数字身份信任硬件金库与 eIDAS 2.0 合规资格认证模块

架构专用硬件安全模块，支持主权身份签发、抗追踪与不可关联的零知识凭证展示，以及电子属性凭证的强加密硬件认证。

IdHSM Identity Enclave Architecture

Cryptographic Enclave: Sovereign Identity Enclave — CC EAL6+ / ARF High LoA Core

Hardware Security Nodes & Co-Processors

  • SD-JWT-VC Hash & Salt Engine
  • BLS12-381 / BBS+ Pairing Core
  • ISO/IEC 18013-5 mDL Engine
  • W3C DID Key Custody Vault
  • Hardware StatusList2021 Signer

Architectural Layers & Silicon Defenses

  • Layer 1: Secure Element & Attestation Root (Silicon PUF / CC EAL6+ Microcontroller): Anchoring sovereign identity master seeds to physically unclonable functions with anti-cloning guarantees.
  • Layer 2: Zero-Knowledge & Pairing Co-Processor (Hardware Multi-Scalar Multiplication / BLS): Accelerating elliptic curve pairings over BLS12-381 and BN254 curves for instant zero-knowledge proof generation.
  • Layer 3: Sovereign Credential Lifecycle Engine (SD-JWT-VC / ISO 18013-5 / OpenID4VCI): Formatting and cryptographically signing verifiable credentials and selective disclosure attribute attestations.
  • Layer 4: European Digital Identity Gateway (eIDAS 2.0 ARF v1.4 / ETSI EN 319 411): Interfacing with European Union Digital Identity (EUDI) wallets and Qualified Trust Service Providers.

Cryptographic Telemetry & Compliance: LoA High (eIDAS 2.0 Trust Level) | < 2.8 ms (BBS+ Proof Verification) | 100% (Unlinkable Presentations) | EAL6+ (Common Criteria Certification)

面向主权数字身份与隐私的硬件信任根

Digital identity ecosystems require mathematical guarantees of privacy, non-traceability, and cryptographic authenticity. IdHSM bridges qualified trust service providers (QTSPs) and citizen identity wallets through Common Criteria certified hardware enclaves that enforce selective disclosure and unlinkability at the silicon level.

Core Engineering Areas

Technical Publications

Related Cluster Architecture Specifications