An artwork right confirmation signature method and system based on an AOE protocol and a TEE

Abstract

The application discloses an artwork right confirmation signature method and system based on an AOE protocol and a TEE, belongs to the cross field of TEE trusted execution, national secret cryptography and block chain storage evidence, and aims at solving the problems of easy tampering of authorization, signature and work unbinding, evidence fragmentation and insufficient judicial effect of an existing right confirmation scheme. The application constructs a right confirmation closed loop based on AOE three fixed axioms (P<=>A and O and E), completes creator identity and protocol hash solidification, generates an authorized package with an increasing time stamp by relying on a TEE and chains the authorized package, extracts physical micro-entropy of an artwork by using microscopic texture in a field to generate a unique physical evidence hash Ho, sets the Ho as a first field of a message, and after double-layer verification of a TEE living body and authorization, uses a hardware isolated private key to complete national secret signature and encrypts all data for storage evidence. The application realizes strong binding of subject, work and evidence cryptography, prevents counterfeiting record and authorization counter-signing tampering, and is suitable for right confirmation of entity artworks such as calligraphy and painting, ceramics, purple sand and the like with exclusive microscopic texture.

Description

Technical Field

[0001] This invention relates to the cross-technical fields of hardware trusted execution environment, national cryptographic standards, blockchain distributed evidence storage, adjustable-rate microscopic evidence feature recognition, and digital trusted ownership confirmation of physical artworks. Specifically, it relates to physical micro-entropy feature extraction and hardware trusted execution environment collaborative ownership confirmation, hardware permission management technology based on multi-factor necessary and sufficient logic control, and especially to an artwork ownership confirmation signature method, system, and computer-readable storage medium based on AOE protocol and TEE.

[0002] This invention is primarily applied to the digital ownership registration and authenticity verification of original paintings, calligraphy, and calligraphy works. It can also be adapted to physical artworks such as ceramics, jade, wood carvings, lacquerware, stone carvings, purple clay teapots, and sculptures, which possess unique and difficult-to-replicate microscopic physical textures, as well as high-end collectibles, luxury goods, and officially limited-edition physical products with unique textures. For products that do not inherently possess significant microscopic textures, they can be incorporated into the ownership verification system of this invention by embedding indivisible identifiable elements with physical micro-entropy characteristics (such as random particle distribution layers, micro-nano texture patches, etc.) during the product design or manufacturing stage. This invention belongs to a hardware-level trusted ownership verification technology solution for physical assets that can be reused across product categories. Background Technology

[0003] With the rapid development of digital cultural heritage, art finance, and the digitalization of intangible cultural heritage, the demand for digital ownership verification, end-to-end traceability, and highly reliable evidence preservation for high-value physical artworks and collectibles continues to surge. Physical artworks possess unique characteristics, their microstructure is difficult to replicate, and the subject and object are strongly bound together. However, existing digital evidence preservation, electronic signatures, and blockchain authentication solutions still have the following technical shortcomings when addressing the special security requirements for ownership verification of physical artworks.

[0004] Existing TEE biometric signature verification schemes only verify the creator's identity. The signature message is only associated with auxiliary information such as device ID, business transaction records, and ordinary work images. It does not take the naturally existing physical micro-entropy (i.e., the high-dimensional disordered information of micro-texture in spatial topology) as the core signature field. It can only verify the operator's real identity, but cannot lock the uniqueness of the corresponding work. It is very easy to have problems such as genuine person but fake object, counterfeit registration, work replacement and repudiation, and forged signatures that lead to the failure of the verification.

[0005] Meanwhile, traditional art licensing mechanisms lack hardware-level time constraints. Licensing agreements, identity records, and evidence data are simply stored on the blockchain without structured hash encapsulation, incremental time-series timestamp verification, or TEE hardware fingerprint binding anti-tampering mechanisms. Licensing records can be added afterward, and the validity period and agreement version can be altered. This results in evidentiary flaws where the signature is valid in form but the authorization is invalid in substance, leading to weak judicial acceptance.

[0006] Furthermore, in existing technologies, creator authorization records, physical evidence data of works, and blockchain signature data are fragmented, relying solely on business logic for connection without any underlying cryptographic binding. This results in severe data fragmentation, requiring the retrieval of multiple independent documents for judicial evidence, failing to form a closed-loop, credible evidentiary unit, and leading to extremely low efficiency and credibility of evidence. Existing micro-level physical evidence technologies can only achieve a unique identifier for the artwork object, lacking trusted authorization from the subject, hardware-level secure signatures, temporal tamper-proofing, and strong binding capabilities between subject and object, thus failing to form a complete closed loop for confirming ownership.

