, and the association between user on-chain operation certificates and distributed identities.

[0014] Furthermore, the user initiates a registration request on the front-end interaction module. The front-end module calls the interface of the back-end processing module to obtain a redirect URL containing the registration process ID that points to a trusted third-party certification center. The front-end module redirects the user's browser to this URL, and the user completes the entity identity information verification on the interface of the third-party CA. The third-party CA redirects the user's browser back to the callback address specified by the front-end module, along with a one-time authorization code. The front-end module displays a "processing" status to the user and polls the back-end status. The third-party CA callback interface of the back-end processing module is triggered. The back-end processing module requests the third-party CA to exchange for a verifiable credential containing the user's authoritative entity information. It then applies for a certificate for the user to operate on the consortium blockchain. The verifiable credential and the on-chain operation certificate are associated with and cached with the registration process ID. After the front-end interaction module obtains the "pending activation" status through polling, it updates the interface and provides the user with a dialog window to perform the final activation and complete the registration. When a user logs in using their wallet on the front-end interaction module, the front-end interaction module requests to connect to the user's wallet plugin to obtain their on-chain address. The front-end interaction module then sends a request to the GET / did-nonce interface of the back-end processing module to obtain a one-time challenge code for this login. The front-end interaction module passes the obtained challenge code to the wallet plugin, requests the user to sign it, the user confirms the signature, the wallet uses the private key of the on-chain operation certificate to sign the one-time challenge code, and returns the signature result to the front-end interaction module; The front-end interaction module submits the user's distributed identity, original one-time challenge code, and signature result to the POST / did-login interface of the back-end processing module, and the back-end processing module performs verification. After all verifications are successful, the backend processing module confirms the user's identity is legitimate, queries the user's role and permission information from the database module, and generates a standard JWT as a session credential to return to the frontend interaction module. The frontend interaction module stores the standard JWT and carries it in all subsequent API requests to maintain the login status.

[0015] Furthermore, the backend processing module performs verification including: Verify that the received one-time challenge code exists in the server's cache, and ensure that the one-time challenge code has not been used and is within its validity period; After successful signature verification, the backend processing module further parses the verifiable credentials stored in the distributed identity document JSON string, and initiates a real-time query to the trusted third-party CA that issued the verifiable credentials through the OCSP or CRL standard protocol to confirm that the user's entity identity credentials are valid at the current moment. The backend processing module initiates a read-only call to the smart contract module via remote procedure call, executes the parsing method, obtains the DID document JSON string corresponding to the DID, parses the user's public key from the DID document JSON string, and uses the public key, the original Nonce, and the received Signature to execute a cryptographic signature verification algorithm to verify the authenticity of the signature.

[0016] Thirdly, the present invention can also provide a computer device, including a processor and a memory, wherein the memory is used to store a computer executable program, the processor reads the computer executable program from the memory and executes it, and the processor can realize the distributed identity association and verification method combining consortium blockchain and trusted CA described in the present invention when executing the computer executable program.

[0017] Simultaneously, a computer-readable storage medium is provided, in which a computer program is stored. When the computer program is executed by a processor, it can implement the distributed identity association and verification method combining consortium blockchain and trusted CA described in this invention.

[0018] Compared with the prior art, the present invention has at least the following beneficial effects: A unified and authoritative root of trust: This invention ensures the ultimate traceability of all distributed identities in the system by forcibly anchoring the starting point of the registration process to a trusted third-party CA. It solves the problem of self-assertive identities in consortium blockchains and the difficulty in gaining external trust, and greatly meets the strong regulatory and auditing requirements of financial and government sectors.

