User identity verification method and apparatus

Abstract

Disclosed in embodiments of the present invention are a user identity verification method and apparatus, an electronic device, and a computer-readable medium. The method comprises: receiving a verifiable presentation generation instruction containing a content digest value; using a decentralized identity private key of a user to sign the content digest value to generate a credential signature; and sending the credential signature to a wallet application such that the wallet application generates a verifiable presentation on the basis of verifiable presentation content and the credential signature, and sending an identity verification request containing the verifiable presentation to a verification authority for verification. The operation of a user repeatedly submitting identity information is reduced, thereby enhancing user experience, lowering the risk of information leakage, and reducing the storage performance requirements of a security chip.

Description

User authentication methods and devices

[0001] This application claims priority to Chinese Patent Application No. 202411640187.1, filed on November 15, 2024, entitled “User Authentication Method and Apparatus”, the entire contents of which are incorporated herein by reference. Technical Field

[0002] This disclosure relates to the field of computer technology, and more particularly to a user authentication method, apparatus, electronic device, and computer-readable medium. Background Technology

[0003] In business processing scenarios, identity verification and Know Your Customer (KYC) are key steps to ensure the effectiveness and compliance of business transactions.

[0004] Currently, online identity verification offers a convenient user experience, allowing users to quickly complete identity verification through websites or mobile applications. This method is sufficient for everyday business scenarios, but its security strength is limited and may not meet the requirements of higher-risk transactions. Offline identity verification, such as visiting a bank counter in person, typically involves reviewing identity documents and facial recognition, ensuring the security, accuracy, and strength of identity verification. However, it requires users to spend additional time and resources visiting physical branches. Especially when users need to conduct business with multiple financial institutions, such as upgrading their wallets at different operating institutions (banks), they must repeat the in-person verification process at each institution. This not only increases the user's time cost but also reduces the overall efficiency of the service.

[0005] Furthermore, the independent nature of digital identity systems across different departments or institutions, lacking unified standards and specifications, forces users or entities to repeatedly submit and verify identity information in cross-scenario services, significantly reducing service efficiency and convenience. In addition, the potentially significant differences in technical architecture and data formats between different systems make the sharing and interoperability of digital identity information particularly difficult, hindering effective information exchange between departments or institutions. This not only increases the complexity of business processes but also restricts the overall advancement of digital services. Summary of the Invention

[0006] In view of this, a first aspect of the present disclosure provides a user authentication method, applied to a security chip installed in a requester's terminal, the requester's terminal also having a wallet application installed, the method comprising:

[0007] The wallet application sends a verifiable expression generation instruction, which includes a content digest value of a preset length generated by the wallet application based on the verifiable expression content. The verifiable expression content includes a verifiable credential and a user distributed identity identifier. The verifiable credential is stored outside the security chip. The verifiable credential includes a declaration part and a signature part generated by signing the declaration part using the issuing authority's distributed identity private key. The declaration part includes the credential content, the issuing authority's distributed identity identifier, and the user's distributed identity identifier.

[0008] The content digest value is signed using the user's distributed identity private key to generate a credential signature;

[0009] Send the credential signature to the wallet application so that the wallet application can generate a verifiable representation based on the verifiable representation content and the credential signature, and send an authentication request containing the verifiable representation to a verification authority for verification.

[0010] A second aspect of this disclosure also provides a user authentication method, applied to a wallet application within an applicant terminal, wherein the applicant terminal is further provided with a security chip, the method comprising:

[0011] Receive user authentication operation, obtain verifiable expression content, verifiable expression content includes verifiable credentials and user distributed identity identifier, verifiable credentials include a statement part and a signature part generated by signing the statement part using the issuing authority's distributed identity private key, the statement part includes credential content, issuing authority distributed identity identifier and user distributed identity identifier;

[0012] The summary is calculated based on the verifiable content to obtain a content summary value of a preset length.

[0013] Send a verifiable representation generation instruction to the security chip. The verifiable representation generation instruction includes a content digest value.

[0014] The system receives the credential signature sent by the security chip and generates a verifiable representation based on the verifiable representation content and the credential signature. The credential signature is generated by the security chip after signing the content digest value using the user's distributed identity private key.

[0015] Send an authentication request containing a verifiable expression to the verification authority so that the verification authority can verify the authentication request, generate and return the credential verification result to the wallet application.

[0016] A third aspect of this disclosure also provides a user authentication method, applied to an authentication authority, the method comprising:

[0017] The authentication request sent by the wallet application of the applicant terminal is obtained. The authentication request includes a verifiable expression generated by the wallet application. The verifiable expression includes the verifiable expression content and the credential signature. The credential signature is generated by the security chip of the applicant terminal after signing the content digest value. The content digest value is obtained by the wallet application by performing digest calculation based on the verifiable expression content. The verifiable expression content includes the verifiable credential and the user's distributed identity identifier.

[0018] Verify the authentication request and generate the credential verification result;

[0019] Send the credential verification result to the wallet application.

[0020] A fourth aspect of this disclosure also provides a user authentication device, applied to a security chip disposed within an applicant's terminal. The applicant's terminal also includes a wallet application. The device comprises an instruction receiving module, a credential signature generation module, and a credential signature sending module.

[0021] The instruction receiving module is configured to receive a verifiable expression generation instruction sent by the wallet application. The verifiable expression generation instruction includes a content digest value of a preset length generated by the wallet application based on the verifiable expression content. The verifiable expression content includes a verifiable credential and a user distributed identity identifier. The verifiable credential includes a declaration part and a signature part generated by signing the declaration part using the issuing authority's distributed identity private key. The declaration part includes the credential content, the issuing authority's distributed identity identifier, and the user's distributed identity identifier.

[0022] The credential signature generation module is configured to sign the content digest value using the user's distributed identity private key to generate a credential signature;

[0023] The credential signature sending module is configured to send credential signatures to the wallet application, so that the wallet application can generate a verifiable representation based on the verifiable representation content and the credential signature, and send an authentication request containing the verifiable representation to the verification authority for verification.

[0024] A fifth aspect of this disclosure also provides a user authentication device applied to an applicant terminal. The applicant terminal further includes a security chip. The device comprises a verifiable representation acquisition module, a content digest calculation module, an instruction sending module, a credential signature receiving module, and a verification request sending module.

[0025] The verifiable representation acquisition module is configured to receive user authentication operations and acquire verifiable representation content. Verifiable representation content includes locally stored verifiable credentials and user distributed identity identifier. Verifiable credentials include a declaration part and a signature part generated by signing the declaration part using the issuing authority's distributed identity private key. The declaration part includes credential content, issuing authority distributed identity identifier, and user distributed identity identifier.

[0026] The content summary calculation module is configured to perform summary calculation based on verifiable content and obtain a content summary value of a preset length.

[0027] The instruction sending module is configured to send a verifiable representation generation instruction to the security chip. The verifiable representation generation instruction includes a content digest value.

[0028] The credential signature receiving module is configured to receive credential signatures sent by the security chip, and generate a verifiable representation based on the verifiable representation content and the credential signature. The credential signature is generated by the security chip after signing the content digest value using the user's distributed identity private key.

[0029] The verification request sending module is configured to send an authentication request containing a verifiable expression to the verification authority, so that the verification authority can verify the authentication request, generate and return the credential verification result to the wallet application.

[0030] A sixth aspect of this disclosure also provides a user authentication device applied to an authentication agency. The device includes an authentication request acquisition module, an authentication module, and an authentication result sending module, wherein...

[0031] The authentication request acquisition module is configured to acquire authentication requests sent by the wallet application of the applicant terminal. The authentication request includes a verifiable representation generated by the wallet application. The verifiable representation includes the verifiable representation content and the credential signature. The credential signature is generated by the security chip of the applicant terminal after signing the content digest value. The content digest value is obtained by the wallet application by performing digest calculation based on the verifiable representation content. The verifiable representation content includes verifiable credentials and user distributed identity identifier.

[0032] The verification module is configured to verify authentication requests and generate credential verification results;

[0033] The verification result sending module is configured to send the credential verification result to the wallet application.

[0034] A seventh aspect of this disclosure provides an electronic device, including: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the methods provided in the embodiments of this disclosure.

[0035] An eighth aspect of this disclosure provides a computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the methods provided in the embodiments of this disclosure.

[0036] One embodiment of the above invention has the following advantages or beneficial effects:

[0037] In this embodiment, the verifiable credentials requested by the user are stored outside the security chip, reducing the storage performance requirements of the security chip. By pre-calculating the digest and then calling the security chip for signing, the efficiency of generating verifiable representations is improved, thus enhancing the user experience. In this embodiment, user verification is performed using distributed identity identifiers, enabling interoperability and mutual recognition of identity verification results across different systems. This reduces the need for users to repeatedly provide identity information and lowers the risk of user identity information leakage.

