TWI650658B - Method and system for querying data through verification of identity and authorization - Google Patents

Abstract

The invention provides a data query method and system for identity authentication and authorization certificate, the method and system comprising: receiving an authorization request sent by a data owner; authenticating the identity of the data owner; and determining the identity of the data owner After the authentication, the authorization certificate is generated according to the authorization request of the data owner; and the generated authorization certificate is sent to the data owner to enable the data owner to provide the generated authorization certificate to the data requester; Receiving the authorization certificate provided by the data requester; authenticating whether the authorization certificate provided by the data requester is valid; and when the authorization certificate provided by the data requester is valid, calculating according to the authorization certificate provided by the data demander Information required by the data requester; the data is sent to the data requester.

Description

Data authentication method and system for identity authentication and authorization certificate

The invention relates to the field of information transmission, in particular to a data query method and system for identity authentication and authorization certificate.

In the prior art, most of the data inquiry and auditing adopts the method of directly reviewing the original document, and the data owner directly provides the data to the data demanding party. This kind of information transmission method is inefficient, and the manual query is used from the authorization query to the transmission file, which is not convenient and not intelligent enough. In addition, the information provided directly by the data owner is also untrue, which will cause problems for the data users.

In view of the above, it is necessary to provide a data query method and system for identity authentication and authorization certificate to obtain more real data, making data query more efficient and intelligent.

A data inquiry system for identity authentication and authorization certificate is applied to a data provider, and the data inquiry system of the identity authentication and authorization certificate communicates with a data owner and a data requester, and the data authentication system for the identity authentication and authorization certificate The method includes: a receiving module, configured to receive an authorization request sent by the data owner; an identity authentication module, configured to authenticate the identity of the data owner; and an authorization certificate generating module, configured to have the data After the identity of the person is authenticated, an authorization certificate is generated according to the authorization request of the data owner; and the sending module is configured to send the generated authorization certificate Giving the data owner to the data owner to provide the generated authorization certificate to the data requester; the receiving module is further configured to receive the authorization certificate provided by the data requester; a certification certification module for authenticating whether the authorization certificate provided by the data requester is valid; and an authorization certification operation module for authorizing the authorization provided by the data requester when the authorization certificate provided by the data requester is valid Proving that the data required by the data requester is calculated; and the sending module is further configured to send the data to the data requester.

A method for querying an identity authentication and authorization certificate for an identity authentication and authorization certificate, the method comprising: a first receiving step of receiving an authorization request sent by the data owner; and an identity authentication step of performing identity of the data owner Authentication; the authorization certification generating step, when the identity of the data owner is authenticated, generating an authorization certificate according to the authorization request of the data owner; the first sending step, sending the generated authorization certificate to the data owner So that the data owner provides the generated authorization certificate to the data requester; the second receiving step receives the authorization certificate provided by the data requester; the authorization certification authentication step, and the certification data requester provides Whether the authorization certificate is valid; the authorization certification operation step, when the authorization certificate provided by the data requester is valid, calculates the information required by the data demander according to the authorization certificate provided by the data requester; and the second The sending step sends the data to the data requester.

Compared with the prior art, the data authentication method for identity authentication and authorization certificate provided by the present invention and the data query method for system identity authentication and authorization certificate can provide a more efficient and more realistic information transmission method. To make data query more intelligent.

11‧‧‧Information provider

2‧‧‧ Data owner

3‧‧‧ data demand side

13‧‧‧Database

10‧‧‧Information authentication system for identity authentication and authorization

101‧‧‧ receiving module

102‧‧‧Authorization certification module

103‧‧‧Authorization certificate generation module

104‧‧‧Transmission module

105‧‧‧Authorization certification computing module

106‧‧‧ identity authentication module

1 is a schematic diagram of an application environment of a preferred embodiment of a method for querying an identity authentication and authorization certificate according to the present invention.

2 is a functional block diagram of a preferred embodiment of a data query system for identity authentication and authorization certificates of the present invention.

3 is a flow chart of a preferred embodiment of the method for querying the identity authentication and authorization certificate of the present invention.

4 is a schematic diagram of a preferred embodiment of the data query system of the identity authentication and authorization certificate of the present invention interacting with the data owner.

FIG. 5 is a schematic diagram of a preferred embodiment of the data query system of the identity authentication and authorization certificate of the present invention interacting with the data requester.

FIG. 6 is a flow chart of a preferred embodiment of the method for querying the identity authentication and authorization certificate of the present invention with Token as the authorization certificate.

FIG. 7 is a schematic diagram of a preferred embodiment of the data query system for authenticating and authenticating the identification and authorization certificate of the present invention with the data owner.

FIG. 8 is a schematic diagram of a preferred embodiment of the data query system for interacting with the data requester with the token authentication and authorization certificate in the present invention.

FIG. 9 is a flow chart of a preferred embodiment of the method for querying the identity authentication and authorization certificate of the present invention using the digital copyright file as an authorization certificate.

FIG. 10 is a schematic diagram of a preferred embodiment of the data query system for interacting with the data owner of the identity authentication and authorization certificate with the digital copyright file as the authorization certificate.

FIG. 11 is a schematic diagram of a preferred embodiment of the data query system for interacting with the data requester of the identity authentication and authorization certificate with the digital copyright file as the authorization certificate.

FIG. 12 is a flow chart of a preferred embodiment of the data query method of the present invention for authenticating and receiving the identity authentication and authorization certificate of the query information.

FIG. 13 is a schematic diagram of a preferred embodiment of the present invention for interacting with a data owner by using a Token as an authorization certificate and receiving an identity authentication and authorization certificate for query information.