[0019] Enhanced user sovereignty and security: The entire process strictly adheres to the core security principle that private keys do not leave the client. The user's core key pair is generated on the client, and the final identity on-chain operation is authorized by the user through a web3 plugin signature. This achieves strong identity binding while maximizing the user's control over their digital identity and reducing the risk of data leakage from centralized servers. Identity Aggregation and Interoperability: This invention innovatively uses DID as a standardized carrier to aggregate previously isolated and heterogeneous credentials (physical VC, on-chain certificates) under a unified identity that conforms to international standards. This not only makes identity information more complete but also lays a solid foundation for future cross-platform and cross-ecosystem identity recognition and data exchange, effectively breaking down "identity silos." Optimized User Experience and Process Automation: This invention transforms the extremely complex interactions involving multiple external systems (third-party CAs, consortium blockchain CAs, smart contracts) into a linear, clearly guided, "one-step" registration process for users. The highly automated orchestration of backend services internally encapsulates the technical complexity, presenting a concise user journey externally, significantly reducing the operational threshold for users.

[0020] Enhanced login security and flexibility: This invention supports DID-based wallet signature login. During the login process, the user's physical identity credentials can be validated twice by querying the credential status service (OCSP / CRL) of a third-party CA in real time. This enables dynamic management of the identity credential lifecycle, effectively preventing the risk of using revoked or expired credentials and further improving the system's security. Attached Figure Description

[0021] To make the objectives, technical solutions, and advantages of the invention clearer, the invention will now be described in further detail with reference to the accompanying drawings, wherein: Figure 1 This is a schematic diagram of the overall architecture of the distributed identity association and verification system described in this invention.

[0022] Figure 2 This is an interaction sequence diagram of the entity identity authentication and on-chain credential acquisition process described in this invention.

[0023] Figure 3 This is an interaction sequence diagram of the user activation and DID chain registration process described in this invention.

[0024] Figure 4 This is an interaction sequence diagram of the DID / wallet login verification process described in this invention. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of this invention clearer, the following description will be provided in conjunction with the appendix. Figures 1 to 3 The specific embodiments of the present invention will be further described in detail below.

[0026] refer to Figure 1 This invention provides a distributed identity association and verification method combining consortium blockchain and trusted CA, comprising the following steps: S1, based on the user's registration operation, generates a unified public-private key pair; S2, based on the public key of the unified public-private key pair and the entity identity information submitted by the user, a first certificate signing request is generated. This first certificate signing request is then submitted to a trusted third-party certification authority via the server to obtain a third-party CA certificate (Verifiable Certificate) that encodes the entity identity information in an extended field. A verifiable credential (VC) is then created in the server's database to store the custom account information, the user entity identity information, and its association with the on-chain operation certificate and distributed identity. The verifiable credential is an X.509 digital certificate that encodes the user entity identity information in the subject alternate name extension.

[0027] S3. Based on the public key of the unified public-private key pair and the organization identity information required by the consortium blockchain, generate a second certificate signing request, and submit the second certificate signing request to the consortium blockchain certification center, which serves as the access control for the consortium blockchain, through the server to obtain an on-chain operation certificate for operation on the consortium blockchain. S4, construct a distributed identity document for the user, wherein the distributed identity document aggregates the public key information of the unified public-private key pair and the verifiable credential information represented by the third-party CA certificate; S5, guide the user to import the on-chain operation certificate and the private key of the unified public-private key pair associated with it into their blockchain wallet; S6. Using the wallet, sign an on-chain transaction for registering the distributed identity, and write the distributed identity and its distributed identity document into the distributed identity registration smart contract on the consortium blockchain to complete the association between the user's on-chain identity and the entity user. S7, User login verification, login is allowed after successful verification.

[0028] This invention provides an innovative distributed identity association and verification system, aiming to solve the problems of user identity credibility, traceability, and interoperability in consortium blockchain environments. The core of this invention lies in organically combining the authoritative identity authentication capabilities of a trusted third-party certification authority (CA), the operational credential system of a consortium blockchain CA, and a W3C-compliant distributed identity (DID) model to construct a secure, compliant, and user-friendly unified identity platform.

[0029] Reference Figure 1 In a specific implementation, the system of the present invention includes a front-end interaction module, a back-end processing module, a smart contract module, and a database module; Front-end interaction module: Serving as the user interface for this system, it is developed using modern front-end frameworks such as Vue and runs in the user's browser. It presents the registration wizard and multi-mode login interface to the user, and securely handles client key generation, signature requests, and on-chain transaction initiation tasks by calling the browser's built-in WebCrypto API and the Chang'an Chain wallet plugin's API.