[0007] Existing technologies lack a hardware-level logical control mechanism that can dynamically determine whether to release digital signature permissions based on the status of physical evidence. They cannot couple the physical uniqueness of physical artworks, the subject's authorization status, and the integrity of process evidence into a unified hardware authentication condition. This results in loose logic for controlling the confirmation of rights and signature permissions, a single constraint condition, and difficulty in avoiding the risk of decoupling physical objects from digital signatures. There are obvious shortcomings in technology adaptability and security. Summary of the Invention

[0008] This invention aims to address the underlying defects of existing technologies for confirming ownership of physical artworks, such as the tampering of subject authorization, the unbinding of signatures from works, the compliant filing of counterfeits, the backdating and supplementation of authorizations, the lack of a closed-loop evidence chain, and insufficient judicial validity. It provides an artwork ownership confirmation and signature method, system, and computer-readable storage medium based on a TEE pre-authorization chain and mandatory binding of physical evidence hashes, achieving hardware-level trusted subject authorization, strong cryptographic binding between subject and object, end-to-end tamper-proofing, and highly reliable closed-loop evidence storage. Technical solution

[0009] To achieve the above objectives, the first aspect of this invention provides a blockchain-based method for pre-authorization and solidification of artwork creation. This invention differs from existing single and fragmented identity verification and evidence storage methods. Its core innovation lies not in the stacking of individual technologies at each step, but in constructing an integrated pre-authorization and solidification architecture that incorporates temporal constraints, hardware binding, and multi-dimensional data structured coupling. This dedicated architecture addresses industry pain points such as the tampering, backdating, and subsequent recording of authorizations. The method includes the following steps: S101. Main Identity Data Hash Collection and Verification: Collect the creator's legal identity information and hash it to generate a biometric verification hash through dynamic liveness verification in the cloud. For scenarios where the stage name and real name are inconsistent, initiate manual qualification review, and uniformly hash and archive the review materials, conclusions, and times to generate a standardized archive hash for the stage name. During the stage name review process, the human only performs the entry operation of qualification materials. The review conclusions, times, and original materials are all hashed and solidified on the blockchain, eliminating the risk of human tampering and traceability disruption from the process design level. S102, Solidification of the Confirmation Agreement Version: Obtain the full text of the effective confirmation service agreement, calculate the unique hash value of the agreement, associate the original text of the agreement with the hash of the on-chain transaction, and solidify the agreement version; S103, TEE Hardware Key Initialization and Authorization Configuration: Generate hardware-level asymmetric key pairs in the terminal TEE trusted isolation environment, extract the unique TEE public key fingerprint, and configure the authorization validity time window corresponding to the authorization service. S104, Structured Encapsulation and Hardware Signature of Authorized Data Packets: Encapsulate identity hash, biometric verification hash, stage name archive hash, protocol hash, TEE public key fingerprint, and authorization validity window parameters into a standardized authorized evidence storage package, and sign the entire data packet using the TEE's built-in private key; S105, Dual Incremental Time Sequence Timestamp Embedding: The identity verification timestamp and the authorization package generation timestamp are generated sequentially. The two sets of timestamps are arranged in a unidirectional increment according to the business process time sequence, forming a rigid time sequence constraint that can be automatically recognized and verified by the machine. Among them, the protocol on-chain timestamp serves as a historical fixed anchor point and is pre-stored in the authorization evidence package to verify that the protocol effective time is earlier than the current authorization behavior. S106, Global Hash Uploading and Solidification of Authorization Package: Perform a global hash operation on the complete authorization data package carrying the time sequence timestamp and TEE hardware signature, and upload the final hash value to the blockchain distributed node for permanent solidification.