[0038] The further effects of the aforementioned unconventional alternative methods will be explained below in conjunction with specific implementation methods. Attached Figure Description

[0039] The accompanying drawings are provided to better understand this disclosure and do not constitute an undue limitation thereof. Wherein:

[0040] Figure 1 is a schematic diagram of the architecture of the network system running according to some embodiments of the present disclosure of the distributed identity activation method;

[0041] Figure 2 is a flowchart illustrating a distributed identity activation method according to some embodiments of this disclosure;

[0042] Figure 3 is a schematic diagram of the process by which an issuing authority generates verifiable credentials according to some embodiments of this disclosure;

[0043] Figure 4 is a schematic diagram of the process by which an issuing authority generates the signature portion of a verifiable credential according to other embodiments of this disclosure;

[0044] Figure 5 is a schematic diagram of the process of generating a user distributed identity public key certificate by a security chip according to some embodiments of this disclosure;

[0045] Figure 6 is a schematic diagram of the storage structure of verifiable credentials according to some embodiments of this disclosure;

[0046] Figure 7 is a flowchart illustrating a user authentication method according to some embodiments of the present disclosure;

[0047] Figure 8 is a schematic diagram of the process of generating a credential signature by a security chip according to some embodiments of the present disclosure;

[0048] Figure 9 is a schematic diagram of the process by which a verification authority verifies a credential signature according to some embodiments of this disclosure;

[0049] Figure 10 is a flowchart illustrating the process by which a verification agency verifies the signature portion of a verifiable credential according to some embodiments of this disclosure;

[0050] Figure 11 is a schematic diagram of the process by which a verification authority obtains the distributed identity public key of an issuing authority according to some embodiments of this disclosure;

[0051] Figure 12 is a flowchart illustrating the process by which a verification agency verifies the validity of a verifiable credential according to other embodiments of this disclosure;

[0052] Figure 13 is a schematic diagram of the functional architecture of a user authentication device according to some embodiments of the present disclosure;

[0053] Figure 14 is a schematic diagram of the functional architecture of a user authentication device according to some other embodiments of the present disclosure;

[0054] Figure 15 is a schematic diagram of the functional architecture of a user authentication device according to some other embodiments of the present disclosure;

[0055] Figure 16 is an exemplary system architecture diagram in which embodiments of this disclosure can be applied;

[0056] Figure 17 is a schematic diagram of the structure of a computer system suitable for implementing terminal devices or servers of the present disclosure. Detailed Implementation

[0057] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0058] First, the abbreviations and related terms involved in the embodiments of this disclosure are defined and explained.

[0059] "DID (Decentralized Identifiers)" refers to a distributed identity identifier, which is an identifier composed of strings to represent a digital identity. The DID is generated by the distributed identity chain based on the applicant's public key and other information. The distributed identity chain also stores the DID document corresponding to the DID, and the DID document stores the DID and the public key corresponding to the DID.

[0060] "VC (Verifiable Credential)" refers to a verifiable credential, typically a JSON string containing VC metadata, a declaration section, and a signature section. The VC metadata mainly includes information such as the issuer, issuance date, and type of declaration. The declaration section contains one or more specific descriptions about the entity. For example, if a VC is an ID card, the declaration section would contain the holder's name, gender, date of birth, ethnicity, address, and other personal information. The signature section is usually the issuer's digital signature, used to ensure the integrity and authenticity of the VC content, prevent tampering, and verify the issuer's identity.

[0061] A “VP (Verifiable Presentation)” is a verifiable representation associated with a user’s distributed identity. It consists of a verifiable proof document synthesized from one or more verifiable credentials (VCs) and digitally signed by the user.

[0062] In existing business processes, such as the digital wallet opening process, opening a wallet under different operating institutions requires repeatedly uploading ID documents and information to different operating institutions. This is cumbersome for users, and the need for users to upload identity information to different operating institutions multiple times can easily lead to the risk of identity information leakage. Furthermore, the identity authentication results of different operating institutions cannot be shared, which is not conducive to user risk control.

[0063] This disclosure provides a distributed identity activation method, which firstly digitizes various physical credentials of users and enables them to independently manage and authorize their own digital credentials; secondly, enables the integrated and portable application of user digital credentials, thereby improving the efficiency of user business processing and optimizing user experience; and thirdly, better protects the security of user privacy information.

[0064] This disclosed embodiment is based on distributed identity identification, which breaks down the current situation of independent identity authentication systems between different systems (e.g., between the certificate issuer and the verification authority), realizes identity commonality, and at the same time, by using the transmission of proof credentials, realizes the transmission of verification results between different systems, thereby improving the efficiency of business processing.

[0065] Figure 1 shows a network system 100 in this embodiment of the present disclosure. The distributed identity activation method in this embodiment of the present disclosure can be run in the network system 100. The network system 100 includes an applicant terminal 110, an issuing authority 120, a verification authority 130, a distributed identity chain 140, a trusted service management platform 150, and a trusted identity management platform 160.

[0066] In this embodiment, the applicant terminal 110 is a terminal containing a wallet application 111. The applicant can use the wallet application 111 to apply for distributed identity activation and identity verification. The applicant terminal 110 also includes a security chip 112 for running the distributed identity application and generating the user's distributed identity public and private keys based on the distributed identity application. In this embodiment, the security chip 112 can be a chip embedded in the applicant terminal or a pluggable SIM card with a security module. In this embodiment, the distributed identity application can be an Applet application (a small application written in the Java programming language), and the security chip can operate according to the Java Card specification.

[0067] In some embodiments of this disclosure, the issuing authority 120 can be understood as an identity issuance system. The issuing authority 120 is equipped with a server cryptographic machine, which generates the issuer's public and private keys. The issuing authority 120 can provide identity credentials to users. In some embodiments of this disclosure, the distributed identity chain 140 can associate and store distributed identity identifiers, distributed identity documents, and / or verifiable credentials. For example, using a user's distributed identity identifier, a user's distributed identity identifier document and / or verifiable credentials can be obtained from the distributed identity chain 140. In some embodiments of this disclosure, the distributed identifier document stores the distributed identity identifier, distributed identity public key, or public key certificate. In some embodiments of this disclosure, the trusted identity management platform 160 can be an authoritative identity authentication institution that maintains and stores a database containing user identity information and biometric information, which can be accessed by other institutions or individuals to verify user identities.

[0068] In some embodiments of this disclosure, the distributed identity activation process includes the generation of a distributed identity identifier, the generation of a verifiable credential, and the on-chain associated storage of distributed identity-related information.

[0069] As shown in Figure 2, this embodiment of the disclosure provides a distributed identity activation method, including the following steps:

[0070] S201: In response to a user's distributed identity activation operation, wallet application 111 sends a distributed identity application and user personalized data to security chip 112. In some embodiments of this disclosure, after receiving a user's distributed identity activation operation, wallet application 111 requests the distributed identity application and user personalized data from the backend. For example, wallet application 111 determines the issuing authority 120 from the user's operation, and then sends a distributed identity application activation request (including information about the issuing authority 120) to trusted service management platform 150. Trusted service management platform 150 identifies the issuing authority 120 information from the activation request, then obtains the user personalized data from the issuing authority 120, and sends the distributed identity application and user personalized data to wallet application 111. In embodiments of this disclosure, when a user applies for distributed identity activation from different issuing authorities 120, they can obtain the distributed identity application from the same trusted service management platform 150. The trusted service management platform 150 manages the distributed identity application, saving management costs and reducing the manual costs of upgrading or deploying the distributed identity application.

[0071] In some embodiments of this disclosure, user-personalized data includes user wallet account information and issuing authority information (e.g., issuing authority distributed identity public key certificate, issuing authority name, etc.).

[0072] S202: Security chip 112 receives the distributed identity application and user personalized data, installs the distributed identity application, and sends the installation result of the distributed identity application to wallet application 111 after installation. Security chip 112 initializes the distributed identity application using the user personalized data, enabling the distributed identity application to function based on the user personalized data. In this embodiment, the distributed identity application runs within security chip 112, which can use the distributed identity application to perform processes such as managing the user's distributed identity, generating the user's distributed identity private key and public key, generating public key certificates, and issuing credential signatures.

[0073] S203: Wallet application 111 obtains user identity information and sends a verifiable credential acquisition request to issuing authority 120 based on the user identity information. The verifiable credential acquisition request includes the user identity information. In some embodiments of this disclosure, user identity information may include the user's ID card information, mobile phone information, biometric information (e.g., facial information, fingerprint information), etc.

[0074] S204: After obtaining the verifiable credential request, the issuing authority 120 verifies the user's identity information. If the verification is successful, a distributed identity identifier for the user is generated.

[0075] In some embodiments of this disclosure, the issuing authority 120 can verify user identity information using pre-stored user information, and can also send user identity information to a trusted identity management platform 160 for verification and obtain verification results from the trusted identity management platform 160.

[0076] In some embodiments of this disclosure, the issuing authority 120 generates a unique distributed user identity identifier for each user. The issuing authority 120 can use the user's identity information to perform calculations to generate the distributed user identity identifier. For example, the issuing authority 120 can use the ID card information in the user's identity information to perform a separate hash calculation, or perform a hash calculation together with the timestamp information, to generate the user's distributed identity identifier.