[0030] Backend processing module: Built on the Java Spring framework, it is the central hub of the entire system's business logic. It orchestrates the registration process, securely communicates with trusted third-party CAs and consortium blockchain CAs via RESTful APIs to obtain and verify user credentials, and processes user login verification requests.

[0031] Smart contract module: Deployed on a consortium blockchain (such as Chang'an Chain), it serves as an on-chain registry for DIDs. Written in Solidity, it stores the association between a user's DID and their identity information in an immutable manner.

[0032] The database module uses MySQL to store user tables, which store user account information, user entity identity information, and the association between user on-chain operation certificates and distributed identities.

[0033] Example 1: A one-step distributed identity association method: Reference Figure 2 , Figure 3 This invention discloses a one-step strong identity registration method, whose business process aims to automatically and streamlinedly associate a new user's physical identity with their on-chain identity. Specifically, it includes the following steps: S1, Registration and Entity Verification Initiation: The user initiates a registration request on the front-end interaction module. The front-end module first calls the back-end processing module's interface to obtain a redirect URL containing a registration ID that points to a trusted third-party certification authority (CA). Subsequently, the front-end module redirects the user's browser to this URL. On the third-party CA's interface, the user completes the standard KYC (Know Your Customer) process, such as facial recognition and submitting ID card information.

[0034] S2, Backend Credential Preparation: After the user completes entity identity verification at the third-party CA, the third-party CA redirects the user's browser back to the callback address specified by the frontend module, along with a one-time authorization code. During this period, the frontend module displays a "processing" status to the user and polls the backend status. The third-party CA callback (ca-callback) interface of the backend processing module is triggered, and the backend processing module automatically executes a series of credential preparation tasks, specifically including the following steps: S201, the backend processing module uses the received authorization code to request a verifiable credential (VC) containing the user's authoritative entity information from a third-party CA, and uses a pre-set CA public key to verify the signature of the obtained verifiable credential (VC) to ensure the authenticity and integrity of the obtained verifiable credential (VC).

[0035] S202, the backend processing module extracts the authoritative entity information from the verifiable credential (VC), and applies for one or more certificates (on-chain operation certificates) for the user to operate on the consortium blockchain by calling the SDK or API provided by the Consortium Blockchain Certification Center (CC), such as signing certificates and TLS certificates.

[0036] S203 After successfully obtaining the on-chain operation certificate file from the consortium blockchain CA, the backend processing module updates the process status to "pending activation" and associates and caches the verifiable credential (VC) and on-chain operation certificate with the registration process ID.

[0037] S3, User Activation and DID On-Chain: After the front-end interaction module obtains the "Pending Activation" status through polling, it updates the interface and guides the user to perform the final activation steps, including the following steps: S301, the front-end module provides users with an interface to download their dedicated on-chain operation certificate, along with a clear illustrated guide. Users download the certificate file and manually import it into their blockchain wallet plugin.

[0038] S302: After importing the certificate, the user clicks the "Complete Final Registration" button on the front-end interface. The front-end module then makes its first connection request to the user's wallet plugin. Since the certificate has been imported, the connection is successful, and the user's on-chain address, determined by the certificate, is returned.

[0039] S303, the front-end module requests the back-end processing module to obtain all the "raw materials" prepared in this registration process, namely the complete content of the verified verifiable credentials (VC) and the necessary metadata for building the DID document, especially the verified VC.

[0040] S304. Based on the obtained wallet address and verified VC information, the front-end module constructs a complete, W3C-standard compliant DID document JSON string locally. This DID document JSON string aggregates the user's on-chain address, the public key information used for cryptographic verification, and the verified VC issued by a third-party CA. The public key information used for cryptographic verification can be extracted from the user's on-chain operation certificate or provided by the wallet.

[0041] In step S305, the front-end module calls the registration method of the smart contract module deployed on the consortium blockchain, passing the DID string and DID document as parameters. This call triggers a transaction confirmation window in the wallet plugin. The user then signs the registration transaction in their wallet using the private key of the on-chain operation certificate they just imported. Once the transaction is successfully recorded on the blockchain, the association between the user's entity identity, on-chain operation identity, and application-layer DID identity is complete.

