Extensible distributed identity authentication method and system based on blockchain anchoring and zero-knowledge proof

Abstract

This invention discloses a scalable distributed identity authentication method and system based on blockchain anchoring and zero-knowledge proofs. The identity owner constructs a DID document and publishes it to the IPFS network to obtain a CID, which serves as an immutable identity root. Simultaneously, the P2P network address is encrypted and written into the DID document to achieve topology hiding. The verifier sends a random challenge number, and the identity owner generates a proof based on an embedded zero-knowledge proof circuit. The verifier can complete stateless verification locally using only the CID, public key, and random number. After successful verification, the sender encapsulates the message into an authentication envelope. Each node performs multi-stage verification; failure results in discarding the message and deducting reputation, while success results in broadcasting. Both parties enter the data plane stage, exchanging decrypted addresses and communicating via a direct tunnel based on the QUIC protocol. Blockchain anchoring ensures the immutability of the identity, zero-knowledge proofs enable efficient offline verification, and encrypted network addresses achieve topology hiding.

Description

Technical Field

[0001] This invention belongs to the field of blockchain and information security technology, specifically relating to a scalable distributed identity authentication method and system based on blockchain anchoring and zero-knowledge proof. Background Technology

[0002] With the deep integration of large language models and decentralized physical infrastructure, autonomous intelligent agents are becoming increasingly prevalent in various scenarios such as consumer services, enterprise collaboration, and government interaction. However, the existing identity authentication system lacks a decentralized, verifiable, and privacy-protecting unified infrastructure, making it difficult to guarantee trusted communication between intelligent agents.

[0003] Currently, while the W3C's DID specification provides a framework for autonomous identity, it relies on mutable pointers or on-chain state queries, resulting in high verification latency and significant privacy risks. Traditional PKI systems depend on centralized institutions, creating single points of failure, which contradicts the goal of decentralization. Existing intelligent agent communication protocols (such as A2A and ANP) lack built-in authentication layers, and network addresses are often exposed in plaintext, making them vulnerable to DDoS and Sybil attacks. Although zero-knowledge proofs have been used for privacy protection, current implementations rely on external toolchains, making deployment complex and difficult to scale on resource-constrained devices.

[0004] To address the aforementioned issues, this invention provides a decentralized identity authentication method and system based on blockchain anchoring and zero-knowledge proofs. This method binds identity to an IPFS content identifier as an immutable anchor point, optionally anchored to the blockchain; it achieves stateless off-chain verification through zero-knowledge proofs, eliminating the need for on-chain queries; it implements topology hiding through encrypted network addresses and constructs a dual-plane communication stack that accommodates both broadcast discovery and high-speed direct connections. Furthermore, it achieves a zero-dependency SDK through compile-time pre-compilation, lowering the deployment threshold and adapting to various environments from edge to cloud, providing a secure and efficient decentralized identity authentication foundation for multiple scenarios. Summary of the Invention

[0005] To address the shortcomings of existing technologies, the present invention aims to provide a scalable distributed identity authentication method and system based on blockchain anchoring and zero-knowledge proofs, thereby overcoming the aforementioned deficiencies in existing technologies.

[0006] To achieve the above objectives, the present invention provides the following technical solution:

[0007] A scalable distributed identity authentication method based on blockchain anchoring and zero-knowledge proofs includes the following steps:

[0008] S1: The identity owner generates a key pair and constructs a DID document, publishes the DID document to the IPFS network to obtain a Content Identifier (CID), which serves as the globally unique and immutable root identifier of the identity, and encrypts the P2P network address information and writes it into the DID document.

[0009] S2: The verification party sends a random challenge number to the identity owner. The identity owner generates a proof based on a pre-generated and embedded zero-knowledge proof circuit and sends it to the verification party. The verification party completes stateless verification locally.

[0010] S3: After successful verification, the sender encapsulates the broadcast message into an authentication envelope. Each receiving node performs multi-stage verification. If the verification fails, the message is discarded. If the verification passes, the message is broadcast in the GossipSub network.

[0011] S4: After successful verification, both parties enter the data plane communication stage, exchange decrypted physical network addresses, and communicate using a point-to-point direct tunnel based on the QUIC protocol.

