Method and apparatus for trusted digital credential verification based on distributed digital identity

Abstract

This invention relates to the field of digital identity authentication technology, and more particularly to a method and apparatus for verifying trusted digital credentials based on distributed digital identity. The method uses initial verification parameters determined by credential metadata to perform distributed verification of the digital credential to be verified to obtain verification feature parameters. A credibility metric is calculated and compared with a preset credibility threshold to determine credibility. If untrustworthy, deep verification is performed by adjusting the initial verification parameters, and cross-verification or third-party endorsement verification strategies are intelligently selected. Further verification is then determined based on a comparison of the verification residual index with a preset residual threshold, adjusting the number of verification nodes or endorsers accordingly. This invention achieves dynamic quantitative evaluation and closed-loop adaptive correction of credential credibility, reducing false positive and false negative rates, optimizing verification resource allocation, and improving verification accuracy and reliability.

Description

Technical Field

[0001] This invention relates to the field of digital identity authentication technology, and in particular to a method and apparatus for verifying trusted digital credentials based on distributed digital identity. Background Technology

[0002] The issuance, holding, and verification processes of trusted digital credentials based on distributed digital identity (DID) have been decentralized and are widely used for cross-institutional identity authentication and data sharing. The verifier obtains the issuer's public key through distributed ledger technology, and then verifies the credential signature and status, thus completing a trusted verification. However, as application scenarios evolve towards multi-source heterogeneity and high dynamism, existing verification mechanisms lack the ability to dynamically quantify the credibility of credentials and continuously correct trust outcomes.

[0003] Chinese Patent Application Publication No. CN120692041A discloses a distributed digital identity (DID) verification method and apparatus. This scheme is based on data processing technology, uses a preset encryption algorithm to generate a public-private key pair for an object, and then generates a DID identifier. Based on the DID identifier, a DID document is generated and stored in the blockchain. During verification, the object generates an identity authentication request based on the DID identifier and sends it to a first server. The object obtains the verifiable declaration it has published from the first server, combines the object's private key to generate an identity attribute certificate and a Merkle tree, and then generates verifiable credentials and sends them to a second server to complete the verification.

[0004] The above technical solutions have the following shortcomings: First, the fixed verification parameters cannot cope with diverse voucher types, resulting in insufficient verification; second, there is no secondary correction, and the trust score is fixed after the initial generation, making it impossible to iteratively correct the score according to the dynamic changes in the voucher status, resulting in insufficient timeliness of the trust results; third, the verification results are highly subjective, and the evaluation of the accuracy of the trust scoring model relies on human experience and intuition, lacking objective and quantifiable accuracy evaluation standards and automatic calibration mechanisms, making it difficult to continuously guarantee the reliability of the verification results. Summary of the Invention

[0005] To address this issue, the present invention provides a trusted digital credential verification method and apparatus based on distributed digital identity, which overcomes the problem in the prior art that the assessment of the credibility of credentials lacks objective quantitative basis due to reliance on a single or fixed data source, resulting in the trust score being fixed after initial generation and unable to be iteratively corrected according to the dynamic changes in the credential status.

[0006] To achieve the above objectives, the present invention provides a trusted digital credential verification method based on distributed digital identity, comprising: Based on the digital voucher to be verified, the voucher type identifier and voucher issuer information are extracted from the voucher metadata. The voucher metadata includes the voucher format version, voucher validity period, and voucher declaration content summary. Initial verification parameters are determined based on the credential type identifier and the credential issuer information, wherein the initial verification parameters include verification depth level, verification dimension set and trust anchor threshold; Based on the initial verification parameters, the digital credential to be verified is subjected to distributed verification to obtain verification feature parameters, wherein the verification feature parameters include the credibility of the issuer's DID, the validity of the credential status, and the integrity of the verification path. The credibility metric value of the credential obtained based on the verification feature parameters is compared with a preset credibility threshold to determine whether the digital credential to be verified is credible. Based on the untrustworthy determination result, the initial verification parameters are adjusted to perform deep verification. The adjustment methods include increasing the verification depth level, expanding the verification dimension set, or decreasing the trust anchor threshold. The voucher verification strategy is determined based on the re-acquired verification feature parameters after adjustment, and the voucher status information after verification is obtained. The voucher verification strategy includes cross-validation and third-party endorsement verification. The verification residual index obtained based on the voucher status information is compared with a preset residual threshold to determine whether a second correction verification is required. Based on the results of the secondary correction verification, the execution parameters of the credential verification strategy are adjusted, wherein the execution parameters include the number of verification nodes for the cross-validation strategy and the number of endorsers for the third-party endorsement verification strategy.

[0007] Furthermore, the process of obtaining the credential credibility measure based on the verification feature parameters includes: The credibility of the issuer's DID, the validity of the credential status, and the integrity of the verification path are quantitatively scored to obtain the corresponding issuer credibility score, validity status score, and path integrity score. The credibility metric of the credential is obtained by multiplying the issuer credibility score, the status validity score, and the path integrity score.

[0008] Furthermore, the process of determining whether the digital credential to be verified is trustworthy includes: Based on the comparison result that the credibility metric of the credential is less than the preset credibility threshold, the digital credential to be verified is determined to be untrustworthy.

[0009] Furthermore, the process of adjusting the initial verification parameters includes: The increase in the verification depth level is determined based on the confidence index difference and the level increment coefficient, wherein the confidence index difference is the difference between the preset confidence threshold and the credential confidence measurement value. Based on the comparison results between the issuer's credibility score and the preset credibility score threshold, determine whether to expand the set of verification dimensions; Based on the comparison between the path integrity score and the preset integrity score threshold, it is determined whether to lower the trust anchor threshold.