[0010] The second aspect of this invention provides a method for art ownership confirmation and signature based on TEE and a pre-authorization chain. This method takes the aforementioned pre-authorization solidification method as its sole foundation and necessary prerequisite, and both belong to the same overall inventive concept. Through deep coupling of the pre-authorization time-series solidification architecture and the online two-layer verification and physical evidence hash forced binding architecture, a complete closed-loop ownership confirmation system is formed, including the following steps: S201, On-chain Authorization Certificate Parsing: Retrieve the creator authorization certificate package solidified on the blockchain, verify the signature of the built-in TEE hardware signature, and extract the authorization validity window, protocol hash, and TEE public key fingerprint verification parameters. S202, Dynamic Liveness Trust Verification: The terminal outputs multi-dimensional interactive commands to complete dynamic liveness verification, intercepting inputs such as static images, 3D masks, and AI-forged faces. After successful matching, a TEE liveness session credential with a time-limited mark is generated. S203. Generation of unique physical evidence hash of artwork: The microscopic texture image of the artwork is acquired by a microscope with adjustable magnification, and its physical micro-entropy is extracted. That is, the inherent disordered information and feature distribution density of the micro-texture in terms of spatial distribution, gradient change and topological connection relationship. The 'physical micro-entropy' referred to in this invention specifically refers to the microscopic structural features with spatial topological disorder and high information entropy generated by random physical processes inside the material (such as fiber deposition, fluid infiltration, phase change crystallization, etc.) during the manufacturing or forming process of physical artwork. The formation of this physical micro-entropy is the result of irreversible entropy increase during the material forming process. Its high-dimensional disordered state cannot be reversed or precisely controlled by any deterministic, low-entropy macroscopic manufacturing technology (including but not limited to micro-nano processing, nanoscale 3D printing, and quantum manipulation technology). This unreplicability is constrained by the second law of thermodynamics. The SIFT / ORB algorithm is used to extract no less than 3 sets of independent texture feature parameters, which are then spliced ​​together and generated into a unique physical evidence hash Ho by the national cryptographic SM3 hash operation. The microscopic topological structure constructed by this invention has spatial non-commutability. In essence, it is a digital extraction and solidification of the physical micro-entropy of the artwork. It takes the relative spatial position of feature points, gradient correlation, and connection constraint relationship as the core, without relying on the traditional two-dimensional pixel arrangement. Changes in the physical structure of the artwork, local texture tampering, and spatial relationship shifts will all lead to irreversible changes in Ho, which manifests as the structural destruction of physical micro-entropy and hash value divergence, achieving high-precision and irreversible binding of the physical features of the object. S204, AOE Logic Protocol Joint Judgment Steps: Within the TEE trusted security domain, a judgment execution module following the AOE trusted ownership confirmation logic protocol is configured and runs. This module is configured to respond to the ownership confirmation signature trigger command, receiving three types of input signals: subject trust verification result, object evidence verification result, and process evidence integrity verification result. It then performs hardware-level joint judgment based on the necessary and sufficient logical relationship P <=> A∧O∧E. Specifically, the protocol first obtains on-chain authorization certificate data, verifies whether the current operation time is within the authorized valid time window, and whether the local protocol hash is consistent with the on-chain fixed protocol hash, completing the subject trust A factor verification; secondly, it reads the TEE liveness session certificate validity data and the topological consistency comparison data of the artwork's micro-topological feature summary Ho, completing the object uniqueness O factor verification; finally, it verifies the unidirectional increment of the entire process time-series timestamp and the integrity of the ownership confirmation data encapsulation, completing the evidence integrity E factor verification. The AOE trusted authorization logic protocol outputs a signature permission unlocking control signal and sends a hardware private key call instruction to the TEE trusted execution environment only when the verification results of the three factors A, O, and E simultaneously meet the preset trusted conditions. If any factor verification fails, the protocol immediately outputs a permission blocking signal, directly terminating the current authorization signature process and prohibiting the TEE hardware private key call and signature behavior execution, thereby realizing hardware-level dynamic permission control constrained by physical evidence, subject authorization, and process evidence. S205, Core Message Structure Construction: Define a fixed-structure signature message M, set the physical evidence hash Field_Ho as the first field of the message and a core required field, and then concatenate a trusted timestamp and a single random number; the system pre-checks whether Field_Ho is empty, missing or has an abnormal format, and if it is abnormal, the operation is terminated. After the verification is passed, the SM3 hash digest operation is performed. S206, TEE Hardware Isolation Signature: Call the TEE's built-in non-exportable hardware private key, perform SM2 asymmetric signature operation on the message hash digest, and generate a hardware isolation ownership confirmation signature value. S207, Full Data Encryption and On-Chain: Symmetric encryption of hardware signature value, structured message, physical evidence hash Ho, global hash of authorized storage package, and TEE live session certificate, uploaded to the blockchain for permanent solidification, forming a complete data link for confirming rights.

[0011] The third aspect of this invention provides an artwork ownership confirmation and signature system for implementing the aforementioned ownership confirmation and signature method, including a pre-authorization and solidification module, a liveness verification module, an evidence hash generation module, an AOE trusted ownership confirmation protocol execution module, a TEE two-layer verification module, a message construction module, a hardware signature module, and a blockchain evidence storage module.