[0012] Preferably, in step S1:

[0013] The identity owner generates an Ed25519 key pair, which includes a public key and a private key, and constructs a DID document that conforms to the W3C standard. The DID document contains the public key as an identity controller and encrypted P2P network information as a server endpoint.

[0014] The CID is obtained through IPFS content encoding, and the internal state of the DID document is verified using the Poseidon hash function.

[0015] Preferably, in step S1:

[0016] The CID can be selectively anchored to the blockchain to form on-chain evidence, or published to IPNS to generate an identity gateway identifier to achieve identity discovery and updating;

[0017] When the identity owner needs to rotate the key, a new DID document is published and a new CID is obtained. The IPNS record is then updated to point to the new CID, while the old CID is retained as an immutable historical anchor.

[0018] Preferably, in step S1:

[0019] The P2P network address information is encrypted using AEAD with a symmetric key to generate ciphertext. The symmetric key is derived from the private key and the protocol static salt value through a key derivation function.

[0020] The ciphertext is digitally signed using the private key, and the ciphertext and the signature are written into the DID document as a server endpoint and then published to IPFS.

[0021] Preferably, in step S2:

[0022] The verification direction sends a random challenge number to the identity owner. The random number belongs to a 256-bit binary space to prevent replay attacks.

[0023] The identity owner receives the random number and generates a proof based on a pre-generated and embedded zero-knowledge proof circuit. The proof is used to prove that the hash value of the core data of the DID document matches the CID, that the private key correctly derives the public key, and that the random number is correctly bound to the proof.

[0024] Preferably, in step S2:

[0025] The zero-knowledge proof circuit uses a Plonk proof backend, is based on BN254 elliptic curves, is implemented in the Noir language, and is pre-compiled and embedded in the binary file in the form of static data during the software development kit construction phase.

[0026] Preferably, in step S2:

[0027] The verifier receives the proof and can verify it locally using only the CID, the public key, and the random number. The verification complexity is constant time, and there is no need to access the blockchain or centralized registry.

[0028] The verifier maintains a local random number cache to ensure that each random number is used only once.

[0029] As a preferred option, in step S3:

[0030] The authentication envelope contains the CID, message subject, message content, random number, proof, and digital signature of the message content by the sender using their private key;

[0031] The multi-stage verification includes: checking the freshness of the random number to prevent replay attacks, verifying the proof to confirm the sender's ownership of the CID, and verifying the digital signature to ensure message integrity.

[0032] If any verification fails, the message is discarded and the sending node is penalized based on the GossipSub scoring system. If the score is below the threshold, the node will be removed from the network.

[0033] Preferably, in step S4:

[0034] The direct tunnel is established based on Iroh's QUIC protocol, supports multiplexed streaming and built-in NAT traversal, and supports 0-RTT handshake to achieve low-latency data transmission.

[0035] A scalable distributed identity authentication system based on blockchain anchoring and zero-knowledge proofs includes the following modules:

[0036] The identity creation module is used to generate key pairs and construct DID documents, publish the DID documents to IPFS to obtain CIDs, and encrypt the P2P network address and write it into the DID documents.

[0037] The authentication module is used to send random challenges and generate proofs based on zero-knowledge proof circuits, completing stateless verification locally;

[0038] The authentication broadcast module is used to encapsulate messages into authentication envelopes and perform multi-stage verification. If the verification fails, the message is discarded; if the verification succeeds, it is broadcast in the GossipSub network.

[0039] The secure communication module is used to exchange decrypted network addresses and establish point-to-point direct tunnels based on the QUIC protocol for communication.