[0010] Furthermore, based on the comparison results of the issuer's credibility score being less than the preset credibility score threshold, the set of verification dimensions is expanded. Based on the comparison results where the path integrity score is less than the preset integrity score threshold, it is determined to lower the trust anchor threshold.

[0011] Furthermore, the expansion range of the verification dimension set is determined based on the credibility score deviation value and the dimension increment coefficient, wherein the credibility score deviation value is the difference between the preset credibility score threshold and the issuer's credibility score; The reduction range of the trust anchor threshold is determined based on the complete score deviation value and the anchor reduction coefficient, wherein the complete score deviation value is the difference between the preset complete score threshold and the path complete score.

[0012] Furthermore, the process of determining the credential verification strategy includes: Based on the comparison results of the re-acquired issuer credibility score being greater than or equal to the preset credibility score threshold and the re-acquired path integrity score being greater than or equal to the preset integrity score threshold, it is determined that a cross-validation strategy should be adopted. Based on the comparison results of the re-acquired issuer credibility score being less than the preset credibility score threshold and the valid status score being greater than or equal to the valid status threshold, or based on the comparison results of the re-acquired path integrity score being less than the preset integrity score threshold and the valid status score being greater than or equal to the valid status threshold, a third-party endorsement verification strategy is determined to be adopted.

[0013] Furthermore, the process of determining whether to perform a second correction verification includes: Based on the comparison results where the verification residual index is greater than the preset residual threshold, it is determined that a second correction verification will be performed.

[0014] Furthermore, the process of adjusting the execution parameters of the credential verification strategy includes: The verification intensity correction coefficient is calculated based on the verification residual index, wherein the verification intensity correction coefficient is positively correlated with the verification residual index; The number of verification nodes in the cross-validation strategy or the number of endorsers in the third-party endorsed validation strategy can be adjusted based on the verification strength correction coefficient.

[0015] The present invention also provides a trusted digital credential verification device based on distributed digital identity, comprising: The data acquisition module is used to extract the voucher type identifier and voucher issuer information based on the voucher metadata determined by the digital voucher to be verified. The feature parameter acquisition module is used to determine initial verification parameters based on the certificate type identifier and the certificate issuer information, and to perform distributed verification on the digital certificate to be verified based on the initial verification parameters to obtain verification feature parameters. The credibility determination module is used to determine whether the digital credential to be verified is credible based on the comparison result between the credential credibility measurement value obtained from the verification feature parameters and the preset credibility threshold. A verification parameter adjustment module is used to determine the adjustment of the initial verification parameters for deep verification based on the unreliable determination result; The verification strategy determination module is used to determine the credential verification strategy based on the re-acquired verification feature parameters, and to obtain the credential status information after verification. The secondary correction verification module is used to determine whether to perform secondary correction verification based on the comparison result between the verification residual index obtained from the voucher status information and the preset residual threshold. An execution parameter adjustment module is used to determine the execution parameters of the credential verification strategy based on the results of the secondary correction verification.

[0016] Compared with existing technologies, the advantages of this invention lie in its ability to extract credential metadata to determine initial verification parameters, and then perform distributed verification of the digital credential to be verified based on these parameters. This process acquires multi-dimensional features such as issuer DID credibility, credential status validity, and verification path integrity, thereby calculating a credential credibility metric and comparing it with a preset credibility threshold to determine the credibility of the credential. If the credential is deemed untrustworthy, deeper verification is performed by increasing the verification depth level, expanding the verification dimension set, or lowering the trust anchor threshold. Cross-validation or third-party endorsement verification strategies are determined based on the re-acquired feature parameters. Finally, a secondary correction verification is performed based on the comparison result of the verification residual index and the preset residual threshold, and the number of verification nodes or endorsers is adjusted accordingly. Through this multi-level, closed-loop feedback verification mechanism, accurate and adaptive evaluation of credible digital credentials is achieved, significantly reducing the false positive and false negative rates, while optimizing the allocation efficiency of verification resources.

[0017] Furthermore, this invention determines the extent to which the verification depth level is increased by introducing a credibility index difference and a level increment coefficient; simultaneously, it determines the extent to which the verification dimension set is expanded by using a credibility score deviation value and a dimension increment coefficient, and determines the extent to which the trust anchor threshold is reduced by using a completeness score deviation value and an anchor point reduction coefficient. This hierarchical and continuous adaptive adjustment mechanism enables the control system to accurately allocate deep verification resources according to the severity of the trust gap, avoiding blind or insufficient adjustment.

[0018] Furthermore, after re-acquiring the verification feature parameters, this invention intelligently selects a verification strategy based on the compliance status of the issuer's DID credibility and the integrity of the verification path: when both the issuer and the path meet the requirements, an efficient cross-validation strategy is adopted; when the issuer or path is questionable but the credential status is valid, a third-party endorsement verification strategy is adopted to obtain additional trust evidence. This strategy selection mechanism significantly improves the verification success rate and maintains high verification reliability even after the trust anchor threshold is reduced, enhancing the system's interoperability across heterogeneous trust domains.