[0077] S205: Issuing authority 120 generates a verifiable credential based on the user's distributed identity identifier and sends the verifiable credential to wallet application 111. In embodiments of this disclosure, the verifiable credential includes a declaration portion and a signature portion generated by signing the declaration portion using the issuing authority's distributed identity private key. The declaration portion includes credential content, the issuing authority's distributed identity identifier, and the user's distributed identity identifier. In some embodiments of this disclosure, issuing authority 120 may pre-generate the issuing authority's distributed identity identifier according to rules, and combine it with a public key certificate issued by a trusted central authority to form an issuing authority's distributed identity identifier document, which is then stored in the distributed identity chain 140. Alternatively, in embodiments of this disclosure, issuing authority 120 may pre-generate the issuing authority's distributed identity identifier according to rules, and call an encryption machine to generate an issuing authority's distributed identity public key and private key, combining the issuing authority's distributed identity identifier and the issuing authority's distributed identity public key to form an issuing authority's distributed identity identifier document, which is then stored in the distributed identity chain 140.

[0078] In some embodiments of this disclosure, the issuing authority's distributed identity identifier and the issuing authority's distributed identity public key certificate can be pre-created by a trusted central authority. After creation, the issuing authority 120 or the trusted central authority synchronously stores the issuing authority's distributed identity identifier and the issuing authority's distributed identity document on the distributed identity chain 140. The issuing authority's distributed identity document contains the issuing authority's distributed identity identifier, the issuing authority's distributed identity public key certificate, and creator information: the trusted central authority's distributed identity identifier. The digital signature in the issuing authority's distributed identity public key certificate is generated based on the trusted central authority's distributed identity private key signature.

[0079] In some embodiments of this disclosure, the issuing authority 120 generates a private key and a public key for its distributed identity, and sends the public key to a trusted central authority. The trusted central authority calculates and generates a distributed identity identifier based on the public key and the issuing authority's identity information, and signs the public key and other information using the private key to generate a distributed identity certificate. The trusted central authority then returns the distributed identity certificate and the distributed identity identifier to the issuing authority 120.

[0080] In this embodiment of the disclosure, the credential content in the declaration section may include the verification result of the issuing authority 120, such as proving the user's legitimate identity information, proving the user's legitimate ownership of wallet account information, or proving the user's legitimate ownership of asset information. Different issuing authorities 120 can issue different credential content, and also require users to provide different information to the issuing authority 120. For example, when the credential content is to prove that the user legally owns asset A, the wallet application 111 needs to send the identification information and description information of asset A to the issuing authority 120 so that the issuing authority can determine the information of asset A and verify it.

[0081] In the embodiments of this disclosure, in order to improve the efficiency of issuing verifiable credentials by the issuing authority 120, the issuing authority 120 can also select the corresponding signature algorithm to sign the declaration part according to the amount of data in the declaration part, and generate the signature part.

[0082] As shown in Figure 3, the process by which issuing authority 120 generates verifiable credentials can be as follows:

[0083] S2051: The issuing authority 120 generates a statement portion of a verifiable credential based on the user's distributed identity, wherein the statement portion includes the credential content, the issuing authority's distributed identity, and the user's distributed identity.

[0084] S2052: The issuing authority 120 selects the corresponding signature algorithm to sign the declaration part based on the amount of data in the declaration part, generating a signature part of the verifiable credential.

[0085] When the amount of data in the declaration section is too large, using a single signature algorithm for signing will result in reduced signing efficiency, longer processing time, and a poor user experience.

[0086] As shown in Figure 4, in this embodiment of the present disclosure, the corresponding signature algorithm can be selected according to the amount of data. Specifically, step S2052 includes:

[0087] S20521: Get the amount of data in the declaration section.

[0088] S20522: When the data volume of the declaration portion exceeds a first data volume threshold, perform a hash calculation on the declaration portion to obtain a digest value of a first preset data volume. Sign the digest value using the issuing authority's distributed identity private key to generate a signature portion. In some embodiments of this disclosure, if the data volume of the declaration portion exceeds 512 bytes, use the national cryptographic algorithm SM3 to perform a hash algorithm on the data (ZA|Message, hash factor) to obtain a digest value of a first preset data volume (e.g., 32 bytes). Then, use the national cryptographic algorithm ALG_SM2_SM3_256_INPUT_E to calculate the digest value and generate the signature portion.

[0089] S20523: When the data size of the declaration portion is less than or equal to the first data size threshold, the declaration portion is signed using the issuing authority's distributed identity private key to generate a signature portion. In some embodiments of this disclosure, if the data size of the declaration portion is less than or equal to 512 bytes, the national cryptographic algorithm ALG_SM2_SM3_256 is used to sign the declaration portion to generate a signature portion.

[0090] In this embodiment of the disclosure, the first preset data volume is less than the first data volume threshold, or the first preset data volume is much smaller than the first data volume threshold. For example, the first preset data volume can be 32 bytes or 64 bytes, and the first data volume threshold can be 512 bytes or 544 bytes.

[0091] In the embodiments of this disclosure, the first preset data volume is less than the first data volume threshold, effectively reducing the data volume for signature calculation and thus improving the efficiency of signature. For the declaration part with a large data volume, hash calculation is performed first, and then signature is performed. The value of the generated signature part and the value of the signature part generated by direct signature can be verified using the same verification method and public key. When verifying the signature part, it is not necessary to pay attention to which signature algorithm was used to generate the signature part. A single verification method can still be used to verify the signature part. The verification agency does not need to be modified, reducing the modification cost of the verification agency.

[0092] S206: Wallet application 111 stores verifiable credentials and sends a distributed identity activation command to security chip 112.

[0093] S207: Security chip 112 calls the distributed identity application to generate the user's distributed identity public key and private key.

[0094] In some embodiments of this disclosure, the security chip 112 also generates a user distributed identity public key certificate based on the user's distributed identity public key and private key.

[0095] In the embodiments disclosed herein, the security chip 112 has a built-in tool for generating public and private keys, and the generated private key is stored in the security chip 112.

[0096] In some embodiments of this disclosure, the user distributed identity public key certificate includes creator identity information, public key subject, and digital signature, as shown in Figure 5. The process by which the security chip 112 generates the user distributed identity public key certificate is as follows:

[0097] S2071: Security chip 112 generates creator identity information based on user wallet account information.

[0098] S2072: Security chip 112 uses the user's distributed identity public key as the public key subject.

[0099] S2073: Security chip 112 generates a digital signature based on the user's distributed identity private key. Security chip 112 can use the user's distributed identity private key to sign information such as the creator's identity information and the public key subject, generating a digital signature. Subsequently, when using the user's distributed identity public key, the digital signature can be verified using the user's distributed identity public key.

[0100] S208: Security chip 112 sends the user's distributed identity public key or public key certificate to wallet application 111.

[0101] In the embodiments of this disclosure, the user-personalized data received by wallet application 111 includes issuing authority information, which includes the issuing authority name, the issuing authority's distributed identity public key certificate, and the issuing authority's distributed identity public key certificate, which includes the issuing authority's distributed identity public key. Wallet application 111 can obtain the user's distributed identity identifier from verifiable credentials, as follows:

[0102] The signature portion is verified using the issuing authority's distributed identity public key, generating a signature portion verification result. In response to the signature portion verification result indicating successful verification, the user's distributed identity identifier is obtained from the declaration portion of the verifiable credential, and the verifiable credential is stored.

[0103] In this embodiment of the disclosure, the verifiable credential is stored outside the security chip 112, which reduces the storage pressure on the verifiable credential and improves the efficiency of subsequent reading of the verifiable credential. In some embodiments of the disclosure, the verifiable credential can be stored in a storage area of ​​the wallet application 111 with read and write permissions. This storage area is located outside the security chip 112 and can also be independent of the security chip 112.

[0104] In some embodiments of this disclosure, to facilitate the reading of verifiable credentials, wallet application 111 stores verifiable credentials in a chain. Wallet application 111 can support storing multiple distributed identity identifiers and their corresponding verifiable credentials. For the same distributed identity identifier, wallet application 111 stores verifiable credentials with the same user distributed identity identifier in the same chained storage structure. During subsequent reading of verifiable credentials, after determining the corresponding chained storage structure based on the user distributed identity identifier, the target verifiable credential is determined by indexing chain by chain according to the chained storage structure, eliminating the need for cross-chain indexing and saving time in reading credentials. The chained storage structure in this embodiment can be seen in Figure 6. Each node stores a verifiable credential (VC) and a next node address (NEXT). For example, chain 1 stores the verifiable credential of the user's distributed identity (DID1). Node 1-1 stores VC1-1, and the next node address (NEXT1-1) of node 1-1 points to node 1-2. Node 1-2 stores VC1-2, and the next node address (NEXT1-2) of node 1-2 points to node 1-3. Node 1-3 stores VC1-3, and the next node address (NEXT1-2) of node 1-3... T1-3 points to NULL. When a new verifiable credential VC1-4 corresponding to the user's distributed identity DID1 needs to be stored, node 1-4 is generated. Node 1-4 stores VC1-4, and the next node address NEXT1-3 of node 1-3 points to node 1-4, while the next node address NEXT1-4 of node 1-4 points to NULL. Chain 2 stores the verifiable credential of the user's distributed identity DID2. Node 2-1 stores VC2-1, and the next node address NEXT2-1 of node 2-1 points to NULL. When it is necessary to read the verifiable credential of the user's distributed identity DID1, it is read from chain 1, without having to read the verifiable credential information from chain 2, thus reducing index space and improving read efficiency.