[0012] The AOE trusted authorization logic protocol is a dedicated hardware logic control module of this invention, which is permanently deployed within the TEE trusted security domain. It is configured to operate based on the P<=>A∧O∧E multi-factor necessary and sufficient logic model. It is used to receive hardware input signals from three verification dimensions: subject trust (A), object uniqueness (O), and evidence integrity (E), and to perform centralized joint logic judgment. The protocol is configured to output a signature permission unlocking command and release a signature permission control signal to the TEE trusted execution environment only when all three factors simultaneously meet the preset trust conditions. If any factor verification is abnormal, a permission blocking command is output, and the signature process is terminated in real time. This transforms the abstract necessary and sufficient logic into a fixed control logic that can be executed by hardware, verified by machines, and controlled by permissions.

[0013] The pre-authorization and solidification module collects subject identity data, biometric verification data, protocol version data, and TEE hardware parameters, completing structured encapsulation, hardware signature, and time-series anchor solidification to generate a machine-verifiable on-chain authorization and evidence storage package. The liveness verification module performs dynamic liveness anti-counterfeiting verification, intercepting various forged inputs and generating a TEE liveness session credential with time constraints. The physical evidence hash generation module collects the micro-topological features of the artwork, constructs a feature structure with spatial non-commutativity, and combines it with national cryptographic algorithms to generate a unique physical evidence feature digest Ho bound to the physical artwork. The TEE dual... The layer verification module works with the AOE logic control module to complete multi-level joint hardware verification of authorization legality, liveness validity, physical evidence topology consistency, and temporal integrity, and manages the release of signature permissions; the message construction module is used to construct standardized signature messages with the physical evidence hash Ho as the core mandatory first field, and complete pre-anomaly detection; the hardware signature module is used to call the non-exportable hardware private key inside the TEE after permission is unlocked to complete hardware-isolated national cryptographic signature operations; the blockchain evidence storage module is used to perform distributed permanent solidification and evidence storage of the encrypted data for full-link rights confirmation, forming a closed-loop trusted evidence chain.

[0014] A fourth aspect of this invention provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of any of the aforementioned methods. This invention constructs a complete and highly reliable closed-loop rights confirmation logic based on the AOE three-dimensional fidelity-preserving necessary and sufficient logic model, providing core theoretical support for end-to-end hardware and software collaborative rights confirmation and verification. This invention defines P (Provenance & Authenticity) as the authenticity and validity of the artwork's ownership confirmation result. The ownership confirmation result P is valid if and only if three core conditions are simultaneously met, and none can be missing. The logical relationship satisfies the formula: P<=>A∧O∧E; where: A (Artist Attestation) is the identification of the person—ensuring that the ownership confirmation act is initiated by the legitimate creator, cannot be impersonated, and cannot be denied; O (Object Identification) is the identification of the object—relying on the unique microscopic physical texture of the artwork to lock in the uniqueness of the artwork object, achieving one object, one source, and difficult to replicate or replace; E (Evidence Certification) is the evidence—solidifying and storing the entire process behavior data, time-series data, and cryptographic hash data to form a highly reliable data unit with complete time sequence, closed-loop link, verifiability, and traceability.

[0015] This invention constructs a closed-loop art ownership confirmation control logic by hardware-level coupling and linkage of A (person), O (object), and E (evidence), solving the technical defects of existing technologies such as single-dimensional verification, loose data association, and lack of hardware constraints on permissions. This invention configures a hardware judgment execution unit (i.e., the AOE protocol execution module) that follows the AOE trusted ownership confirmation logic protocol as the core decision-making hardware unit. It uses the microscopic physical evidence hash Ho of the artwork as the core physical input signal to participate in the logical judgment, mapping the physical state of the object to the hardware control conditions of digital signature permissions. This differs from conventional technologies that only use the evidence hash as a passive signature field, achieving a hardware-level technical architecture that actively controls digital signature permissions based on the physical state of the entity. Beneficial effects

[0016] Achieving a strong cryptographic binding between subject and object: Based on the uniqueness and unreplicability of the physical micro-entropy of artworks, the physical evidence hash is forcibly embedded as a core required field in the signature message, binding the creator and the unique work from the cryptographic level... Physical micro-entropy comes from the random physical processes in the material forming process (such as fiber distribution, bubble generation, crystal growth), and no human imitation can reproduce the same entropy value distribution, fundamentally eliminating the risk of counterfeit registration and replacement.

[0017] Effectively suppresses the risks of authorization tampering and backdating: Through double incremental time-series timestamps, full-field hash encapsulation, and TEE hardware fingerprint binding, the authorization data, time sequence, and version are made immutable and traceable throughout the entire process, supporting automatic machine verification and eliminating flaws in judicial evidence.