[0019] Furthermore, this invention introduces a comparison between the verification residual index and a preset residual threshold as the basis for determining whether to perform secondary correction verification. The verification residual index comprehensively reflects the uncertainty of the initial verification, the inconsistency of scores across various dimensions, or the degree of conflict among multiple data sources. It is more sensitive than simply relying on credible / uncredible conclusions and can detect potential misjudgment risks in advance. Secondary correction verification is only initiated when the residual exceeds the threshold, effectively avoiding invalid deep verification and saving computational resources.

[0020] Furthermore, in the secondary correction verification, this invention calculates a verification strength correction coefficient positively correlated with the residual based on the verification residual index, and adjusts the number of verification nodes in the cross-validation strategy or the number of endorsers in the third-party endorsed verification strategy accordingly. The larger the residual, the larger the verification strength correction coefficient, and the more verification nodes or endorsers are involved, achieving intelligent adjustment that requires more verification resources to be invested when uncertainty is greater. At the same time, the coefficient has an upper limit and the basic strength is not reduced, achieving an optimal balance between security and resource consumption.

[0021] Furthermore, this invention also provides a corresponding trusted digital credential verification device, including a data acquisition module, a feature parameter acquisition module, a trust determination module, a verification parameter adjustment module, a verification strategy determination module, a secondary correction verification module, and an execution parameter adjustment module. Each module corresponds to the above method steps, forming a complete closed-loop feedback system. The modular design facilitates engineering deployment, algorithm iteration, and cross-platform integration, lowering the threshold for applying this technology to practical distributed digital identity systems. Attached Figure Description

[0022] Figure 1This is a schematic diagram of the modules of the trusted digital credential verification device based on distributed digital identity according to an embodiment of the present invention; Figure 2 This is a flowchart illustrating the trusted digital credential verification method based on distributed digital identity, as described in an embodiment of the present invention. Figure 3 This is a logic diagram illustrating how the reliability of a digital credential to be verified is determined based on a credential reliability metric in an embodiment of the present invention. Figure 4 This is a logic diagram for determining whether to perform secondary correction verification based on the verification residual index obtained from the voucher status information in an embodiment of the present invention. Detailed Implementation

[0023] To make the objectives and advantages of the present invention clearer, the present invention will be further described below with reference to embodiments; it should be understood that the specific embodiments described herein are merely for explaining the present invention and are not intended to limit the present invention.

[0024] Preferred embodiments of the present invention will now be described with reference to the accompanying drawings. Those skilled in the art should understand that these embodiments are merely illustrative of the technical principles of the present invention and are not intended to limit the scope of protection of the present invention.

[0025] It should be noted that in the description of this invention, the terms "upper", "lower", "left", "right", "inner", "outer", etc., which indicate directions or positional relationships, are based on the directions or positional relationships shown in the accompanying drawings. This is only for the convenience of description and is not intended to indicate or imply that the device or element must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, it should not be construed as a limitation of this invention.

[0026] Furthermore, it should be noted that, in the description of this invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0027] Please see Figure 1 As shown, it is a schematic diagram of the module of the trusted digital credential verification device based on distributed digital identity in an embodiment of the present invention.

[0028] The data acquisition module is used to extract the voucher type identifier and voucher issuer information based on the voucher metadata determined by the digital voucher to be verified. The feature parameter acquisition module, which is connected to the data acquisition module, is used to determine the initial verification parameters based on the voucher type identifier and voucher issuer information, and to perform distributed verification of the digital voucher to be verified based on the initial verification parameters to obtain the verification feature parameters. The credibility determination module is connected to the feature parameter acquisition module and the verification parameter adjustment module respectively. It is used to determine whether the digital certificate to be verified is credible based on the comparison result between the certificate credibility measurement value obtained from the verification feature parameters and the preset credibility threshold. The verification parameter adjustment module is connected to the feature parameter acquisition module and the credibility determination module respectively, and is used to determine and adjust the initial verification parameters based on the untrustworthy determination result for deep verification. The verification strategy determination module is connected to the feature parameter acquisition module and the secondary correction verification module, respectively, to determine the voucher verification strategy based on the re-acquired verification feature parameters, and to acquire the voucher status information after verification. The secondary correction verification module is connected to the verification strategy determination module and the execution parameter adjustment module respectively. It is used to determine whether to perform secondary correction verification based on the comparison result between the verification residual index obtained from the voucher status information and the preset residual threshold. The execution parameter adjustment module, which is connected to the verification strategy determination module, is used to determine the execution parameters of the credential verification strategy based on the results of the secondary correction verification.

[0029] Please see Figure 2 The diagram shown is a flowchart illustrating the trusted digital credential verification method based on distributed digital identity according to an embodiment of the present invention. The verification method in this embodiment includes: Step S1: Extract the voucher type identifier and voucher issuer information based on the voucher metadata determined by the digital voucher to be verified. The voucher metadata includes the voucher format version, voucher validity period, and voucher declaration content summary. Step S2: Determine the initial verification parameters based on the credential type identifier and credential issuer information. The initial verification parameters include the verification depth level, the set of verification dimensions, and the trust anchor threshold. Step S3: Perform distributed verification of the digital credential to be verified based on the initial verification parameters to obtain verification feature parameters, including the issuer DID credibility, credential status validity, and verification path integrity. Step S4: The credibility metric value of the credential obtained based on the verification feature parameters is compared with the preset credibility threshold to determine whether the digital credential to be verified is credible. Step S5: Based on the untrustworthy determination result, determine the adjustment of the initial verification parameters to perform deep verification. The adjustment methods include increasing the verification depth level, expanding the verification dimension set, or reducing the trust anchor threshold. Step S6: Determine the voucher verification strategy based on the re-acquired verification feature parameters after adjustment, and obtain the voucher status information after verification. The voucher verification strategy includes cross-validation and third-party endorsement verification. Step S7: Compare the verification residual index obtained based on the voucher status information with the preset residual threshold to determine whether to perform secondary correction verification. Step S8: Based on the results of the secondary correction verification, adjust the execution parameters of the credential verification strategy. The execution parameters include the number of verification nodes for the cross-validation strategy and the number of endorsers for the third-party endorsement verification strategy.