[0042] Example 2, Authentication Method. (Refer to...) Figure 4 For users who have already registered, this invention provides a secure login method based on DID signature, the specific steps of which are as follows: S4, Initiating Login and Challenge: The user (U) clicks the "Login with Wallet" button on the front-end interaction module (F). The front-end interaction module (F) first requests to connect to the user's wallet plugin (W) to obtain their on-chain address. Then, the front-end interaction module (F) sends a request to the GET / did-nonce interface of the back-end processing module (B) to obtain a one-time challenge code (Nonce) for this login.

[0043] S5, Client Signing: The front-end interaction module (F) passes the obtained challenge code (Nonce) to the wallet plugin (W), requesting the user to sign it. The user (U) clicks the "Sign" button in the signature confirmation window popped up by the wallet plugin. The wallet uses the private key of its on-chain operation certificate to sign the Nonce and returns the signature result (Signature) to the front-end interaction module (F).

[0044] S6, Server-side verification: The front-end interaction module (F) submits the user's DID, the original Nonce, and the signature result (Signature) to the back-end processing module (B)'s POST / did-login interface. The back-end processing module (B) executes a multi-step verification process, specifically including: S601, Nonce Verification: Verify that the received nonce exists in the server's cache and ensure that it has not been used and is within its validity period.

[0045] S602, Credential Status Verification: After successful signature verification, the backend processing module (B) further parses the verifiable credential (VC) stored in the DID document JSON string and initiates a real-time query to the trusted third-party CA (CA) that issued the verifiable credential (VC) through the OCSP (Online Certificate Status Protocol, OCSP) or CRL (Certificate Revocation List, CRL) standard protocol to confirm that the user's entity identity credential is still valid at the current moment.

[0046] S603, Signature Verification: The backend processing module (B) initiates a read-only call to the smart contract module (DC) via a Remote Procedure Call (RPC) to execute the `resolvedid` method and obtain the corresponding DID document JSON string. Subsequently, it parses the user's public key from the DID document JSON string and uses this public key, the original Nonce, and the received Signature to execute a cryptographic signature verification algorithm to verify the authenticity of the signature. The token issued after login typically has a validity period of 300 minutes.

[0047] On the other hand, the present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, enables the distributed identity association and verification method combining consortium blockchain and trusted CA as described in the present invention.

[0048] The computer device may be a laptop, a desktop computer, or a workstation.

[0049] The present invention can also provide a computer device, including a processor and a memory, wherein the memory is used to store a computer executable program, the processor reads the computer executable program from the memory and executes it, and the processor can implement the distributed identity association and verification method combining consortium blockchain and trusted CA described in the present invention when executing the computer executable program.

[0050] The processor can be a central processing unit (CPU), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), or an off-the-shelf programmable gate array (FPGA).

[0051] The memory described in this invention can be an internal storage unit of a laptop, desktop computer, or workstation, such as memory or hard disk; or it can be an external storage unit, such as a portable hard disk or flash memory card.

[0052] Computer-readable storage media can include computer storage media and communication media. Computer storage media includes volatile and non-volatile, removable and non-removable media implemented using any method or technology for storing information such as computer-readable instructions, data structures, program modules, or other data. Computer-readable storage media can include: read-only memory (ROM), random access memory (RAM), solid-state drives (SSDs), or optical discs, etc. Random access memory can include resistive random access memory (ReRAM) and dynamic random access memory (DRAM).