[0105] S209: Wallet application 111 generates a user distributed identity document based on the user's distributed identity identifier and the user's distributed identity public key or public key certificate, and sends the user distributed identity document, verifiable credential, and user distributed identity identifier to the distributed identity chain 140 for associated storage.

[0106] In some embodiments of this disclosure, the wallet application 111 can open multiple user distributed identity identifiers, create different user distributed identity private keys, public keys and public key certificates, and create corresponding chained storage structures.

[0107] In this embodiment of the disclosure, the distributed identity document includes a user's distributed identity and a user's distributed identity public key or public key certificate. When the wallet application 111 synchronizes data to the distributed identity chain 140, it can also synchronize the verification data of the verifiable credential to the distributed identity chain 140. In some embodiments of this disclosure, the verification data of the verifiable credential includes the digest value of the verifiable credential and the status of the verifiable credential. In this embodiment of the disclosure, the distributed identity chain 140 stores the user's distributed identity document, the verifiable credential, and the user's distributed identity in association, and can obtain the user's distributed identity document, the verifiable credential, or the verification data of the verifiable credential through the user's distributed identity.

[0108] In the embodiments of this disclosure, after the wallet application 111 sends the user's distributed identity document, verifiable credential, and user's distributed identity to the distributed identity chain 140 for associated storage, it will also receive the storage result from the distributed identity chain 140. The wallet application 111 sends the storage success result to the issuing authority 120, and the issuing authority 120 sends the verification data of the verifiable credential to the distributed identity chain 140. The distributed identity chain 140 associates and stores the verification data with the user's distributed identity.

[0109] In this embodiment of the disclosure, the issuing authority 120 may be the operator of the digital wallet. When generating a verifiable credential VC, the issuing authority 120 verifies the user based on the information submitted by the user when opening the wallet (name, age, date of birth, ID card number, specific address, etc.). The declaration part of the generated verifiable credential also includes the credential type, issuing authority information, validity period, credential content, etc.

[0110] In this embodiment, wallet application 111 does not need to repeatedly provide identity information to issuing authority 120. Providing it only once allows the issuing authority to generate a distributed identity identifier and a verifiable credential based on that identifier, reducing the need for users to frequently provide identity information. In this embodiment, a distributed identity application is installed in the security chip, enabling the management of user distributed identities within the chip. Subsequent key generation, certificate generation, parsing of verifiable credentials, and storage of verifiable credentials can all be achieved through the distributed identity application. This allows for the management of user distributed identities in a secure environment, improving the security of managing user identity information. The on-chain storage of the user distributed identity identifier, identifier document, and verifiable credentials provides a foundation for subsequent credential verification to validate the user's identity.

[0111] In this embodiment, after the issuing authority verifies the user's identity information, it activates a distributed identity for the user. The user's application terminal stores the user's distributed identity identifier and verifiable credentials. When the user needs to present verifiable credentials to the verification authority later, a verifiable expression can be generated based on the verifiable credentials. The verification authority verifies the verifiable credentials and the verifiable expression therein. After successful verification, the result of the issuing authority's verification of the user's identity is reused. The user does not need to repeatedly submit identity information to the verification authority during verification, thereby reducing repetitive operations for the user, improving the efficiency of the user's business processing, improving the user experience, and reducing the risk of leakage of user identity information.

[0112] As shown in Figure 7, this embodiment of the disclosure also provides a user authentication method based on verifiable credentials in the applicant's terminal, including the following steps:

[0113] S301: Wallet application 111 receives the user's authentication request and obtains the distributed identity identifier selected by the user.

[0114] S302: Wallet application 111 reads the verifiable credential related to the user's distributed identity from the corresponding chained storage structure based on the distributed identity identifier. The verifiable credential in this embodiment can be obtained based on the aforementioned distributed identity activation method, or it can be obtained from the issuing authority using other methods. For example, the user can apply for a verifiable credential from the issuing authority using the applied distributed identity identifier, collected identity information, and a proof request. After verifying the identity information and clarifying the proof request content, the issuing authority returns the verifiable credential to the user, which is then stored outside the security chip 112.

[0115] It should be noted that in this embodiment of the disclosure, the verifiable credentials in the security chip 112 can also be stored in a sequential storage manner. In this case, when reading the verifiable credentials, all verifiable credentials need to be read in full.

[0116] S303: Wallet application 111 displays verifiable credentials. The user selects a verifiable credential, and wallet application 111 sends a verifiable representation generation instruction to the security chip based on the user's selection. In some embodiments of this disclosure, the verifiable representation generation instruction includes a content digest value of a preset length generated by wallet application 111 based on the verifiable representation content. The verifiable representation content includes the user's distributed identity identifier, verifiable credentials, and may also include business request content, such as a wallet or account activation request, a wallet or account upgrade request, etc. In embodiments of this disclosure, the user authentication method can be executed during the user's specific business processing. For example, if the user selects to activate their wallet under a certain operating institution from wallet application 111, then this operating institution acts as the verification institution and sets the corresponding business request content into the verifiable representation content.

[0117] In some embodiments of this disclosure, the wallet application 111 may also send a random number acquisition request to the verification authority 130, and the verification authority 130 sends a random number to the wallet application 111, which can be verified to include this random number.

[0118] S304: The security chip 112 generates a credential signature by signing the content digest value using the user's distributed identity private key according to the verifiable expression generation instruction.

[0119] In embodiments of this disclosure, the verifiable representation includes verifiable representation content and a credential signature. The security chip 112 uses the user's distributed identity private key to sign the content digest value to generate a credential signature. The verifiable representation content includes a user-selected verifiable credential and a user distributed identity identifier. In some embodiments of this disclosure, the verifiable representation content may also include business request content.

[0120] In this embodiment of the disclosure, the security chip 112 can use the user's distributed identity private key to sign the content digest value and generate a credential signature. In some embodiments of this disclosure, the national cryptographic algorithm ALG_SM2_SM3_256 is used to sign the content digest value and generate a credential signature.

[0121] In some embodiments of this disclosure, due to the limited computing power of the security chip 112, in order to improve the signing efficiency (efficiency of generating credential signatures) of the security chip 112, when generating credential signatures, the security chip 112 selects the corresponding signature algorithm to sign the content digest value according to the amount of data in the content digest value, and generates a credential signature in the verifiable expression.

[0122] As shown in Figure 8, the process of generating a credential signature by the security chip 112 can be as follows:

[0123] S3041: The amount of data that the security chip 112 acquires for the content digest value.

[0124] S3042: When the security chip 112 determines that the amount of data in the content digest value is greater than the second data amount threshold, it performs a hash calculation on the content digest value to obtain a digest value with the second preset data amount, and signs the digest value using the user's distributed identity private key to generate a credential signature.

[0125] In some embodiments of this disclosure, if the data size of the content digest value is greater than 512 bytes, the national cryptographic algorithm SM3 is used to perform a hash algorithm on the data (ZA|Message, hash factor) to obtain a digest value of a second preset data size (e.g., 32 bytes), and the national cryptographic algorithm ALG_SM2_SM3_256_INPUT_E is used to calculate the digest value and generate a credential signature.

[0126] S3043: When the security chip 112 determines that the data size of the content digest value is less than or equal to the second data size threshold, it signs the content digest value using the user's distributed identity private key to generate a credential signature. In some embodiments of this disclosure, if the data size of the content digest value is less than or equal to 512 bytes, the national cryptographic algorithm ALG_SM2_SM3_256 is used to sign the content digest value to generate a credential signature.

[0127] In embodiments of this disclosure, the second preset data volume is less than a second data volume threshold, or the second preset data volume is much smaller than the second data volume threshold. For example, the second preset data volume can be 32 bytes or 64 bytes, and the second data volume threshold can be 512 bytes or 544 bytes.

[0128] In some embodiments of this disclosure, to ensure that each generated verifiable representation is different and to prevent hijackers from launching replay attacks after being intercepted, the verifiable representation content also includes timestamp information. Each time a verifiable representation is generated, the time and credential signature are different.

[0129] In some embodiments of this disclosure, replay attacks can also be prevented using random numbers. In step S301 of this embodiment, after receiving a user authentication request, the wallet application 111 obtains a random number from the verification authority 130. In step S303, the wallet application 111 sets the random number into the verifiable representation content. When the security chip 112 generates a credential signature, the verifiable representation content includes the random number, thus ensuring that the credential signature generated for each verification is different. Based on the changing credential signature, the verification authority 130 determines that the verifiable representation has not been hijacked and replayed. When subsequently verifying the credential signature, the verification authority 130 also compares whether the random number in the verifiable representation content is consistent with the issued random number, verifying the user's consistency.