[0030] Specifically, in step S1, the certificate metadata of the digital certificate to be verified is temporarily stored in the certificate receiving temporary storage area. The certificate format version parser identifies the format declaration field of the certificate and locates the metadata block. The format declaration field and the metadata block structure are mapped into key-value pairs. The program directly extracts the certificate type identifier and certificate issuer information through the key name of the key-value pair. In this embodiment, the credential metadata includes the credential format version, credential validity period, and a summary of the credential declaration content.

[0031] The voucher format version is determined based on the technical specifications and version number followed by the digital voucher, which determines which syntax rules and parsing logic the system uses to read the voucher; for example, if the voucher follows the W3C VC Data Model V2 specification, the system will use the V2 version parser and verification logic to read the voucher content.

[0032] The validity period of the certificate is determined based on two timestamps: the issuance date and the expiration date, which are used to determine the time window for the certificate to take effect and be used; for example, the certificate is valid from September 1, 2025 to September 1, 2026.

[0033] The credential statement content digest is determined based on the credential core statement and is used as the unique identifier and integrity verification benchmark of the credential core statement to be verified. For example, the credential format version parser serializes the credential statement content digest and calculates a 256-bit hash value through the SHA-256 hash engine. This hash value is embedded in the credential metadata.

[0034] Furthermore, in this embodiment, the extracted voucher type identifier and voucher issuer information are input into the feature parameter acquisition module to obtain subsequent verification feature parameters.

[0035] Specifically, in step S2, the initial verification parameters are determined based on the credential type identifier and credential issuer information. The initial verification parameters include the verification depth level, the set of verification dimensions, and the trust anchor threshold.

[0036] In this embodiment, the verification depth level is determined by the system by querying a preset credential type-verification depth mapping table through the credential type identifier. This mapping table is established based on factors such as the social and economic value claimed by the credential and the severity of the consequences of forgery.

[0037] In this embodiment, the verification dimension set first determines a basic dimension set based on the credential type identifier. Then, in response to a judgment result indicating that the verification depth level has reached a preset level, a trust anchor verification dimension is added by default to the basic dimensions. The basic dimension set includes at least the issuer's DID document parsing and credential status query.

[0038] In this embodiment, the trust anchor threshold adopts a composite mode of baseline value and risk adjustment. First, the baseline value of the trust anchor threshold is set by the verification depth level, and the higher the verification depth level, the more stringent the baseline value. Through the synergistic effect of the above three interrelated sub-processes, the system achieves fine-grained and adaptive configuration of the initial verification parameters, thereby enabling the next step of distributed verification.

[0039] Specifically, in step S3, the verification feature parameters are determined based on the verification depth level set in the initial verification parameters to control the traceability depth, the verification dimension set to determine the activated verification items, and the trust anchor threshold as the trusted acceptance standard for the path endpoint. This is used to provide structured quantitative input for subsequent trust determination. The verification feature parameters include the issuer DID trustworthiness, the validity of the credential status, and the integrity of the verification path.

[0040] Specifically, the system initiates a DID document parsing request to the distributed ledger through the issuer's DID, extracts the public key list and service endpoint information, and calls the issuer reputation assessment smart contract deployed in the distributed network. By querying on-chain behavioral data such as the issuer's total historical credential issuance volume, the proportion of revoked credentials, key update frequency, and complaint records, the system quantifies and scores the issuer's overall reputation, thus obtaining the issuer's DID credibility and issuer credibility score.

[0041] Specifically, the system initiates a status query request to the smart contract of the certificate status registry maintained on the distributed ledger by the certificate type identifier of the digital certificate to be verified. The registry synchronizes the revocation, freezing and expiration status of each certificate in real time through the event listening mechanism. At the same time, it converts different statuses into corresponding scores according to the preset status quantification mapping rules, thereby obtaining the certificate status validity and status validity score.

[0042] Specifically, starting with the issuer's DID, the traceability chain is traced upwards along the reference relationships of each node's DID document to the anchor point that meets the trust anchor point threshold requirements. Factors such as the number of hops, the credibility of intermediate nodes, and the occurrence of chain breaks are considered to evaluate the continuity and reliability of the traceability chain, resulting in a path integrity score. The path integrity score reflects the continuity and reliability of the traceability chain from the issuer to the acceptable trust anchor point.

[0043] Please see Figure 3 As shown, it is a logic diagram for determining whether a digital credential to be verified is trustworthy based on the credential trustworthiness metric value in an embodiment of the present invention.

[0044] Specifically, in step S4, the credibility metric is determined based on the product of the issuer credibility score, the status validity score, and the path integrity score, and is compared with a preset credibility threshold to determine whether the digital credential to be verified is credible.

[0045] In this embodiment, the system determines that the digital credential to be verified is untrustworthy based on the credential trust metric value being less than a preset trust threshold.