[0053] In summary, this invention provides a distributed identity association method and verification system combining a consortium blockchain and a trusted Certificate Authority (CA). The method first guides the user to a trusted third-party Certificate Authority (CA) to verify their entity identity information and obtain an authoritative verifiable credential (VC). Second, the backend processing module, based on this VC, automatically requests the consortium blockchain's CA to issue an on-chain operation certificate for on-chain interaction. Subsequently, a distributed identity (DID) document aggregating the VC and the user's public key information is constructed for the user. Finally, the user is guided to import their on-chain operation certificate and corresponding private key into their blockchain wallet, and the user then... By personally signing a transaction, the user registers the DID and its document into a smart contract deployed on the blockchain. This addresses the issues of separation between on-chain identity and real-world entity identity, inconsistent roots of trust, and poor cross-platform interoperability in existing blockchain identity systems. Through a "one-step" registration process, the user's entity identity, on-chain operational identity, and standardized DID are unified and immutably linked on-chain. This establishes an identity system with the entity identity derived from a trusted third-party CA as the root of trust. While meeting stringent regulatory requirements, this system safeguards user sovereignty and security and enhances identity interoperability by leveraging the DID standard.

[0054] The above content is only for illustrating the technical concept of the present invention and should not be construed as limiting the scope of protection of the present invention. Any modifications made to the technical solution based on the technical concept proposed in this invention shall fall within the scope of protection of the claims of this invention.

Claims

1. A distributed identity association and verification method combining consortium blockchain and trusted CA, characterized in that, Includes the following steps: S1, based on the user's registration operation, generates a unified public-private key pair; S2, based on the public key of the unified public-private key pair and the entity identity information submitted by the user, generate the first certificate signing request, and submit the first certificate signing request to a trusted third-party certification center through the server to obtain a third-party CA certificate that encodes the entity identity information in the extended fields; S3. Based on the public key of the unified public-private key pair and the organization identity information required by the consortium blockchain, generate a second certificate signing request, and submit the second certificate signing request to the consortium blockchain certification center, which serves as the access control for the consortium blockchain, through the server to obtain an on-chain operation certificate for operation on the consortium blockchain. S4, construct a distributed identity document for the user, wherein the distributed identity document aggregates the public key information of the unified public-private key pair and the verifiable credential information represented by the third-party CA certificate; S5, guide the user to import the on-chain operation certificate and the private key of the unified public-private key pair associated with it into their blockchain wallet; S6. Using the wallet, sign an on-chain transaction for registering the distributed identity, and write the distributed identity and its distributed identity document into the distributed identity registration smart contract on the consortium blockchain to complete the association between the user's on-chain identity and the entity user. S7, User login verification, login is allowed after successful verification.

2. The distributed identity association and verification method combining consortium blockchain and trusted CA as described in claim 1, characterized in that, In S2, based on the public key of the unified public-private key pair and the entity identity information submitted by the user, a first certificate signing request is generated, and the first certificate signing request is submitted to a trusted third-party certification center through the server to obtain a third-party CA certificate that encodes the entity identity information in the extended fields. The process also includes: creating a user master account in the database of the server to store the custom account information, the user entity identity information, and the association relationship with the on-chain operation certificate and the distributed identity.

3. The distributed identity association and verification method combining consortium blockchain and trusted CA as described in claim 1, characterized in that, The third-party CA certificate is an X.509 digital certificate that encodes the identity information of the user entity in the Subject Alternate Name extension.

4. The distributed identity association and verification method combining consortium blockchain and trusted CA as described in claim 1, characterized in that, User login verification includes the following steps: S71, Receive a user's login request, the login request including a signature made by a challenge code generated by the user's wallet and the user's distributed identity; S72, by initiating a read-only call to the consortium blockchain node, query the DID registration smart contract to obtain the DID document associated with the user's distributed identity, and parse the public key information associated with the unified public-private key pair from the DID document; S73, Using the public key information, verify the validity of the signature and confirm the user's control over the distributed identity; S74, after the signature verification is successful, a login session is established for the user.

5. The distributed identity association and verification method combining consortium blockchain and trusted CA as described in claim 1, characterized in that, Login after verification includes: S75: Parse the verifiable credentials stored in the DID document; S76: Query the current validity status of the verifiable credential in real time from a trusted third-party certification authority via an online certificate status protocol or certificate revocation list; S77: Confirm successful user login only if the verifiable credential status is valid.