[0040] The beneficial effects of this invention are as follows: Decentralized identity authentication is achieved by combining blockchain anchoring with zero-knowledge proofs. Identity is bound to an immutable IPFS CID and optionally anchored to the blockchain. Simultaneously, zero-knowledge proofs enable stateless off-chain verification, ensuring the immutability of identity while achieving efficient offline verification. By encrypting P2P network address information and writing it into a DID document, only the identity owner can decrypt it to obtain their network coordinates, achieving topology hiding and effectively resisting network reconnaissance and DDoS attacks. A dual-plane communication stack is constructed: the control plane uses GossipSub for authentication broadcasting, and the data plane uses QUIC to establish a point-to-point direct tunnel, balancing the robustness of broadcast discovery with the high performance of point-to-point communication. Furthermore, compiling at compile time enables a zero-dependency SDK, lowering the deployment threshold. Attached Figure Description

[0041] Figure 1 This is a schematic diagram of the method of the present invention;

[0042] Figure 2 A schematic diagram of the identity creation module of the method of the present invention;

[0043] Figure 3 This is a schematic diagram of the authentication module of the method of the present invention;

[0044] Figure 4 This is a schematic diagram of the authentication broadcast module of the method of the present invention;

[0045] Figure 5 This is a schematic diagram of the secure communication module of the method of the present invention. Detailed Implementation

[0046] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0047] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein in the description of the invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items.

[0048] The embodiments of the present invention will be further described in detail below with reference to the accompanying drawings:

[0049] like Figures 1-5As shown in the specific embodiments of the present invention, a scalable distributed identity authentication method and system based on blockchain anchoring and zero-knowledge proof includes the following steps: S1, the identity owner generates a key pair and constructs a DID document, publishes the DID document to the IPFS network to obtain a Content Identifier (CID), which serves as the globally unique immutable root identifier of the identity, and encrypts the P2P network address information and writes it into the DID document; S2, the verifier sends a random challenge random number to the identity owner, the identity owner generates a proof based on a pre-generated and embedded zero-knowledge proof circuit and sends it to the verifier, and the verifier completes stateless verification locally; S3, after successful verification, the sender encapsulates the broadcast message into an authentication envelope, each receiving node performs multi-stage verification, if verification fails, the message is discarded, if verification succeeds, the message is broadcast in the GossipSub network; S4, after successful verification, both parties enter the data plane communication stage, exchange decrypted physical network addresses, and communicate using a point-to-point direct connection tunnel based on the QUIC protocol. In this context, "identity owner" refers to an autonomous intelligent agent seeking a verifiable identity in a decentralized network environment. This agent can be a large language model-driven intelligent agent, a decentralized physical infrastructure node, or other software entity with independent communication capabilities. A DID document is a structured data file conforming to the World Wide Web Consortium's decentralized identifier specification, used to carry identity control attribution and network access information. It typically contains an identity controller field, a public key field, and a server endpoint field. IPFS, or InterPlanetary File System, is a content-addressed distributed storage network. Unlike traditional network protocols that locate resources based on location, IPFS uses a hash digest calculated from the data content itself to locate and access data. This hash digest is the Content Identifier (CID), which has the characteristic that any change to the data content will cause the corresponding CID to change accordingly. Therefore, it can naturally serve as a verification basis for whether identity content has been tampered with.

[0050] Step S1 is specifically detailed as follows: The identity owner generates an Ed25519 key pair, including a public key and a private key, and constructs a DID document conforming to the W3C standard. The DID document contains the public key as an identity controller and encrypted P2P network information as a server endpoint. Ed25519 is a digital signature algorithm based on a distorted Edwards curve. Compared to traditional elliptic curve signature schemes, it features faster signature generation and verification speeds, shorter key lengths, and independence from random number generator quality, making it suitable for deployment on resource-constrained edge devices. The CID is obtained through IPFS content encoding, and the internal state of the DID document is verified using the Poseidon hash function. Here, the internal state refers to the core data field in the DID document used for zero-knowledge proof circuit operations, denoted as Dcore, which obtains its digital digest in the following way:

[0051]

[0052] in This represents the Poseidon hash function. This represents the core data field of the DID document. The Poseidon hash function is a hash algorithm specifically optimized for algebraic circuit operations. Compared to traditional hash functions such as SHA-256, it has significantly fewer multiplication gates in arithmetic circuits, thus greatly reducing the proof generation overhead of subsequent zero-knowledge proof circuits. This design choice is an important foundation for the lightweight deployment of zero-knowledge proofs on resource-constrained devices.