[0046] Specifically, this indicates that the overall credibility of the digital credential to be verified has not met the system's preset minimum acceptance standard. It lacks sufficient credibility in one or more dimensions, such as issuer credibility, status validity, and path integrity, resulting in an overall low level of trust. Therefore, the system determines the digital credential to be verified to be untrustworthy and adjusts the initial verification parameters to improve the system's accuracy.

[0047] In this embodiment, the system determines that the digital credential to be verified is trustworthy based on the credential trust metric value being greater than or equal to a preset trust threshold.

[0048] Specifically, this indicates that the overall trustworthiness of the digital credential to be verified has reached or exceeded the system's preset acceptable standard, and the overall trustworthiness in dimensions such as issuer trustworthiness, status validity, and path integrity meets the requirements. Therefore, the system determines that the digital credential to be verified is trustworthy.

[0049] Specifically, after accumulating at least several hundred verified credential samples labeled as either authentic or unreliable, rigorously verified labeled samples are collected. Multiple sets of credential credibility metrics are then collected to form a standard baseline sample set. The normal fluctuation range of the sample set is calculated and its average is taken as a preset credibility threshold, which can be set to 0.9 for example.

[0050] Specifically, in step S5, based on the system's determination in step S4 that the digital credential to be verified is untrustworthy, the verification depth level is increased, and the adjusted verification depth level is used to re-perform distributed verification of the digital credential to be verified for deep verification.

[0051] In this embodiment, the improved verification depth level is the sum of the current verification depth level and the level increment; wherein the level increment is the product of the level increment coefficient and the difference in the credibility index; and wherein the difference in the credibility index is the difference between the preset credibility threshold and the credibility measurement value of the credential. It should be noted that the result of the improved verification depth level calculation is rounded up.

[0052] It should be noted that the preset level increment coefficient is determined based on statistical analysis of historical verification data. This coefficient is used to convert the confidence index difference into a verification depth level increment, avoiding over-adjustment leading to wasted verification resources or under-adjustment leading to insufficient depth verification. When the level increment coefficient is less than 2, the verification depth level responds too slowly to changes in the confidence index difference; minor trust gaps fail to trigger effective depth verification supplementation, increasing the risk of missed detections. Therefore, the level increment coefficient is set to 2 for this example.

[0053] Furthermore, in this embodiment, an extended verification dimension set is determined based on the issuer's credibility score being less than a preset credibility score threshold.

[0054] Specifically, this indicates a decline in the reliability of the credential's source and a weakened trust chain. Therefore, an expanded set of verification dimensions is determined. Each of these expanded dimensions is then quantitatively scored, and the new scores are merged with the existing scores to recalculate the credential credibility metric, thereby ensuring the credibility of the digital credential to be verified across other dimensions.

[0055] In this embodiment, the expanded verification dimension set is the sum of the current verification dimension set and the dimension increment; wherein, the dimension increment is the product of the dimension increment coefficient and the credibility score deviation value; and the credibility score deviation value is the difference between the preset credibility score threshold and the issuer's credibility score. It is worth noting that the calculation result of the expanded verification dimension set is rounded up.

[0056] It should be noted that the preset dimension increment coefficient is determined based on statistical analysis of historical verification data. This coefficient is used to convert the credibility score deviation value into a specific number of expansions in the verification dimension set, avoiding over-adjustment leading to wasted verification resources or under-adjustment leading to insufficient discovery of credible evidence. When the dimension increment coefficient is greater than 2, the verification dimension set becomes overly sensitive to insufficient issuer scoring; even a slight credibility score deviation triggers verification of a large number of additional dimensions, resulting in excessive consumption of verification computation and query resources. Therefore, the dimension increment coefficient is set to 2 for this example.

[0057] Specifically, after constructing a trustworthy issuer rating database, a standard sample set is formed by collecting multiple sets of trustworthy issuer ratings. The normal fluctuation range of the sample set is calculated, and the average value is taken as the preset trustworthy rating threshold. For example, the preset trustworthy rating threshold can be set to 0.8.

[0058] In this embodiment, the set of verification dimensions is determined not to be expanded based on the issuer's credibility score being greater than or equal to a preset credibility score threshold.

[0059] Specifically, this indicates that the source of the credentials is reliable and the trust chain is solid. Therefore, the set of verification dimensions is not expanded.

[0060] Furthermore, based on the fact that the integrity of the verification path is less than the preset integrity score threshold, a threshold for reducing the trust anchor point is determined.

[0061] Specifically, this indicates that the traceability chain from the issuer to the trust anchor has connectivity defects, excessive hops, insufficient credibility of intermediate nodes, or broken paths. Therefore, it is determined to lower the trust anchor threshold. Then, based on the lowered trust anchor threshold, the traceability assessment from the issuer to the new trust anchor is re-executed, and the path integrity score is recalculated, thereby improving the system's credential verification success rate.

[0062] The reduced trust anchor threshold is the difference between the current trust anchor threshold and the anchor reduction; the anchor reduction is the product of the anchor reduction coefficient and the complete score deviation value; and the complete score deviation value is the difference between the preset complete score threshold and the path complete score.

[0063] It should be noted that during the system debugging phase, different degrees of faults such as invalid intermediate node certificates, abnormally increased path hop count, and circular references in DID documents are sequentially input. The discrete mapping relationship between the complete score deviation value corresponding to each fault degree and the minimum trust anchor threshold reduction required to achieve a satisfactory traceability success rate is recorded and linear regression is performed. The slope of the regression line is taken as the anchor reduction coefficient. For example, the anchor reduction coefficient is set to 0.2.