[0130] In the embodiments of this disclosure, to facilitate the verification of the credential signature in the verifiable representation by the verification authority 130, the wallet application 111 can also set the user's distributed identity public key into the verifiable representation content when organizing it. Subsequently, when verifying the credential signature, the verification authority 130 can compare the user's distributed identity public key in the verifiable representation content with a public key obtained from other sources. Only after the comparison matches will the credential signature be verified, ensuring the security of public key transmission.

[0131] S305: Security chip 112 sends a credential signature to wallet application 111. Wallet application 111 generates a verifiable representation based on the verifiable representation content and the credential signature, and generates an authentication request based on the verifiable representation. It then sends the authentication request to verification authority 130, wherein the authentication request includes the verifiable representation.

[0132] In some embodiments of this disclosure, when the security chip 112 sends the credential signature to the wallet application 111, it also sends the user's distributed identity public key certificate to the wallet application 111. The authentication request generated by the wallet application 111 also includes the user's distributed identity public key certificate. Subsequently, when the verification authority 130 verifies the credential signature, it can use the public key in the user's distributed identity public key certificate to verify the credential signature, confirming that the credential signature was indeed generated by the user's distributed identity private key, and ensuring that the verifiable expression content in the verifiable expression has not been tampered with. The verification authority 130 directly obtains the user's distributed identity public key from the authentication request, saving time spent obtaining the user's distributed identity public key from other channels and improving verification efficiency.

[0133] S306: Verification authority 120 receives the authentication request sent by wallet application 111, verifies the verifiable representation, and generates a credential verification result.

[0134] In this embodiment of the disclosure, the authentication request includes a verifiable representation, which comprises verifiable representation content and a credential signature. The verifiable representation content includes a user distributed identity identifier and a verifiable credential. The declaration portion of the verifiable credential includes an issuing authority distributed identity identifier, and the signature portion is generated by signing with the issuing authority's distributed identity private key. In this embodiment of the disclosure, the verification authority 130 can verify the credential signature to obtain a preliminary verification result, and can further verify the signature portion of the verifiable credential to verify that the verifiable credential has not been tampered with.

[0135] In this embodiment of the disclosure, to prevent replay attacks after the verifiable representation is hijacked, the verification agency 130 also confirms whether the received verifiable representation is a replay attack before verifying the signature in the verifiable representation. In some embodiments of this disclosure, the verification agency 130 determines whether the value of the credential signature is consistent with the value of the credential signature sent from the wallet application before a preset time period. If they are consistent, the verification fails. For example, the preset time period can be 5 minutes or 10 minutes. After each successful verification of the verifiable representation, the verification agency 130 also stores the credential signature in the verifiable representation. When the next verifiable representation is received, it determines whether the credential signature is the same as the credential signature in the previously sent verifiable representation. If it is consistent with the previously received credential signature value, the verification fails.

[0136] To avoid replay attacks, in some embodiments of this disclosure, the security chip 112 also obtains a random number from the verification agency 130. The verifiable expression includes a random number, causing the credential signature value to change, thus avoiding replay attacks. When the verification agency 130 verifies the verifiable expression, in addition to verifying the change in the credential signature value, it also verifies the random number in the verifiable expression to determine whether it is consistent with the issued random number. If they are inconsistent, the verification fails, thereby verifying the consistency of the identity of the security chip 112 when applying for the random number and when verifying the verifiable expression.

[0137] In this embodiment of the disclosure, the verification agency 130 verifies the verifiable expression, which can verify the correctness of the credential signature and / or the correctness of the signature portion in the verifiable expression. Specifically, as shown in FIG9, the verification of the verifiable expression generates a credential verification result, including:

[0138] S3061: Verification authority 130 obtains the user's distributed identity public key. In this embodiment of the disclosure, verification authority 130 may obtain the user's distributed identity public key in different ways depending on the authentication request and the settings in the verifiable content.

[0139] In some embodiments of this disclosure, the verification authority 130 can obtain the user's distributed identity public key from the distributed identity chain 140 based on the user's distributed identity identifier. In these embodiments, when distributed identity is activated, the wallet application 111 stores the user's distributed identity identifier document and the associated user's distributed identity identifier on the distributed identity chain 140, retrieves the user's distributed identity identifier document from the distributed identity chain 140 using the user's distributed identity identifier, and obtains the user's distributed identity public key or public key certificate from the distributed identity identifier document.

[0140] In some embodiments of this disclosure, to save the process of obtaining the public key from the distributed identity chain, the verification authority 130 can also obtain the user's distributed identity public key from the applicant terminal 110. Specifically, the authentication request also includes a user's distributed identity public key certificate. The verification authority 130 obtains the public key body from the user's distributed identity public key certificate, uses the public key body to verify the digital signature in the user's distributed identity public key certificate, and obtains the user's distributed identity public key based on the public key body after successful verification. In these embodiments, obtaining the user's distributed identity public key through the public key certificate in the authentication request saves the step of querying and obtaining the public key from the distributed identity chain, saves verification time, and improves verification efficiency.

[0141] In the embodiments disclosed herein, if the consensus process on the blockchain takes a long time and the user's distributed identity public key certificate is updated but the public key certificate on the distributed identity chain 140 is not updated, the verification of the credential signature will fail. The latest user distributed public key certificate will be obtained through the applicant terminal 110 to ensure that the credential signature can be verified according to the actual situation, thereby improving the user experience.

[0142] In some embodiments of this disclosure, to ensure consistency of public key certificates stored by multiple parties, the verification authority 130 compares the public key obtained from the user's distributed identity public key certificate in the authentication request with the public key obtained from the distributed identity chain 140. Specifically, obtaining the user's distributed identity public key based on the public key subject includes:

[0143] Verification authority 130 obtains the user's distributed identity public key from the distributed identity chain 140 based on the user's distributed identity identifier; it compares whether the public key subject is consistent with the user's distributed identity public key. If they are consistent, the public key subject is used as the user's distributed identity public key.

[0144] In other embodiments of this disclosure, to ensure that the user distributed identity public key used by the security chip 112 in generating the credential signature is consistent with the public key in the user distributed identity public key certificate, the verification authority 130 may also require the verifiable expression content to include the user distributed identity public key, and then perform a consistency check. Specifically, obtaining the user distributed identity public key based on the public key subject includes:

[0145] Verification agency 130 compares whether the user's distributed identity public key in the verifiable expression content is consistent with the public key subject. If they are consistent, the public key subject is used as the user's distributed identity public key.

[0146] In this embodiment of the disclosure, multiple public key verifications are performed to ensure that the user distributed identity public key used is authentic and reliable.

[0147] S3062: Verification agency 130 performs a digest calculation on the verifiable expression content to obtain a content verification digest value. In this embodiment of the disclosure, the algorithm used by verification agency 130 to perform the digest calculation on the verifiable expression content is the same as the algorithm used by wallet application 111 to generate the content digest value. In some embodiments of this disclosure, parameters indicating the algorithm type can be set in the verifiable expression content.

[0148] S3063: Verification authority 130 verifies the credential signature using the user's distributed identity public key and content verification digest value, generating a credential signature verification result. In this embodiment of the disclosure, the signature verification algorithm can adopt a national cryptographic signature verification algorithm.

[0149] S3064: Verification agency 130 verifies verifiable vouchers based on the voucher signature verification result and generates voucher verification result.

[0150] In this embodiment of the disclosure, the verifiable credential includes a signature portion issued by the issuing authority's distributed identity private key. The issuing authority's distributed identity public key is required to verify the signature portion. In this embodiment of the disclosure, the issuing authority's distributed identity public key is obtained through the issuing authority's distributed identity identifier in the declaration section.

[0151] As shown in Figure 10, step S3064 above includes the following steps:

[0152] S30641: In response to the credential signature verification result indicating that the credential signature verification is successful, the verification authority 130 obtains the issuing authority's distributed identity public key from the distributed identity chain 140 based on the issuing authority's distributed identity identifier. In some embodiments of this disclosure, the distributed identity chain 140 stores an issuing authority's distributed identity identifier document, which can be obtained from the distributed identity chain 140 through the issuing authority's distributed identity identifier, and the issuing authority's distributed identity public key can be obtained from the distributed identity identifier document.

[0153] In some embodiments of this disclosure, the issuing authority's distributed identity document stores the issuing authority's distributed identity public key certificate. Before using the public key, its validity can be verified. Specifically, as shown in Figure 11, obtaining the issuing authority's distributed identity public key from the distributed identity chain 140 includes:

[0154] S306411: Verification authority 130 obtains the issuing authority distributed identity identifier document from the distributed identity chain 140, wherein the issuing authority distributed identity identifier document includes the issuing authority distributed identity public key or public key certificate and the trusted central authority distributed identity identifier (creator), and the digital signature in the issuing authority distributed identity public key certificate is generated by signing the trusted central authority distributed identity private key.