[0053] The CID can be selectively anchored to the blockchain to form on-chain evidence, or published to IPNS to generate an identity gateway identifier for identity discovery and updating. Blockchain anchoring refers to writing the CID and related evidence information into a ledger network with a distributed consensus mechanism, such as a consortium blockchain, to obtain an evidence record that is difficult to tamper with and can be independently verified by a third party. IPNS, or Interplanetary Naming System, is an auxiliary mechanism in the IPFS system used to implement variable name resolution. Through cryptographic redistribution, a relatively stable and readable identifier can point to the latest CID that changes over time. Unlike traditional schemes that directly bind the identity to a variable pointer, in this invention, IPNS is only used as an optional auxiliary means of identity discovery. The persistence and immutability of the identity itself are entirely carried by the immutable CID. The decoupling of the two ensures that the stability of the identity identifier is not affected by the reliability of the naming resolution mechanism itself. When the identity owner needs to change the key, a new DID document is published and a new CID is obtained. The IPNS record is updated to point to the new CID, and the old CID is retained as an immutable historical anchor. This mechanism ensures that each key change leaves a traceable historical record in the immutable storage layer, allowing any verifier to trace the complete identity change trajectory along the historical CID chain, thus supporting key updates without sacrificing auditing capabilities.

[0054] The P2P network address information is encrypted using AEAD with a symmetric key to generate ciphertext. The symmetric key is derived from the private key and the protocol static salt value through a key derivation function. Here, the P2P network address information refers to the physical network coordinates of the identity holder in the peer-to-peer network, used to be directly connected to by other nodes, including peer node identifiers and reachable multi-address information. The protocol static salt value is a fixed auxiliary parameter specified in the protocol of this invention, used to increase the determinism and uniqueness of the derivation result during the key derivation process. The key derivation function is an algorithm that expands the input secret material into a fixed-length key through one-way computation. The derivation process of this symmetric key is denoted as:

[0055]

[0056] in Represents a symmetric key. This represents the key derivation function. This represents the private key. This represents the static salt value of the protocol. AEAD, or Authenticated Encryption with Associated Data, is an encryption mode that guarantees both the confidentiality of the ciphertext and the integrity of both the ciphertext and the associated data. This invention uses the AES256-GCM algorithm as its specific implementation. The ciphertext is digitally signed using the private key, and the ciphertext and the signature are written into the DID document as server endpoints and published together to IPFS. A digital signature is an unforgeable cryptographic operation result performed on a data digest using a private key. Any third party holding the corresponding public key can verify whether the signature was indeed generated by the private key holder and whether the data has been tampered with. By writing the ciphertext and signature together into the DID document and publishing it to the immutable IPFS storage layer, the integrity and authenticity of the network address information are guaranteed with the same strength of immutability as the identity identifier itself.

[0057] After identity creation is complete, proceed to step S2: The verifier sends a random challenge number to the identity holder. The identity holder generates a proof based on a pre-generated and embedded zero-knowledge proof circuit and sends it to the verifier. The verifier completes stateless verification locally. Here, zero-knowledge proof is a type of cryptographic protocol that allows the prover to assure the verifier that the prover possesses the secret information without revealing the secret information itself. Stateless verification means that the verifier's verification process does not rely on reading or writing any external persistent state; it can independently complete the judgment based solely on the publicly available information obtained in this interaction.

[0058] Specifically, in step S2, the verifier sends a random challenge number to the identity holder. This random number belongs to a 256-bit binary space and is used to prevent replay attacks. The random challenge number is a one-time random value temporarily generated by the verifier in each verification session. A replay attack refers to an attack method in which an attacker intercepts previously valid proof data and repeatedly submits the same data in subsequent sessions to impersonate a legitimate identity. By introducing a unique random challenge number for each session and requiring the proof to be bound to this random number, historical proof data can be made invalid in new sessions. The identity holder receives the random number and generates a proof based on a pre-generated and embedded zero-knowledge proof circuit. This proof is used to prove that the hash value of the DID document's core data matches the CID, that the private key correctly derives the public key, and that the random number is correctly bound to the proof. The relationship verified by this proof can be expressed as:

[0059]

[0060]

[0061]