[0018] Enhance the security level of rights confirmation: Through a two-layer hardware verification structure of TEE liveness verification + on-chain authorization legality, combined with the multi-factor necessary and sufficient linkage judgment mechanism of the AOE trusted rights confirmation logic protocol, it is configured to accurately intercept abnormal scenarios such as authorization expiration, protocol mismatch, non-personal operation, physical topology abnormality, and missing process evidence, effectively improving the non-repudiation of rights confirmation signature and hardware security level.

[0019] Constructing integrated, highly reliable data units: end-to-end data ownership confirmation is hash-linked and chain-based, eliminating the need for fragmented retrieval of credentials, forming highly reliable data units with complete source proof, integrity verification, and time traceability, significantly reducing data verification and evidence collection costs.

[0020] Compatible with all types of artworks: The core technology does not depend on the material of the artwork and can be equally adapted to all physical artworks with unique microscopic physical structures and high-end cultural and creative collectibles, with a wide range of application scenarios.

[0021] Adaptable to complex terminal scenarios: It adopts a two-stage architecture of offline pre-authorization + online real-time signing to reduce the computing power pressure of on-site rights confirmation and adapt to outdoor weak network and low computing power mobile terminal scenarios.

[0022] Strong algorithm compatibility: The core architecture is compatible with national cryptographic algorithms and internationally used encryption algorithms, adapts to various TEE terminals, and has a wide range of patent protection. Attached Figure Description

[0023] Figure 1 The overall two-stage flowchart of this invention illustrates the entire chain of offline authorization initialization, online authorization signing, and integrated verification, highlighting the dual-layer verification, binding of physical evidence hash messages to core nodes, and failure termination logic.

[0024] Figure 2 The diagram illustrates the isolated interaction between TEE and a regular operating system, showing that core identity data, private keys, and authorization data packets flow in a closed loop within the TEE security domain, eliminating the risk of external theft or Hook tampering.

[0025] Figure 3 The diagram illustrates the structure of the message to be signed, clearly defining the core mandatory position of the physical evidence hash Ho and defining the hierarchical relationship and binding logic of each field in the message.

[0026] Figure 4 This is a schematic diagram of the A-factor multi-channel adaptive authentication architecture of the present invention, showing the connection relationship between the five authentication sources and the AOE protocol and the unified verification constraint process. Detailed Implementation

[0027] Example 1: Confirmation of Rights for Calligraphy and Painting Works Using traditional Chinese paintings and calligraphy works as the core medium, the process involves offline completion of creator identity hashing, liveness verification hashing, protocol hashing encapsulation, and TEE pre-authorization on-chain solidification. During on-site rights confirmation, a variable magnification microscope is used to collect natural physical micro-entropy information such as the fibers of the Xuan paper and the texture of pigment deposition in the paintings and calligraphy, extracting multiple sets of feature parameters to calculate a unique physical evidence hash Ho. The A, O, and E factors are jointly verified using the AOE logic protocol within the TEE hardware domain. Upon successful verification, a structured message centered on Ho is constructed, and a national cryptographic signature is completed using the TEE hardware private key. All rights confirmation data is then encrypted and stored on the blockchain. During authenticity verification, the microscopic features of the artwork are re-collected for hash comparison, combined with signature verification and authorization verification to complete integrated authenticity verification, achieving reliable rights confirmation for paintings and calligraphy works across the entire chain.

[0028] Example 2: Equivalent Confirmation of Rights for Multiple Categories of Artworks Without altering the core technical architecture, this invention is adapted to the authentication of multiple categories of physical artworks: it collects unique microscopic features such as bubbles and textures on ceramic glazes, crystals and cotton-like patterns in jade, and conduits and polishing marks in wood carvings, generating corresponding physical evidence hashes Ho. Ho is then forcibly embedded into the core fields of the signature message. Combined with a pre-authorization chain solidification, AOE three-factor necessary and sufficient logic verification, and TEE two-layer verification mechanism, hardware-level reliable authentication of various artworks is achieved. The technical effect is completely consistent with the calligraphy and painting scenario. The physical evidence hashes Ho of each category of artworks are digital mappings of their physical micro-entropy, proving that this invention has cross-material physical entropy source universality.

[0029] Example 3: Multi-cryptography Algorithm Compatible Replacement Example While retaining the core architecture of this invention, the SM3 hash algorithm is equivalently replaced with SHA-256 or SHA-512, and the SM2 signature algorithm is equivalently replaced with common algorithms such as ECDSA and EdDSA. The system is still configured to retain the core hardware logic of mandatory binding of physical evidence hash, TEE double-layer verification, pre-authorization time sequence fixing, and necessary and sufficient determination of the AOE trusted rights confirmation logic protocol. This can stably achieve the technical effects of strong binding of subject and object, anti-tampering, and anti-repudiation, proving that the core innovation of this invention is the coupled design of hardware architecture and control logic, rather than the limited application of a single algorithm. Furthermore, this invention adopts national cryptographic algorithms, adapting to domestic compliance requirements. The underlying security logic and technical effects of national cryptographic algorithms are equivalent to internationally common algorithms, and the algorithm selection does not affect the protection scope of the core technical solution of this invention.