[0155] S306412: Verification authority 130 obtains a trusted central authority distributed identity public key from distributed identity chain 140 based on the trusted central authority distributed identity identifier. Distributed identity chain 140 stores a trusted central authority distributed identity identifier document, which contains the trusted central authority distributed identity identifier and a trusted central authority distributed identity public key certificate. The trusted central authority distributed identity identifier document can be indexed through the trusted central authority distributed identity identifier, thereby obtaining the trusted central authority distributed identity public key certificate, and then obtaining the trusted central authority distributed identity public key from the trusted central authority distributed identity public key certificate. In some embodiments of this disclosure, the digital signature in the trusted central authority distributed identity public key certificate is generated by the trusted central authority distributed identity private key. After obtaining the trusted central authority distributed identity public key certificate, verification authority 130 can use the trusted central authority distributed identity public key within it to verify the digital signature in the trusted central authority distributed identity public key certificate. After successful verification, it is determined that the trusted central authority distributed identity public key stored on the chain has not been tampered with, and the trusted central authority distributed identity public key is used to verify the digital signature in the issuing authority distributed identity public key certificate.

[0156] S306413: Verification Authority 130 uses the trusted central authority's distributed identity public key to verify the digital signature in the issuing authority's distributed identity public key certificate. After successful verification, the public key subject in the issuing authority's distributed identity public key certificate is used as the issuing authority's distributed identity public key.

[0157] In this embodiment of the disclosure, the trusted central authority creates a distributed identity for the issuing authority. The trusted central authority sets the distributed identity identifier of the trusted central authority as the creator in the distributed identity identifier document of the issuing authority, and uses the private key of the trusted central authority's distributed identity to generate a digital signature in the public key certificate of the issuing authority's distributed identity.

[0158] In this embodiment of the disclosure, the digital signature in the issuing authority's distributed identity public key certificate is verified by the distributed identity public key of a trusted central authority, thereby determining the legitimacy of the issuing authority's distributed identity public key.

[0159] In this embodiment of the disclosure, the verification authority 130 performs at least three signature verifications. First, it verifies that the verifiable representation was submitted by the user (verification through credential signature); second, it verifies that the verifiable representation was submitted by the user and issued by the issuing authority (verification of the signature portion of the verifiable representation); third, it verifies that the distributed identity of the issuing authority was created by a trusted central authority (verification through the digital signature of the issuing authority's distributed public key certificate), and the trusted central authority is in the trusted list of verification authorities, forming a verification closed loop.

[0160] S30642: Verification authority 130 verifies the signature portion based on the issuing authority's distributed identity public key. After successful verification, it generates a credential verification result indicating that the verification has been successful.

[0161] In the embodiments disclosed herein, the authenticity of the verifiable credential is determined by verifying the signature portion, and the content of the credential has not been tampered with.

[0162] In other embodiments of this disclosure, after the verification agency 130 verifies the signature portion, it does not directly generate a credential verification result indicating that the verification has passed. Instead, it verifies the status of the verifiable credential, as shown in Figure 12. Specifically, this includes the following steps:

[0163] S306421': After the verification agency 130 determines that the signature part has been verified based on the verification result of the signature part, it generates a query digest value based on the verifiable credential.

[0164] S306422': Verification agency 130 obtains verifiable credential status information from distributed identity chain 140 based on the query digest value. In some embodiments of this disclosure, when a user activates distributed identity or applies for a verifiable credential, the applicant terminal 110 or issuing agency 120 associates and stores the verifiable credential digest value and verifiable credential status information on distributed identity chain 140, and the corresponding verifiable credential status information can be queried through the digest value. In embodiments of this disclosure, verifiable credential status information includes valid, invalid, etc. When a verifiable credential becomes invalid, the status information on distributed identity chain 140 is synchronously changed, which can be synchronized from the applicant terminal 110 or issuing agency 120 to the distributed identity chain 140.

[0165] In this embodiment of the disclosure, the verification agency 130 sends the query digest value to the distributed identity chain 140, and the distributed identity chain 140 obtains the credential status information based on the query digest value and sends the credential status information to the verification agency 130.

[0166] S306423': After the verification agency 130 responds to the status information indicating that the credential is valid, it generates a credential verification result indicating that the verification has passed.

[0167] In this embodiment of the disclosure, when the verifiable credential is generated, the issuing authority 120 sets an expiration date, i.e., the declaration section includes credential validity information. Verifying the verifiable credential also includes verifying the validity period based on the current time. For example, if the declaration section specifies the validity period as ending on January 1, 2025, at 00:00:00, and the current time is November 1, 2024, at 12:05:56, then the credential has not yet expired, and the verification passes.

[0168] In some embodiments of this disclosure, the declaration portion of the verifiable credential also includes the credential type. When verifying the verifiable credential, the credential type can also be verified. For example, the verification agency only accepts verifiable credentials of type A and B, and considers type C verifiable credentials to be untrustworthy. Therefore, when the user presents a type C verifiable credential, the verification agency 130 fails to verify it.

[0169] In some embodiments of this disclosure, the verification authority 130 also verifies the identity of the issuing authority. The verification authority 130 pre-stores a whitelist of trusted issuing authorities. When the issuing authority is not in the whitelist, the verification authority 130 fails to verify. The verification authority 130 can determine whether the issuing authority is in the pre-stored whitelist of trusted issuing authorities based on the distributed identity identifier of the issuing authority, or based on the issuing authority information in the verifiable credential declaration section.

[0170] In the above-described verification of credential signature, verification of signature portion, and verification of verifiable credential validity period and status in this embodiment of the disclosure, if verification fails, the verification agency 130 returns the verification failure result to the applicant terminal 110 or wallet application 111.

[0171] In some embodiments of this disclosure, the verifiable content may include business processing request related content. After verifying the credential signature and the verifiable credential signature portion, the verification agency 130 can process the business based on the business processing request related content. For example, after the verification agency 130 verifies the request, it can perform operations such as wallet opening or wallet upgrade.

[0172] S307: Verification agency 130 sends the credential verification result to wallet application 111. In some embodiments of this disclosure, verification agency 130 may also send the business processing result to wallet application 111 synchronously or asynchronously. In some embodiments of this disclosure, verification agency 130 may first send the credential verification result to wallet application 111. After wallet application 111 confirms, verification agency continues to process business requests. After processing is completed, it sends the business processing result to wallet application 111.

[0173] S308: Wallet application 111 displays the credential verification result and / or the transaction processing result. In some embodiments of this disclosure, wallet application 111 may first display the credential verification result, and then display the transaction processing result after receiving it.

[0174] This disclosure provides a distributed identity activation method and a user authentication method based on a security chip. It realizes functions such as distributed identity creation and maintenance, credential issuance, credential presentation and verification, and authorization management. It constructs a financial distributed identity chain, realizes distributed storage and verification of credentials, and stores and manages nodes for access institution registration services.

[0175] Some embodiments of this disclosure are based on security chips and use domestically developed cryptographic algorithms to ensure the legitimacy of the visitor's identity, preventing the illegal theft or tampering of keys, thus improving the security of data transmission and providing cryptographic hardware support. The security chip is responsible for key creation, use, and management. In these embodiments, the authentication results can be shared and reused across operating institutions and business processes, simplifying user authentication within the digital wallet system, thereby improving user convenience and establishing a mechanism for multi-party mutual trust and efficient collaboration among banking institutions, markets, organizations, and governments, ultimately enhancing the efficiency of financial services.

[0176] In this embodiment of the disclosure, the verifiable credentials are stored outside the security chip, which reduces the storage and reading pressure on the security chip and improves the efficiency of generating verifiable representations.

[0177] As shown in Figure 13, this embodiment of the disclosure also provides a user authentication device 400, which is applied to a security chip installed in the applicant's terminal. The applicant's terminal also has a wallet application installed. The device 400 includes an instruction receiving module 410, a credential signature generation module 420, and a credential signature sending module 430. The functional modules are described below:

[0178] The instruction receiving module 410 is configured to receive a verifiable expression generation instruction sent by the wallet application. The verifiable expression generation instruction includes a content digest value of a preset length generated by the wallet application based on the verifiable expression content. The verifiable expression content includes a verifiable credential and a user distributed identity identifier. The verifiable credential includes a declaration part and a signature part generated by signing the declaration part using the issuing authority's distributed identity private key. The declaration part includes the credential content, the issuing authority's distributed identity identifier, and the user's distributed identity identifier.

[0179] The credential signature generation module 420 is configured to sign the content digest value using the user's distributed identity private key to generate a credential signature;

[0180] The credential signature sending module 430 is configured to send credential signatures to the wallet application, so that the wallet application can generate a verifiable representation based on the verifiable representation content and the credential signature, and send an authentication request containing the verifiable representation to the verification authority for verification.

[0181] Verifiable content also includes timestamp information.

[0182] In some embodiments of this disclosure, the verifiable expression also includes a random number, which is obtained by the wallet application from the verification authority after receiving the authentication request operation.

[0183] In some embodiments of this disclosure, the credential signature sending module 430 is further configured to send the user's distributed identity public key certificate to the wallet application when sending the credential signature to the wallet application, and the authentication request includes the user's distributed identity public key certificate.