[0062] Where R represents the set of relations being verified in the proof. and It is the secret input held by the proving party. This represents the operation of deriving the corresponding public key from the private key. Represents the public key. The symbol represents a random challenge number, and Noncepub represents the publicly bound value of the random number after hashing. The symbol ∧ indicates that all three constraints must be met simultaneously. This relationship essentially consists of three sub-conditions: integrity constraint, ownership constraint, and liveness constraint. The integrity constraint ensures that the core document data held by the identity owner corresponds to the publicly released CID, preventing the identity owner from forging document content inconsistent with the CID for proof. The ownership constraint ensures that the proving party actually possesses the private key matching the public key declared in the DID document, rather than merely knowing the publicly available DID document content. The liveness constraint ensures that there is a cryptographic binding between the current proof and the random challenge number issued by the verifier, thus limiting the validity of the proof to the scope of this session.

[0063] The zero-knowledge proof circuit employs a Plonk proof backend, based on the BN254 elliptic curve model, and implemented in the Noir language. It is pre-compiled during the software development kit (SDK) build phase and embedded into the binary file as static data. Plonk is a general-purpose, non-interactive zero-knowledge proof system where the proof and verification keys can be generated once the circuit structure is determined, eliminating the need for resetting them for each specific proof. BN254 is an elliptic curve model that supports pairwise operations and is commonly used in zero-knowledge proof systems. Noir is a domain-specific programming language designed for writing zero-knowledge proof circuits. By pre-compiling the proof and verification keys during the SSD build phase and embedding them directly into the final executable binary file as static data, the runtime environment eliminates the need to call external circuit compilation toolchains or access the network to obtain proof parameters. This achieves a zero-dependency deployment, and this separation of the build and runtime phases is a key engineering foundation for this invention's adaptability to various resource-constrained scenarios, from edge devices to cloud environments.

[0064] The verifier receives the proof and can verify it locally using only the CID, the public key, and the random number. The verification complexity is constant time, without needing to access the blockchain or a centralized registry. The verifier maintains a local random number cache to ensure that each random number is used only once. Constant time means that the computational overhead required for the verification operation does not increase with the complexity of the DID document content. The local random number cache is a record table of used random numbers maintained locally by the verifier. It is used to check whether the submitted random number has been used while verifying the proof. If it has been used, the proof is directly deemed invalid. Thus, replay attacks can still be blocked under the stateless verification framework.

[0065] After successful authentication, proceed to step S3: The sender encapsulates the broadcast message into an authentication envelope. Each receiving node performs multi-stage verification; if verification fails, the message is discarded; if verification succeeds, the message is broadcast in the GossipSub network. The authentication envelope contains the CID, message subject, message content, the random number, the proof, and a digital signature of the message content by the sender using their private key. The authentication envelope is a complete encapsulation structure for a single broadcast message, and its construction can be represented as follows:

[0066]

[0067] Env stands for authentication envelope. Indicates the message subject. Indicates the message content, This indicates proof. This indicates the sender's understanding of the message content. The digital signature. GossipSub is a publish-subscribe messaging protocol used in peer-to-peer networks. Nodes spread messages through a combination of mesh connections and random pull, balancing propagation efficiency and network robustness. It is one of the modular components provided under the Libp2p framework. The multi-stage verification includes: checking the freshness of the random number to prevent replay attacks, verifying the proof to confirm the sender's ownership of the CID, and verifying the digital signature to ensure message integrity. Freshness checking verifies that the random number has not been previously recorded in the local cache, thus excluding historical envelopes that have been replayed; confirming ownership verifies that the sender does indeed possess the private key corresponding to the CID in the envelope by verifying the proof π; ensuring message integrity verifies whether the message content m has been tampered with since signing by verifying the signature σm. The three verifications are executed independently and sequentially; failure in any step terminates the subsequent verification process.

[0068] If any verification fails, the message is discarded and a reputation penalty is imposed on the sending node based on the GossipSub scoring system. Nodes with scores below a threshold are removed from the network. Reputation penalty refers to the GossipSub protocol maintaining a dynamic score for each participating node in the broadcast. When a node is found to have submitted a message that failed verification, its score is reduced accordingly. Nodes whose scores continue to fall below a preset threshold are deemed untrusted by other nodes in the grid, and their message forwarding relationship with the node is terminated. This combines the authentication result with the network layer's reputation governance mechanism, suppressing the continuous interference of malicious nodes on the broadcast network without relying on any centralized arbitrator.