[0030] Example 4: Multi-channel A-factor adaptive subject rights confirmation example This invention is based on the AOE three-dimensional fidelity-guaranteed necessary and sufficient logic model (P<=>A∧O∧E) to solidify hardware control logic. It configures five adaptively switchable subject authentication channels. Valid identity credentials output from each authentication channel are transmitted as A-factor input signals to the AOE trusted rights confirmation logic protocol. The protocol uniformly completes standardized verification and judgment according to the necessary and sufficient logic rules, achieving hardware-level linkage and adaptation between multi-channel subject authentication and physical rights confirmation and evidence verification, improving system scenario adaptability and verification stability. The five authentication channels can be adaptively activated according to terminal hardware capabilities, network environment, and compliance level requirements: 1. Commercial biometrics + TEE embedded CA universal channel, adapted to conventional mobile rights confirmation scenarios; 2. National network identity authentication legal credibility channel, adapted to high-compliance scenarios such as museum collections and intangible cultural heritage; 3. eID / SE hardware trust root channel, adapted to high-value cultural relics and rare items high-level rights confirmation scenarios; 4. Bank four-factor verification financial soft signature channel, adapted to hardware-restricted terminal batch rights confirmation scenarios; 5. Operator real-name + super SIM card integrated inclusive channel, adapted to mass-market, low-cost rights confirmation scenarios.

[0031] Example 5: Long-term upgrade example of the national eID global trust root This embodiment is an architecture iteration and adaptation solution, configured to eliminate reliance on third-party commercial CAs and use the National Network Identity Authentication Public Service Platform as the sole trust anchor. It completes legal identity authentication based on the resident ID card SE chip, terminal SE, and SIMeID hardware identifier, using legal network identity data as a standard A-factor input signal to access the AOE trusted rights confirmation logic protocol. The protocol embeds legal identity verification logic, matching the necessary and sufficient judgment rules of O-factor physical evidence topology verification and E-factor procedural evidence verification, achieving a three-in-one hardware-level locking rights confirmation. This is adaptable to advanced compliance rights confirmation scenarios after the widespread adoption of legal digital identities in the future.

[0032] Example 6: Normalization Processing of Multi-Source Identity Authentication Data This invention's system is equipped with an identity data standardization preprocessing module, used to normalize multi-source identity authentication data of different types and formats. It converts heterogeneous data such as biometric vectors, legal network numbers, and hardware serial numbers into a unified standard binary data stream, and then generates a unified format identity hash through hash operations, serving as the standardized A-factor input signal for the AOE trusted confirmation logic protocol. This configuration decouples the authentication medium from the verification logic, enabling the AOE necessary and sufficient control logic to adapt to multiple subject authentication scenarios, thus improving the system's versatility.

[0033] Example 7: TEE encapsulation of third-party identity verification results and joint evidence collection mechanism In this embodiment, the verification result output by the third-party identity authentication platform is received by the terminal business layer, standardized and encapsulated into trusted credential data, and transmitted to the TEE security domain. The TEE performs encryption encapsulation and integrity signing, generating a standardized A-factor input signal that can be solidified and verified. This signal is then transmitted to the AOE trusted rights confirmation logic protocol for joint judgment. The TEE hardware signature ensures the integrity and immutability of the transmission and storage of the third-party verification result. During the evidence verification or dispute resolution stage, multi-source cross-verification can be completed by combining third-party verification logs, TLS verification records, and TEE hardware signatures to form a complete and trusted evidence chain. Simultaneously, the system is compatible with third-party verifiable credential access for offline verification independent of the third-party service terminal, improving the long-term verifiability of the evidence chain. System Hardware Deployment Architecture Description