[0184] In some embodiments of this disclosure, the verifiable expression also includes the user's distributed identity public key.

[0185] As shown in Figure 14, in some embodiments of this disclosure, a user authentication device 500 is also provided, applied to the applicant terminal. The applicant terminal is also equipped with a security chip. The device 500 includes a verifiable expression acquisition module 510, a content digest calculation module 520, an instruction sending module 530, a credential signature receiving module 540, and a verification request sending module 550. The functions of each module are described below:

[0186] The verifiable representation acquisition module 510 is configured to receive the user's authentication operation and acquire the verifiable representation content. The verifiable representation content includes locally stored verifiable credentials and user distributed identity identifier. The verifiable credentials include a declaration part and a signature part generated by signing the declaration part using the issuing authority's distributed identity private key. The declaration part includes the credential content, the issuing authority's distributed identity identifier, and the user's distributed identity identifier.

[0187] Content summary calculation module 520 is configured to perform summary calculation based on verifiable expressive content and obtain a content summary value of a preset length;

[0188] The instruction sending module 530 is configured to send a verifiable representation generation instruction to the security chip, the verifiable representation generation instruction including a content digest value;

[0189] The credential signature receiving module 540 is configured to receive credential signatures sent by the security chip, and generate a verifiable representation based on the verifiable representation content and the credential signature. The credential signature is generated by the security chip after signing the content digest value using the user's distributed identity private key.

[0190] The verification request sending module 550 is configured to send an authentication request containing a verifiable expression to the verification authority, so that the verification authority can verify the authentication request, generate and return the credential verification result to the wallet application.

[0191] In some embodiments of this disclosure, the credential signature receiving module 540 is further configured to: when receiving a credential signature sent by the security chip, also receive a user distributed identity public key certificate sent by the security chip; the authentication request includes the user distributed identity public key certificate.

[0192] As shown in Figure 15, this embodiment of the present disclosure also provides a user authentication device 600, which is applied to an authentication agency. The device 600 includes an authentication request acquisition module 610, an authentication module 620, and an authentication result sending module 630. The functions of each module are described below:

[0193] The authentication request acquisition module 610 is configured to acquire the authentication request sent by the wallet application of the applicant terminal. The authentication request includes a verifiable expression generated by the wallet application. The verifiable expression includes the verifiable expression content and the credential signature. The credential signature is generated by the security chip of the applicant terminal after signing the content digest value. The content digest value is obtained by the wallet application by performing digest calculation based on the verifiable expression content. The verifiable expression content includes the verifiable credential and the user's distributed identity identifier.

[0194] The verification module 620 is configured to verify authentication requests and generate credential verification results;

[0195] The verification result sending module 630 is configured to send the credential verification result to the wallet application.

[0196] In some embodiments of this disclosure, the verification module 620 is further configured to:

[0197] The system checks whether the value of the credential signature matches the credential signature sent from the wallet application before a preset time. If they match, the verification fails.

[0198] In some embodiments of this disclosure, the device 600 further includes a random number generation module 640, configured to: obtain a random number retrieval request sent by a wallet application, generate a random number, and send the random number to the wallet application, wherein the verifiable expression content includes the random number, and the wallet application generates the random number retrieval request after obtaining the authentication request operation.

[0199] In some embodiments of this disclosure, the verification module 620 is further configured to:

[0200] The verification function checks whether the random number in the expressed content matches the random number sent. If they match, the verification fails.

[0201] In some embodiments of this disclosure, the verification module 620 is further configured to:

[0202] Obtain the user's distributed identity public key;

[0203] Perform a summary calculation on the verifiable content to obtain the content verification summary value;

[0204] The credential signature is verified using the user's distributed identity public key and the content verification digest value, and a credential signature verification result is generated.

[0205] Based on the voucher signature verification result, the verifiable voucher is verified, and a voucher verification result is generated.

[0206] In some embodiments of this disclosure, the verification module 620 is further configured to:

[0207] Based on the user's distributed identity identifier, obtain the user's distributed identity public key from the distributed identity chain.

[0208] In some embodiments of this disclosure, the authentication request also includes a user distributed identity public key certificate, and the authentication module 620 is further configured to:

[0209] Obtain the public key body from the user's distributed identity public key certificate, use the public key body to verify the digital signature in the user's distributed identity public key certificate, and after successful verification, obtain the user's distributed identity public key based on the public key body.

[0210] In some embodiments of this disclosure, the verifiable expression content also includes the user's distributed identity public key, and the verification module 620 is further configured as follows:

[0211] The system compares the user's distributed identity public key in the verifiable expression content with the public key body. If they match, the public key body is used as the user's distributed identity public key.

[0212] In some embodiments of this disclosure, the verifiable credential includes a claim portion and a signature portion generated by signing the claim portion with the issuing authority's distributed identity private key, the claim portion including the issuing authority's distributed identity identifier; the verification module 620 is further configured to:

[0213] In response to the credential signature verification result indicating that the credential signature verification is successful, the issuing authority's distributed identity public key is obtained from the distributed identity chain based on the issuing authority's distributed identity identifier;

[0214] The signature is verified using the issuing authority's distributed identity public key. Once the verification is successful, a credential verification result indicating successful verification is generated.

[0215] The device features of the embodiments of this disclosure can be referenced to the features of the methods and steps of the embodiments of this disclosure, and the system embodiments can be combined with the features of the method embodiments to obtain new embodiments, and vice versa, and will not be repeated here.

[0216] An embodiment of this disclosure provides an electronic device including a processor and a memory storing a computer program, the processor being configured to implement any method according to an embodiment of this disclosure when running the computer program. Additionally, means for implementing embodiments according to this disclosure may also be provided.

[0217] Figure 16 illustrates an exemplary system architecture 1600 for applying identity credentials, a distributed identity activation method, and a distributed identity activation device that can be applied to embodiments of this disclosure.

[0218] As shown in Figure 16, the system architecture 1600 may include terminal devices 1601, 1602, and 1603, a network 1604, and a server 1605. The network 1604 serves as the medium for providing communication links between the terminal devices 1601, 1602, and 1603 and the server 1605. The network 1604 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0219] Users can use terminal devices 1601, 1602, and 1603 to interact with server 1605 via network 1604 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 1601, 1602, and 1603, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0220] Terminal devices 1601, 1602, and 1603 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0221] Server 1605 can be a server providing various services, such as a backend management server supporting shopping websites browsed by users using terminal devices 1601, 1602, and 1603 (for example only). The backend management server can analyze and process data such as received product information query requests, and feed back the processing results (such as target push information and product information - for example only) to the terminal devices.

[0222] It should be noted that the identity credential application and distributed identity activation method provided in this embodiment is generally executed by server 1605, and correspondingly, the identity credential application and distributed identity activation implementation device is generally set in server 1605.

[0223] It should be understood that the number of terminal devices, networks, and servers in Figure 16 is merely illustrative. Any number of terminal devices, networks, and servers can be used depending on implementation needs.

[0224] Referring now to FIG17, a schematic diagram of the structure of a computer system 1700 suitable for implementing a terminal device or server in the embodiments of the present disclosure is shown. The methods or apparatus for implementing the methods in the embodiments of the present disclosure can be implemented on the computer system 1700. The terminal device or server shown in FIG17 is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of the present disclosure.

[0225] As shown in Figure 17, the computer system 1700 includes a central processing unit (CPU) 1701, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 1702 or programs loaded from storage section 1708 into random access memory (RAM) 1703. The RAM 1703 also stores various programs and data required for the operation of the system 1700. The CPU 1701, ROM 1702, and RAM 1703 are interconnected via bus 1704. An input / output (I / O) interface 1705 is also connected to bus 1704.

[0226] The following components are connected to I / O interface 1705: an input section 1706 including a keyboard, mouse, etc.; an output section 1707 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 1708 including a hard disk, etc.; and a communication section 1709 including a network interface card such as a LAN card, modem, etc. The communication section 1709 performs communication processing via a network such as the Internet. A drive 1710 is also connected to I / O interface 1705 as needed. Removable media 1711, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 1710 as needed so that computer programs read from them can be installed into storage section 1708 as needed.

[0227] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 1709, and / or installed from removable medium 1711. When the computer program is executed by central processing unit (CPU) 1701, it performs the functions defined above in the system of this disclosure.

[0228] It should be noted that the computer-readable medium disclosed herein may be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium may be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0229] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0230] The units or modules described in the embodiments of this disclosure can be implemented in software or hardware. The described units or modules can also be housed in a processor; for example, a processor can be described as including a sending unit (or "module"), an acquisition unit, a determining unit, and a first processing unit. The names of these units or modules do not necessarily limit the specific unit or module itself; for example, a sending unit can also be described as "a unit that sends an image acquisition request to a connected server."

[0231] In another aspect, this disclosure also provides a computer-readable medium, which may be included in the device described in the above embodiments; or it may exist independently and not assembled into the device. The computer-readable medium carries one or more programs that, when executed by the device, cause the device to perform the methods described in the above embodiments.