[0069] Finally, in step S4: after successful verification, both parties enter the data plane communication phase, exchanging decrypted physical network addresses and communicating via a point-to-point direct tunnel based on the QUIC protocol. This direct tunnel is established based on the Iroh QUIC protocol, supporting multiplexed streaming transmission and built-in NAT traversal, and supporting 0-RTT handshakes to achieve low-latency data transmission. Iroh is a high-performance point-to-point network transmission component built on the QUIC protocol; QUIC is a multiplexed connection protocol running on top of the User Datagram Protocol with built-in transport layer encryption; multiplexed streaming transmission refers to carrying multiple independent data streams in parallel on a single underlying connection, avoiding mutual blocking between different data streams; NAT traversal is a technical means to help nodes behind network address translation devices establish connection paths that can be directly accessed externally, which this invention achieves by combining session traversal tools and relay traversal tools; 0-RTT handshake means that for previously authenticated communicating parties, when establishing a new connection, there is no need to re-execute the complete handshake negotiation process to directly start transmitting application data, thereby reducing the latency introduced during the connection establishment phase to near zero. At this point, the authentication result completed by the control plane is directly transformed into the trust foundation for establishing a high-performance direct connection tunnel in the data plane, achieving a balance between the robustness of broadcast discovery and the high performance of point-to-point transmission.

[0070] Corresponding to the above methods, this invention also provides a decentralized identity authentication device based on blockchain anchoring and zero-knowledge proof, comprising the following modules: an identity creation module, used to generate key pairs and construct a DID document, publish the DID document to IPFS to obtain a CID, and encrypt the P2P network address and write it into the DID document; an identity verification module, used to send random challenges and generate proofs based on zero-knowledge proof circuits, and complete stateless verification locally; an authentication broadcast module, used to encapsulate messages into authentication envelopes and perform multi-stage verification, discarding messages if verification fails and broadcasting them in the GossipSub network if verification passes; and a secure communication module, used to exchange decrypted network addresses and establish a peer-to-peer direct tunnel based on the QUIC protocol for communication. The four modules mentioned above correspond to the specific implementation processes of steps S1 to S4. Data is transmitted between the modules through identity identification and verification results: the DID document and CID produced by the identity creation module serve as the input basis for the identity verification module to generate and verify proofs; the verification results produced by the identity verification module determine whether the authentication broadcast module allows the corresponding broadcast message; the two-way verification results completed in the authentication broadcast module further serve as a prerequisite for the secure communication module to establish a direct connection tunnel. The four modules cooperate in the above order to jointly complete the complete link from identity creation to secure communication.

[0071] The above are merely preferred embodiments of the present invention. The scope of protection of the present invention is not limited to the above embodiments. All technical solutions falling within the scope of the present invention's concept are within the scope of protection of the present invention. It should be noted that for those skilled in the art, any improvements and modifications made without departing from the principle of the present invention should also be considered within the scope of protection of the present invention.

Claims

1. A scalable distributed identity authentication method based on blockchain anchoring and zero-knowledge proof, characterized in that, Includes the following steps: S1: The identity owner generates a key pair and constructs a DID document, publishes the DID document to the IPFS network to obtain a Content Identifier (CID), which serves as the globally unique and immutable root identifier of the identity, and encrypts the P2P network address information and writes it into the DID document. S2: The verification party sends a random challenge number to the identity owner. The identity owner generates a proof based on a pre-generated and embedded zero-knowledge proof circuit and sends it to the verification party. The verification party completes stateless verification locally. S3: After successful verification, the sender encapsulates the broadcast message into an authentication envelope. Each receiving node performs multi-stage verification. If the verification fails, the message is discarded. If the verification passes, the message is broadcast in the GossipSub network. S4: After successful verification, both parties enter the data plane communication stage, exchange decrypted physical network addresses, and communicate using a point-to-point direct tunnel based on the QUIC protocol.