[0034] Each functional module of the rights confirmation system of this invention corresponds to a clearly defined hardware operating platform and a fixed execution logic, forming a hardware-software co-architecture. The functions and deployment forms of each module are as follows: 1. Pre-authorization and solidification module: Deployed in the terminal TEE security domain and blockchain node client, used to complete the structured encapsulation of main data, protocol data, and hardware parameters, hardware signature, and time-series solidification, generating on-chain authorization certificates that can be verified by machines; 2. Liveness verification module: Relying on the terminal biometric hardware and TEE verification algorithm, used to intercept forgery operations and generate TEE liveness session certificates with time constraints; 3. Physical evidence hash generation module: Connected to adjustable magnification microscopic acquisition hardware, used to collect the microscopic topological features of artworks, generating a unique physical evidence feature summary Ho bound to the physical work, as the core physical input of the O factor. 4. AOE Trusted Authorization Logic Protocol: This protocol is embedded as a trusted TEE application, running in a hardware-isolated security domain. It receives A, O, and E input signals, performs necessary and sufficient logic joint judgment, and outputs access control signals. 5. TEE Dual-Layer Verification Module: Running in the TEE security domain, this module works with the protocol to perform hardware-level verification of authorization validity, credential integrity, and topology consistency. 6. Message Construction Module: Running in the terminal security service layer, this module constructs standardized signature messages with Ho as the core mandatory field and performs anomaly detection. 7. Hardware Signature Module: This module calls the TEE's built-in hardware key and the national cryptographic coprocessor to perform isolated hardware signatures. 8. Blockchain Evidence Storage Module: This module connects to distributed blockchain nodes for encrypted uploading and permanent evidence storage of all authorized data. These modules work together to form a hardware-controlled authorized signature architecture.

Claims

1. A method for pre-authorization and solidification of artwork creation, based on TEE pre-authorization and physical evidence hash binding, characterized in that, Includes the following steps: S101. Collect the creator's legal identity information and perform hash encryption, and generate a biometric verification hash by combining the cloud dynamic liveness verification results; for scenarios where the stage name and real name are inconsistent, perform unified hash archiving of qualification review materials, review conclusions and review time, and generate a standardized archive hash for the stage name. S102. Obtain the full text of the effective confirmation of rights service agreement, calculate the unique agreement hash value as the version identifier, upload the full text of the agreement and the corresponding version identifier to the blockchain for notarization, associate the corresponding on-chain transaction hash and establish a local agreement version index to complete the solidification of the agreement version. S103. Generate a hardware-level asymmetric key pair in the terminal TEE trusted isolation environment, extract the terminal's unique TEE public key fingerprint, and configure the authorization validity time window corresponding to the confirmation service. S104. Unify the identity hash, biometric verification hash, stage name archive hash, protocol hash, TEE public key fingerprint and authorization validity parameters into a standardized authorization storage package, and perform overall hardware signing on the authorization storage package through the TEE built-in private key. S105. Generate identity verification timestamp and authorization package generation timestamp in sequence. The two sets of timestamps are arranged in a unidirectional increasing order according to the business time sequence to form a time sequence constraint relationship that can be automatically verified by the machine. This serves as the time sequence verification benchmark for the E factor (evidence integrity) and is input into the joint judgment process of the subsequent AOE protocol. S106. Perform a global hash operation on the complete authorization data packet carrying the time sequence timestamp and TEE hardware signature, upload the final hash value to the blockchain for permanent solidification, and complete the offline solidification of the creator's pre-authorization chain. The authorized evidence package contains joint verification benchmark parameters required for the subsequent authorization and signature stage, which are used as the basis for authorization determination in the TEE internal protocol.

2. A method for confirming ownership of an artwork through signature, based on TEE pre-authorization and binding of physical evidence hash, characterized in that, The pre-authorization solidification method according to claim 1 is executed, including the following steps: S201. Retrieve the creator authorization certificate package solidified on the blockchain, verify the TEE hardware signature built into the authorization certificate package, and extract verification parameters such as authorization validity window, protocol hash, and TEE public key fingerprint after the verification is successful. S202. Perform dynamic liveness verification on the terminal to intercept illegal inputs such as static images, 3D masks, and AI face forgery. After successful liveness verification, generate a TEE liveness session credential with a time expiration mark. S203. Collect images of the microscopic physical structure of the artwork using a microscopic acquisition device, extract its physical micro-entropy features, namely the inherent disorder information of the micro-texture in spatial distribution, gradient change and topological connection relationship, obtain multiple sets of micro-texture feature parameters and complete feature splicing, and generate a unique corresponding physical evidence hash Ho through hash operation. S204. A judgment execution unit, which is solidified as a trusted application and follows the AOE trusted authorization logic protocol, runs within the TEE trusted security domain. Responding to the authorization signature trigger command, the judgment execution unit receives three types of input data: subject trusted verification result, object physical evidence verification result, and process evidence integrity verification result. It performs hardware-level joint judgment based on the necessary and sufficient logic of P<=>A∧O∧E. The A factor verification includes on-chain authorization timeliness window verification and protocol hash consistency comparison; the O factor verification includes topological consistency comparison between the physical evidence hash Ho and the on-chain baseline hash; the E factor verification includes unidirectional increment verification of the dual time-series timestamps and data encapsulation integrity verification. Only when all three factors (A, O, and E) meet the preset trusted conditions is a signature permission unlock signal output; if any factor verification fails, a permission blocking signal is output, prohibiting the use of the TEE internal signature private key. S205. In response to the permission unlock signal, construct a fixed structured signature message, set the Field_Ho field corresponding to the physical evidence hash as the first core required field of the message, and then concatenate the trusted timestamp and the single random number segment in sequence; complete the message field anomaly detection, and perform SM3 hash digest operation on the complete message if the fields are legal and complete. S206. Call the hardware private key built into the TEE security domain, which cannot be read or exported by the external operating system, and perform SM2 asymmetric signature operation on the message hash digest to generate a hardware-isolated authorization signature value. S207. Symmetrically encrypted encapsulate the hardware signature value, structured signature message, physical evidence hash Ho, authorized global hash, and TEE live session certificate, and upload the encrypted data packet to the blockchain for permanent solidification, forming a closed loop of ownership confirmation data that strongly binds the subject and the object.