[0232] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can occur depending on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A user identity authentication method, characterized by, The method, which applies to a security chip installed in a requester's terminal, and the requester's terminal also includes a wallet application, comprises: The system receives a verifiable representation generation instruction sent by the wallet application. The verifiable representation generation instruction includes a content digest value of a preset length generated by the wallet application based on the verifiable representation content. The verifiable representation content includes a verifiable credential and a user distributed identity identifier. The verifiable credential is stored outside the security chip. The verifiable credential includes a declaration portion and a signature portion generated by signing the declaration portion using the issuing authority's distributed identity private key. The declaration portion includes credential content, the issuing authority's distributed identity identifier, and the user's distributed identity identifier. The content digest value is signed using the user's distributed identity private key to generate a credential signature; and The credential signature is sent to the wallet application, so that the wallet application generates a verifiable representation based on the verifiable representation content and the credential signature, and sends an authentication request containing the verifiable representation to a verification authority for verification.

2. The method of claim 1, wherein, The verifiable content also includes timestamp information.

3. The method of claim 1, wherein, The verifiable expression content also includes a random number, which is obtained by the wallet application from the verification authority after receiving the authentication request operation.

4. The method of claim 1, wherein, When the security chip sends the credential signature to the wallet application, it also sends the user's distributed identity public key certificate to the wallet application, and the authentication request includes the user's distributed identity public key certificate.

5. The method of claim 1, wherein, The verifiable content also includes the user's distributed identity public key.

6. A user authentication method characterized by, A wallet application applied within an applicant's terminal, wherein the applicant's terminal is also equipped with a security chip, the method comprising: Receive user authentication operation, obtain verifiable expression content, the verifiable expression content includes verifiable credentials and user distributed identity identifier, the verifiable credentials include a declaration part and a signature part generated by signing the declaration part using the issuing authority's distributed identity private key, the declaration part includes credential content, issuing authority distributed identity identifier and user distributed identity identifier; Based on the verifiable content, a summary calculation is performed to obtain a content summary value of a preset length. A verifiable representation generation instruction is sent to the security chip, the verifiable representation generation instruction including the content digest value; The system receives a credential signature sent by the security chip, generates a verifiable representation based on the verifiable representation content and the credential signature, wherein the credential signature is generated by the security chip signing the content digest value using the user's distributed identity private key; and An authentication request containing the verifiable expression is sent to a verification authority, which then verifies the authentication request, generates and returns a credential verification result to the wallet application.

7. The method of claim 6, wherein, When receiving the credential signature sent by the security chip, the method further includes: also receiving the user distributed identity public key certificate sent by the security chip; the authentication request includes the user distributed identity public key certificate.

8. The method of claim 6, wherein, Before receiving the user's authentication request, the method further includes: Verifiable credentials with the same distributed identity of the user are stored in the same chained storage structure, which is located outside the security chip.

9. A user authentication method characterized by, Applied to a verification organization, the method includes: The system obtains an authentication request sent by the wallet application of the applicant terminal, wherein the authentication request includes a verifiable representation generated by the wallet application, the verifiable representation includes verifiable representation content and a credential signature, the credential signature is generated by the security chip of the applicant terminal after signing according to the content digest value, the content digest value is obtained by the wallet application by performing digest calculation based on the verifiable representation content, and the verifiable representation content includes a verifiable credential and a user distributed identity identifier; The authentication request is verified, and a credential verification result is generated; and Send the credential verification result to the wallet application.

10. The method of claim 9, wherein, The verification of the authentication request includes: Determine whether the value of the credential signature is consistent with the credential signature sent from the wallet application before a preset time period. If they are consistent, the verification fails.

11. The method of claim 10, wherein, Before obtaining the authentication request, the method further includes: The wallet application receives a random number retrieval request, generates a random number, and sends the random number to the wallet application. The verifiable content includes the random number. The wallet application generates the random number retrieval request after receiving the authentication request operation. The verification of the authentication request further includes: Verify whether the random number in the verifiable expression content is consistent with the random number sent. If they are consistent, the verification fails.

12. The method of claim 9, wherein, The step of verifying the authentication request and generating a credential verification result includes: Obtain the user's distributed identity public key; Perform a summary calculation on the verifiable content to obtain a content verification summary value; The credential signature is verified using the user's distributed identity public key and the content verification digest value to generate a credential signature verification result; and Based on the credential signature verification result, the verifiable credential is verified, and the credential verification result is generated.

13. The method according to claim 12, characterized in that, The process of obtaining the user's distributed identity public key includes: Based on the user's distributed identity identifier, obtain the user's distributed identity public key from the distributed identity chain.

14. The method of claim 12, wherein, The authentication request also includes a user's distributed identity public key certificate, and obtaining the user's distributed identity public key includes: Obtain the public key body from the user's distributed identity public key certificate, and use the public key body to verify the digital signature in the user's distributed identity public key certificate. After successful verification, obtain the user's distributed identity public key based on the public key body.

15. The method of claim 14, wherein, The verifiable expression content also includes the user's distributed identity public key, and obtaining the user's distributed identity public key based on the public key subject includes: Compare whether the user's distributed identity public key in the verifiable expression content is consistent with the public key body. If they are consistent, then the public key body is used as the user's distributed identity public key.

16. The method of claim 9, wherein, The verifiable credential includes a declaration portion and a signature portion generated by signing the declaration portion with the issuing authority's distributed identity private key, wherein the declaration portion includes the issuing authority's distributed identity identifier; the step of verifying the verifiable credential based on the credential signature verification result and generating the credential verification result includes: In response to the credential signature verification result indicating that the credential signature verification passed, the issuing authority's distributed identity public key is obtained from the distributed identity chain based on the issuing authority's distributed identity identifier; and The signature portion is verified using the issuing authority's distributed identity public key. Once the verification is successful, a credential verification result indicating successful verification is generated.

17. A user identity verification apparatus, characterized by comprising: The device is applied to a security chip installed in the applicant's terminal, which also includes a wallet application. The device comprises an instruction receiving module, a credential signature generation module, and a credential signature sending module. The instruction receiving module is configured to receive a verifiable expression generation instruction sent by the wallet application. The verifiable expression generation instruction includes a content digest value of a preset length generated by the wallet application based on the verifiable expression content. The verifiable expression content includes a verifiable credential and a user distributed identity identifier. The verifiable credential includes a declaration portion and a signature portion generated by signing the declaration portion using the issuing authority's distributed identity private key. The declaration portion includes credential content, the issuing authority's distributed identity identifier, and the user's distributed identity identifier. The credential signature generation module is configured to sign the content digest value using the user's distributed identity private key to generate a credential signature; and The credential signature sending module is configured to send the credential signature to the wallet application, so that the wallet application generates a verifiable expression based on the verifiable expression content and the credential signature, and sends an authentication request containing the verifiable expression to a verification authority for verification.

18. A user identity verification apparatus, characterized by comprising: The device is applied to the applicant's terminal, which also contains a security chip. The device includes a verifiable representation acquisition module, a content digest calculation module, an instruction sending module, a credential signature receiving module, and a verification request sending module. The verifiable representation acquisition module is configured to receive user authentication operations and acquire verifiable representation content. The verifiable representation content includes locally stored verifiable credentials and user distributed identity identifiers. The verifiable credentials include a declaration portion and a signature portion generated by signing the declaration portion using the issuing authority's distributed identity private key. The declaration portion includes credential content, issuing authority distributed identity identifiers, and user distributed identity identifiers. The content summary calculation module is configured to perform summary calculation based on the verifiable expression content to obtain a content summary value of a preset length. The instruction sending module is configured to send a verifiable expression generation instruction to the security chip, wherein the verifiable expression generation instruction includes the content digest value; The credential signature receiving module is configured to receive a credential signature sent by the security chip, and generate a verifiable representation based on the verifiable representation content and the credential signature, wherein the credential signature is generated by the security chip after signing the content digest value using the user's distributed identity private key; and The verification request sending module is configured to send an authentication request containing the verifiable expression to the verification authority, so that the verification authority verifies the authentication request, generates and returns the credential verification result to the wallet application.

19. A user identity verification apparatus, characterized by comprising: Applied to verification agencies, the device includes an identity verification request acquisition module, a verification module, and a verification result sending module, wherein, The authentication request acquisition module is configured to acquire authentication requests sent by the wallet application of the applicant terminal. The authentication request includes a verifiable expression generated by the wallet application. The verifiable expression includes verifiable expression content and a credential signature. The credential signature is generated by the security chip of the applicant terminal after signing based on the content digest value. The content digest value is obtained by the wallet application by performing digest calculation based on the verifiable expression content. The verifiable expression content includes a verifiable credential and a user distributed identity identifier. The verification module is configured to verify the authentication request and generate a credential verification result; and The verification result sending module is configured to send the credential verification result to the wallet application.

20. An electronic device, comprising: include: One or more processors; Storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1-16.

21. A computer readable medium having stored thereon a computer program, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1-16.

Images