[0064] Furthermore, based on the fact that the integrity of the verification path is greater than or equal to the preset integrity score threshold, it is determined that the trust anchor threshold will not be lowered.

[0065] Specifically, this indicates that the connectivity, hop count, reliability of intermediate nodes, or path breaks in the traceability chain from the issuer to the trust anchor meet the requirements. Therefore, the trust anchor threshold is not lowered.

[0066] Specifically, after constructing a path integrity rating database, a standard sample set is formed by collecting multiple sets of path integrity ratings. The normal fluctuation range of the sample set is calculated, and the average value is taken as the preset integrity rating threshold. For example, the preset integrity rating threshold can be set to 0.85.

[0067] Specifically, in step S6, the credential verification strategy is determined based on the verification feature parameters that have been re-acquired after adjustment, and the verified credential status information is obtained. The credential verification strategy includes cross-validation and third-party endorsement verification.

[0068] In this embodiment, cross-validation is a verification mechanism based on multiple independent and unrelated peer verification nodes in a distributed network, used to avoid the risks of node failure, data tampering, or malicious attacks in single-point verification. The number of verification nodes in the cross-validation strategy is the number of independent verification nodes participating in parallel verification.

[0069] In this process, the verification nodes perform distributed parallel verification of the issuer's DID identity validity, on-chain evidence storage hash consistency, certificate lifecycle status, and digital signature legality of the digital certificate to be verified, and use the consensus consistency of the verification results of multiple nodes as the basis for verification.

[0070] In this embodiment, third-party endorsement verification is based on highly trusted authoritative entities with no vested interest in either the issuer or the verifier. This serves to address the trust shortcomings in the original verification process, thereby completing the verification mechanism for credential credibility. The number of endorsers in the third-party endorsement verification strategy refers to the number of authoritative entities providing such endorsements.

[0071] Among them, authoritative entities with high trust levels can issue compliance endorsement statements for cases where the basic status of the digital certificate to be verified is compliant and valid, but the credibility of the issuer's DID does not reach the preset threshold or there are defects in the integrity of the certificate verification path.

[0072] Furthermore, based on the adjusted verification depth level, verification dimension set, and trust anchor threshold obtained in step S5, the issuer trust score, state validity score, and path integrity score are re-obtained.

[0073] In this embodiment, a cross-validation strategy is determined to be adopted based on the fact that the re-acquired issuer credibility score is greater than or equal to a preset credibility score threshold and the re-acquired path integrity score is greater than or equal to a preset integrity score threshold.

[0074] Specifically, this indicates that the issuer itself is trustworthy and the trust traceability chain is complete. Therefore, a cross-validation strategy is adopted, which requires only multiple independent nodes to verify consistency in parallel, thereby improving verification efficiency and enhancing the trustworthiness of individual nodes.

[0075] In this embodiment, based on the comparison results where the re-acquired issuer credibility score is less than the preset credibility score threshold and the valid status score is greater than or equal to the valid status threshold, or the re-acquired path integrity score is less than the preset integrity score threshold and the valid status score is greater than or equal to the valid status threshold, it is determined that a third-party endorsement verification strategy will be adopted.

[0076] Specifically, this indicates a deficiency in the issuer's credibility or the integrity of its transmission path. Therefore, a third-party endorsement verification strategy is adopted, which involves introducing a highly trusted authoritative entity to issue a compliance endorsement statement, thereby addressing the trust gap.

[0077] In this embodiment, if the valid state score is less than the valid state threshold, the latest certificate metadata is retrieved from the source of the distributed ledger based on the digital certificate to be verified, and step S1 is continued to extract the certificate type identifier and certificate issuer information to eliminate misjudgments caused by inconsistencies in local cache or intermediate node data, thereby accurately determining the objective authenticity of the current state and providing a reliable basis for whether to conduct deep verification or introduce third-party endorsement.

[0078] If the valid status score is still less than the valid status threshold after re-acquiring the metadata, the credential is directly deemed untrustworthy and the process is terminated.

[0079] In this embodiment, if the valid status score is greater than or equal to the valid status threshold, it indicates that the voucher is valid; if the valid status score is less than the valid status threshold, it indicates that the voucher is in a frozen state, expired state, revoked state, or unsearchable state.

[0080] Specifically, the valid status threshold is determined based on the credential status query results and a preset status quantification mapping rule. The query results and mapping rule are as follows: if the valid status score is less than 1, it indicates that the credential is in an abnormal state such as revocation, freezing, expiration, or unsearchable. This abnormal state no longer meets the requirements, and even the introduction of third-party endorsement cannot remedy the fundamental deficiency. Therefore, the valid status threshold is set to 1 for this example.

[0081] Please see Figure 4 As shown, it is a logic decision diagram for determining whether to perform secondary correction verification based on the verification residual index obtained from the voucher status information in an embodiment of the present invention.

[0082] Specifically, in step S7, the verification residual index obtained based on the voucher status information is compared with a preset residual threshold to determine whether a secondary correction verification should be performed.

[0083] In this embodiment, the verification residual index is calculated based on the difference between a preset trust threshold and the trust metric of the re-obtained credential, and then compared with the preset trust threshold. The trust metric of the re-obtained credential is obtained by the above calculation based on the re-obtained issuer trust score, status validity score, and path integrity score.

[0084] In this embodiment, based on the fact that the verification residual index is less than or equal to a preset residual threshold, it is determined that no secondary correction verification will be performed.