3. The method according to claim 2, characterized in that: The micro-texture features include the fiber arrangement of calligraphy and painting, pigment deposition morphology, bubbles on ceramic glaze, crystal structure of jade, duct traces in wood carving, polishing texture of lacquerware, and mineral crystallization in stone carving; the method is applicable to all scenarios involving the authentication of physical artworks, luxury goods, collectibles, and official limited editions that possess unique and difficult-to-replicate micro-physical structures.

4. The method according to claim 2, characterized in that: The hash operation adopts any one of SM3, SHA-256, and SHA-512, and the asymmetric signature operation adopts any one of SM2, ECDSA, and EdDSA. Under the premise of equivalent algorithm replacement, the system still retains the binding logic of physical evidence hash Ho as the core mandatory field of the signature message, TEE hardware isolated signature, pre-authorization timing solidification, and AOE protocol necessary and sufficient joint determination core architecture.

5. The method according to claim 2, characterized in that: The entity identity authentication is configured with multiple adaptive verification channels. After standardization and normalization, the output data of each channel is uniformly used as the A factor input signal to access the AOE trusted confirmation logic protocol's judgment and execution unit inside the TEE. The execution unit operates based on the P<=>A∧O∧E multi-factor necessary and sufficient logic. The signature permission can only be unlocked when the three factors A, O, and E are verified to be compliant at the same time, effectively avoiding the confirmation vulnerability caused by a single verification channel.

6. The method according to claim 2, characterized in that: The method is adaptable to the national eID global trust root architecture, and can be compatible with or replace third-party commercial authentication mechanisms. It uses the legal network identity as the unique identifier of the subject, and realizes three-dimensional logical constraints based on legal identity and hardware-level locking and confirmation of rights through the three-dimensional logical constraints of subject, object and evidence.

7. A system for confirming ownership and signing artworks, characterized in that, To implement the method according to any one of claims 1-6, comprising: The pre-authorization solidification module is used to complete the offline solidification and on-chain storage of the main identity hash, protocol version, TEE key and authorization package; The liveness verification module is used for dynamic liveness verification and generating time-sensitive TEE liveness session credentials; The physical evidence hash generation module is used to collect microscopic texture features of artworks and generate unique physical evidence hash Ho; The TEE dual-layer verification module is configured to verify the authorized evidence storage package, TEE liveness session certificate and physical evidence hash Ho, and is used to provide the AOE trusted rights confirmation protocol execution module with the joint hardware verification results of authorization, liveness, physical evidence and time sequence data. The message construction module is used to construct structured signature messages with physical evidence hash as the core required field and to perform anomaly detection; The hardware signature module is connected to the AOE trusted rights confirmation protocol execution module and the TEE trusted execution environment respectively. It is configured to respond to the unlock signal output by the AOE trusted rights confirmation protocol execution module and call the TEE built-in private key to complete the hardware isolated signature. The blockchain evidence storage module is used for the encrypted uploading and permanent solidification of all ownership confirmation data on the blockchain. The AOE trusted rights confirmation protocol execution module is solidified as a TEE trusted application. It is used to receive A factor data from the pre-authorization solidification module, O factor data from the physical evidence hash generation module, and E factor data from the TEE two-layer verification module and the blockchain evidence storage module based on the P<=>A∧O∧E multi-factor necessary and sufficient logic, respectively, perform joint judgment and output signature permission control signal.

8. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by a processor, implements the steps of the method according to any one of claims 1-6.

Images