6. A distributed identity association and verification system combining consortium blockchain and trusted CA, characterized in that, A method for performing a distributed identity association and verification method combining a consortium blockchain and a trusted CA as described in any one of claims 1-5, comprising: The front-end interaction module uses HTML, CSS, and JavaScript front-end technologies and the VUE framework to build the user interface. It runs on the user client and provides a dialog window for users to complete entity identity information verification. It generates a unified public-private key pair locally and provides a dialog window for users to interact with smart contracts through wallets after obtaining on-chain operation certificates. The backend processing module uses the JAVA language combined with the Spring framework and runs on the server side. It is used to orchestrate the registration process, perform user real identity verification, interact with trusted third-party certification centers and the consortium blockchain certification center via API, obtain user credentials, and process user login verification requests. The smart contract module, deployed on the consortium blockchain, provides an on-chain registry for distributed identity, storing the mapping relationship between DID and its DID document; The database module uses MySQL to store user tables, which store user account information, user entity identity information, and the association between user on-chain operation certificates and distributed identities.

7. The distributed identity association and verification system combining consortium blockchain and trusted CA as described in claim 6, characterized in that, When a user initiates a registration request on the front-end interaction module, the front-end module calls the interface of the back-end processing module to obtain a redirect URL containing the registration process ID that points to a trusted third-party certification center. The front-end module then redirects the user's browser to this URL, and the user completes the entity identity information verification on the third-party CA's interface. The third-party CA redirects the user's browser back to the callback address specified by the front-end module, along with a one-time authorization code. The front-end module displays a "processing" status to the user and polls the back-end status. The third-party CA callback interface of the back-end processing module is triggered. The back-end processing module requests the third-party CA to exchange for a verifiable credential containing the user's authoritative entity information and applies for a certificate for the user to operate on the consortium blockchain. The verifiable credential and the on-chain operation certificate are associated with the registration process ID and cached. After the front-end interaction module obtains the "pending activation" status through polling, it updates the interface and provides the user with a dialog window to perform the final activation and complete the registration. When a user logs in using their wallet on the front-end interaction module, the front-end interaction module requests to connect to the user's wallet plugin to obtain their on-chain address. The front-end interaction module then sends a request to the GET / did-nonce interface of the back-end processing module to obtain a one-time challenge code for this login. The front-end interaction module passes the obtained challenge code to the wallet plugin, requests the user to sign it, the user confirms the signature, the wallet uses the private key of the on-chain operation certificate to sign the one-time challenge code, and returns the signature result to the front-end interaction module; The front-end interaction module submits the user's distributed identity, original one-time challenge code, and signature result to the POST / did-login interface of the back-end processing module, and the back-end processing module performs verification. After all verifications are successful, the backend processing module confirms the user's identity is legitimate, queries the user's role and permission information from the database module, and generates a standard JWT as a session credential to return to the frontend interaction module. The frontend interaction module stores the standard JWT and carries it in all subsequent API requests to maintain the login status.

8. The distributed identity association and verification system combining consortium blockchain and trusted CA as described in claim 6, characterized in that, The backend processing module performs verification including: Verify that the received one-time challenge code exists in the server's cache, and ensure that the one-time challenge code has not been used and is within its validity period; After successful signature verification, the backend processing module further parses the verifiable credentials stored in the distributed identity document JSON string, and initiates a real-time query to the trusted third-party CA that issued the verifiable credentials through the OCSP or CRL standard protocol to confirm that the user's entity identity credentials are valid at the current moment. The backend processing module initiates a read-only call to the smart contract module via remote procedure call, executes the parsing method, obtains the DID document JSON string corresponding to the DID, parses the user's public key from the DID document JSON string, and uses the public key, the original Nonce, and the received Signature to execute a cryptographic signature verification algorithm to verify the authenticity of the signature.

9. A computer device, characterized in that, It includes a processor and a memory, the memory being used to store a computer-executable program, the processor reading the computer-executable program from the memory and executing it, and the processor executing the computer-executable program being able to implement the distributed identity association and verification method combining consortium blockchain and trusted CA as described in any one of claims 1-5.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, enables the distributed identity association and verification method combining a consortium blockchain and a trusted CA as described in any one of claims 1-5.

Images