[0085] Specifically, this indicates that the deviation between the initial verification result and the expected credible state is small, the consistency of the evaluation across all dimensions is high, and the confidence level of the verification result meets the system requirements. Therefore, it is determined that no secondary correction verification will be performed.

[0086] In this embodiment, a second correction verification is performed based on the fact that the verification residual index is greater than a preset residual threshold.

[0087] Specifically, this indicates significant inconsistencies in the evaluation across different dimensions or conflicts between validation data sources, resulting in a failure to meet system requirements in terms of confidence level of the validation results and a potential risk of misjudgment. Therefore, a second, corrective validation is determined. This involves further adjusting the execution parameters of the current validation strategy to improve the overall accuracy of the system.

[0088] Specifically, under the premise of building a verification residual index database, collect strictly confirmed historical verification records and corresponding business feedback tags, such as the initial conclusion correct tag or the initial conclusion incorrect tag. By collecting multiple sets of verification residual index values, calculate their normal fluctuation range and take the average value as the preset residual threshold, which can be set to 0.1 for example.

[0089] Specifically, in step S8, based on the results of the secondary correction verification, the execution parameters of the credential verification strategy are adjusted according to the verification strength correction coefficient. The execution parameters include the number of verification nodes for the cross-validation strategy and the number of endorsers for the third-party endorsement verification strategy.

[0090] In this embodiment, the verification strength correction coefficient is the sum of the correction coefficient benchmark value and the verification residual index, wherein the correction coefficient benchmark value is set to 1, and the verification strength correction coefficient and the verification residual index are positively correlated.

[0091] In this embodiment, the number of verification nodes to increase the cross-validation strategy is determined based on the fact that the verification strength correction coefficient is less than the correction coefficient threshold.

[0092] Specifically, this indicates that the uncertainty of the current verification results is still within a controllable range, and there is no need to introduce higher-level external trust anchors. Therefore, it is determined to increase the number of verification nodes in the cross-validation strategy. Furthermore, by expanding the number of independent verification nodes, the impact of data bias on the verification conclusions is reduced, thereby effectively improving the credibility of the verification results without excessively consuming endorsement resources.

[0093] The number of validation nodes in the adjusted cross-validation strategy is the product of the validation strength correction coefficient and the number of validation nodes in the original cross-validation strategy. The result needs to be rounded up.

[0094] In this embodiment, the number of endorsers for the added third-party endorsement verification strategy is determined based on the verification strength correction coefficient being greater than or equal to the correction coefficient threshold.

[0095] Specifically, this indicates a high degree of uncertainty in the current verification results, significant inconsistencies in the assessments across different dimensions, or serious conflicts between verification data sources. Simply increasing the number of verification nodes is insufficient to effectively eliminate the risk of misjudgment; a more authoritative entity needs to be introduced for credibility endorsement. Therefore, it is determined to increase the number of endorsers in the third-party endorsement verification strategy. Furthermore, by introducing multiple highly trusted authoritative entities to provide compliance endorsements for the target certificate and the issuer's issuance qualifications, the trust gap in the original verification process is addressed through multiple authoritative sources. This ensures that reliable verification conclusions can still be obtained even when there are serious deficiencies in the verification path or the issuer's reputation.

[0096] The number of endorsers for the adjusted third-party endorsement verification strategy is the verification strength correction coefficient plus the number of endorsers for the original third-party endorsement verification strategy. The result needs to be rounded up.

[0097] Specifically, the correction coefficient threshold is determined based on statistical analysis of misjudged samples in historical verification data. This threshold differentiates between verification strategies that increase the number of nodes and those that introduce external endorsement, thus achieving a balance between verification resource consumption and the reliability of verification conclusions. When the correction coefficient threshold is less than 1.2, the system prematurely switches to a third-party endorsement verification strategy, resulting in increased verification costs and latency. Therefore, the correction coefficient threshold is set to 1.2 for this example.

[0098] Furthermore, the verification is re-executed based on the adjusted execution parameters, and the final trustworthy determination result is output.

[0099] All technologies not mentioned in the above embodiments are existing technologies. It should be noted that the specific values ​​of each preset threshold are exemplary settings based on the specific test scenario of this embodiment. In specific implementation, those skilled in the art can obtain corresponding empirical values ​​by conducting a limited number of experiments, based on the calculation sensitivity of the voucher credibility measurement value and the verification residual index, and the tolerance of the actual voucher verification task scenario to the false positive rate and the false negative rate.

[0100] The technical solution of the present invention has been described above with reference to the preferred embodiments shown in the accompanying drawings. However, it will be readily understood by those skilled in the art that the scope of protection of the present invention is obviously not limited to these specific embodiments. Without departing from the principles of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will all fall within the scope of protection of the present invention.