2. The scalable distributed identity authentication method based on blockchain anchoring and zero-knowledge proof according to claim 1, characterized in that, In step S1: The identity owner generates an Ed25519 key pair, which includes a public key and a private key, and constructs a DID document that conforms to the W3C standard. The DID document contains the public key as an identity controller and encrypted P2P network information as a server endpoint. The CID is obtained through IPFS content encoding, and the internal state of the DID document is verified using the Poseidon hash function.

3. The scalable distributed identity authentication method based on blockchain anchoring and zero-knowledge proof according to claim 1, characterized in that, In step S1: The CID can be selectively anchored to the blockchain to form on-chain evidence, or published to IPNS to generate an identity gateway identifier to achieve identity discovery and updating; When the identity owner needs to rotate the key, a new DID document is published and a new CID is obtained. The IPNS record is then updated to point to the new CID, while the old CID is retained as an immutable historical anchor.

4. The scalable distributed identity authentication method based on blockchain anchoring and zero-knowledge proof as described in claim 1, characterized in that, In step S1: The P2P network address information is encrypted using AEAD with a symmetric key to generate ciphertext. The symmetric key is derived from the private key and the protocol static salt value through a key derivation function. The ciphertext is digitally signed using the private key, and the ciphertext and the signature are written into the DID document as a server endpoint and then published to IPFS.

5. The scalable distributed identity authentication method based on blockchain anchoring and zero-knowledge proof according to claim 1, characterized in that, In step S2: The verification direction sends a random challenge number to the identity owner. The random number belongs to a 256-bit binary space to prevent replay attacks. The identity owner receives the random number and generates a proof based on a pre-generated and embedded zero-knowledge proof circuit. The proof is used to prove that the hash value of the core data of the DID document matches the CID, that the private key correctly derives the public key, and that the random number is correctly bound to the proof.

6. The scalable distributed identity authentication method based on blockchain anchoring and zero-knowledge proof according to claim 5, characterized in that, In step S2: The zero-knowledge proof circuit uses a Plonk proof backend, is based on BN254 elliptic curves, is implemented in the Noir language, and is pre-compiled and embedded in the binary file in the form of static data during the software development kit construction phase.

7. The scalable distributed identity authentication method based on blockchain anchoring and zero-knowledge proof according to claim 1, characterized in that, In step S2: The verifier receives the proof and can verify it locally using only the CID, the public key, and the random number. The verification complexity is constant time, and there is no need to access the blockchain or centralized registry. The verifier maintains a local random number cache to ensure that each random number is used only once.

8. The decentralized identity authentication method based on blockchain anchoring and zero-knowledge proof according to claim 1, characterized in that, In step S3: The authentication envelope contains the CID, message subject, message content, random number, proof, and digital signature of the message content by the sender using their private key; The multi-stage verification includes: checking the freshness of the random number to prevent replay attacks, verifying the proof to confirm the sender's ownership of the CID, and verifying the digital signature to ensure message integrity. If any verification fails, the message is discarded and the sending node is penalized based on the GossipSub scoring system. If the score is below the threshold, the node will be removed from the network.

9. The scalable distributed identity authentication method based on blockchain anchoring and zero-knowledge proof according to claim 1, characterized in that, In step S4: The direct tunnel is established based on Iroh's QUIC protocol, supports multiplexed streaming and built-in NAT traversal, and supports 0-RTT handshake to achieve low-latency data transmission.

10. A scalable distributed identity authentication system based on blockchain anchoring and zero-knowledge proofs, characterized in that: Includes the following modules: The identity creation module is used to generate key pairs and construct DID documents, publish the DID documents to IPFS to obtain CIDs, and encrypt the P2P network address and write it into the DID documents. The authentication module is used to send random challenges and generate proofs based on zero-knowledge proof circuits, completing stateless verification locally; The authentication broadcast module is used to encapsulate messages into authentication envelopes and perform multi-stage verification. If the verification fails, the message is discarded; if the verification succeeds, it is broadcast in the GossipSub network. The secure communication module is used to exchange decrypted network addresses and establish point-to-point direct tunnels based on the QUIC protocol for communication.

Images