Claims

1. A method for verifying trusted digital credentials based on distributed digital identity, characterized in that, include: Based on the digital voucher to be verified, the voucher type identifier and voucher issuer information are extracted from the voucher metadata. The voucher metadata includes the voucher format version, voucher validity period, and voucher declaration content summary. Initial verification parameters are determined based on the credential type identifier and the credential issuer information, wherein the initial verification parameters include verification depth level, verification dimension set and trust anchor threshold; Based on the initial verification parameters, the digital credential to be verified is subjected to distributed verification to obtain verification feature parameters, wherein the verification feature parameters include the credibility of the issuer's DID, the validity of the credential status, and the integrity of the verification path. The credibility metric value of the credential obtained based on the verification feature parameters is compared with a preset credibility threshold to determine whether the digital credential to be verified is credible. Based on the untrustworthy determination result, the initial verification parameters are adjusted to perform deep verification. The adjustment methods include increasing the verification depth level, expanding the verification dimension set, or decreasing the trust anchor threshold. The voucher verification strategy is determined based on the re-acquired verification feature parameters after adjustment, and the voucher status information after verification is obtained. The voucher verification strategy includes cross-validation and third-party endorsement verification. The verification residual index obtained based on the voucher status information is compared with a preset residual threshold to determine whether a second correction verification is required. Based on the results of the secondary correction verification, the execution parameters of the credential verification strategy are adjusted, wherein the execution parameters include the number of verification nodes for the cross-validation strategy and the number of endorsers for the third-party endorsement verification strategy.

2. The trusted digital credential verification method based on distributed digital identity according to claim 1, characterized in that, The process of obtaining the credential credibility measure value based on the verification feature parameters includes: The credibility of the issuer's DID, the validity of the credential status, and the integrity of the verification path are quantitatively scored to obtain the corresponding issuer credibility score, validity status score, and path integrity score. The credibility metric of the credential is obtained by multiplying the issuer credibility score, the status validity score, and the path integrity score.

3. The trusted digital credential verification method based on distributed digital identity according to claim 2, characterized in that, The process of determining whether the digital credential to be verified is trustworthy includes: Based on the comparison result that the credibility metric of the credential is less than the preset credibility threshold, the digital credential to be verified is determined to be untrustworthy.

4. The trusted digital credential verification method based on distributed digital identity according to claim 3, characterized in that, The process of adjusting the initial verification parameters includes: The increase in the verification depth level is determined based on the confidence index difference and the level increment coefficient, wherein the confidence index difference is the difference between the preset confidence threshold and the credential confidence measurement value. Based on the comparison results between the issuer's credibility score and the preset credibility score threshold, determine whether to expand the set of verification dimensions; Based on the comparison between the path integrity score and the preset integrity score threshold, it is determined whether to lower the trust anchor threshold.

5. The trusted digital credential verification method based on distributed digital identity according to claim 4, characterized in that, Based on the comparison results where the issuer's credibility score is less than the preset credibility score threshold, the set of verification dimensions is expanded. Based on the comparison results where the path integrity score is less than the preset integrity score threshold, it is determined to lower the trust anchor threshold.

6. The trusted digital credential verification method based on distributed digital identity according to claim 5, characterized in that, The expansion range of the verification dimension set is determined based on the credibility score deviation value and the dimension increment coefficient, wherein the credibility score deviation value is the difference between the preset credibility score threshold and the issuer's credibility score; The reduction range of the trust anchor threshold is determined based on the complete score deviation value and the anchor reduction coefficient, wherein the complete score deviation value is the difference between the preset complete score threshold and the path complete score.

7. The trusted digital credential verification method based on distributed digital identity according to claim 4, characterized in that, The process of determining the credential verification strategy includes: Based on the comparison results of the re-acquired issuer credibility score being greater than or equal to the preset credibility score threshold and the re-acquired path integrity score being greater than or equal to the preset integrity score threshold, it is determined that a cross-validation strategy should be adopted. Based on the comparison results of the re-acquired issuer credibility score being less than the preset credibility score threshold and the valid status score being greater than or equal to the valid status threshold, or based on the comparison results of the re-acquired path integrity score being less than the preset integrity score threshold and the valid status score being greater than or equal to the valid status threshold, a third-party endorsement verification strategy is determined to be adopted.

8. The trusted digital credential verification method based on distributed digital identity according to claim 1, characterized in that, The process of determining whether to perform a second correction verification includes: Based on the comparison results where the verification residual index is greater than the preset residual threshold, it is determined that a second correction verification will be performed.

9. The trusted digital credential verification method based on distributed digital identity according to claim 8, characterized in that, The process of adjusting the execution parameters of the credential verification strategy includes: The verification intensity correction coefficient is calculated based on the verification residual index, wherein the verification intensity correction coefficient is positively correlated with the verification residual index; The number of verification nodes in the cross-validation strategy or the number of endorsers in the third-party endorsed validation strategy can be adjusted based on the verification strength correction coefficient.

10. A trusted digital credential verification device based on distributed digital identity, used to implement the trusted digital credential verification method based on distributed digital identity as described in any one of claims 1-9, characterized in that, include: The data acquisition module is used to extract the voucher type identifier and voucher issuer information based on the voucher metadata determined by the digital voucher to be verified. The feature parameter acquisition module is used to determine initial verification parameters based on the certificate type identifier and the certificate issuer information, and to perform distributed verification on the digital certificate to be verified based on the initial verification parameters to obtain verification feature parameters. The credibility determination module is used to determine whether the digital credential to be verified is credible based on the comparison result between the credential credibility measurement value obtained from the verification feature parameters and the preset credibility threshold. A verification parameter adjustment module is used to determine the adjustment of the initial verification parameters for deep verification based on the unreliable determination result; The verification strategy determination module is used to determine the credential verification strategy based on the re-acquired verification feature parameters, and to obtain the credential status information after verification. The secondary correction verification module is used to determine whether to perform secondary correction verification based on the comparison result between the verification residual index obtained from the voucher status information and the preset residual threshold. An execution parameter adjustment module is used to determine the execution parameters of the credential verification strategy based on the results of the secondary correction verification.

Images