FIG. 14 is a schematic diagram of a preferred embodiment of the present invention for interacting with a data requesting party by using a Token as an authorization certificate and receiving an identity authentication and authorization certificate for querying information.

15 is a flow chart of a preferred embodiment of the data query method for authenticating and authenticating the identity verification and authorization certificate of the present invention with the digital copyright file as the authorization certificate.

16 is a schematic diagram of a preferred embodiment of the data query system of the present invention for interacting with a data owner by using a digital copyright file as an authorization certificate and receiving identity verification and authorization certificates for query information.

17 is a schematic diagram of a preferred embodiment of the present invention for interacting with a data requesting party by using a digital copyright file as an authorization certificate and receiving an identity authentication and authorization certificate for querying information.

Referring to FIG. 1 , it is a schematic diagram of an application environment of a preferred embodiment of the method for querying the identity authentication and authorization certificate of the identity authentication and authorization certificate of the present invention. In this embodiment, the data authentication system 10 for the identity authentication and authorization certificate is applied to the data provider 11, and the data provider 11 communicates with the data owner 2 and the data requester 3, respectively.

In this embodiment, the data provider 11 is configured to manage the data of the data owner 2, and the data provider 11 includes, but is not limited to, an accounting, a bank, a financial institution, an upstream accounts receivable vendor, The household office, the hospital, the supplier, the academic research institution, and the like, the present invention does not limit the identity of the data provider 11.

In this embodiment, the data owner 2 is used to provide information, and the data owner 2 includes, but is not limited to, a business, a legal person or an individual.

In this embodiment, the data demander 3 is a party that needs data, and the data demander 3 includes, but is not limited to, an accountant, a bank, a financial institution, a hospital, a supplier, a research institution, a regulatory agency, and the like.

In this embodiment, the data provider 11 is configured to provide an authorization certificate according to the authorization request of the data owner 2, and according to the authorization certificate provided by the data requester 3 and the query information of the data requester 3 In order to authorize the data requester 3 to conduct data inquiry.

The database 13 is in communication connection with the data query system 10 of the identity authentication and authorization certificate. The database 13 stores important data items related to users in various application fields. In this embodiment, the database 13 stores the data items provided by the data owner 2 for the data requester 3 to query the data in the database 13 according to the authorization certificate. The data items include: ledger, deposit and offer amount, transaction time, balance, other transaction records, and the like. In different application fields, the data item may also include assets, debts, medical records, credits, education, and the like. The database 13 also stores materials and the like generated by the material provider 11.

In this embodiment, the identity authentication and authorization certificate data query system 10 can be run in a computer device, which is a device capable of automatically performing numerical calculation and/or information processing according to an instruction set or stored in advance. The hardware includes but is not limited to a microprocessor, an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA), a digital signal processor (DSP), and an embedded Equipment, etc. The computer device includes, but is not limited to, a single network server, a server group composed of a plurality of network servers, or a Cloud Computing-based cloud composed of a large number of hosts or network servers, wherein the cloud computing It is a kind of distributed computing, a super virtual computer composed of a group of loosely coupled computers.

Referring to FIG. 2, it is a functional block diagram of a preferred embodiment of the data query system of the identity authentication and authorization certificate of the present invention. In this embodiment, the data query system 10 of the identity authentication and authorization certificate may be divided into one or more modules. For example, the data query system 10 of the identity authentication and authorization certificate is divided into a receiving module 101, an authorization certificate authentication module 102, and an authorization certificate. The module 103, the transmitting module 104, the authorization certificate computing module 105, and the identity authentication module 106 are generated. The detailed functions of each module will be specifically described later in FIGS. 3 to 17.

Referring to FIG. 3, it is a flow chart of a preferred embodiment of the method for querying the identity authentication and authorization certificate of the present invention. The order of the steps in the flowchart may be changed according to different requirements, and some steps may be omitted or combined.

In step S10, the receiving module 101 receives the authorization request sent by the data owner 2.

In the present embodiment, the data authentication system 10 of the identity authentication and authorization certificate is applied to the data provider 11, and the data provider 11 communicates with the data owner 2.

In this embodiment, the authorization request includes a combination of one or more of the following: an identity certificate of the data owner 2, a name of the data owner 2, an identity certificate of the data requester 3, and a The name of the data requester 3, the scope of the authorization scope, and the like.

The authorization scope condition includes one or more of the following combinations: the querier (data demand side 3), the query validity period, the maximum number of queries that can be queried, the query subject, and the time point of the query subject.

In this embodiment, the data requester 3 is communicatively coupled to the data provider 11.

In step S11, the identity authentication module 106 authenticates the identity of the data owner 2.

In this embodiment, the data owner 2 sends the authorization request to the identity authentication module 106, and the identity certificate of the data owner 2 and the name of the data owner 2 are combined. Sended to the identity authentication module 106.

In this embodiment, the identity authentication module 106 pre-stores the identity certificate of at least one user and the name of at least one user for authenticating the identity of different users.

In this embodiment, after the identity authentication module 106 obtains the identity certificate of the data owner 2 and the name of the data owner 2, the identity certificate of the data owner 2 and the data are obtained. The name of the owner 2 matches the pre-stored identification of the at least one user and the name of the at least one user. When the identity holder 2 has the identity certificate and the data owner 2 When the name matches the pre-stored identity certificate of the at least one user and the name of the at least one user, the identity authentication module 106 confirms that the identity of the material owner 2 is valid; when the data owner When the identity of 2 and the name of the data owner 2 fail to match the pre-stored identity certificate of the at least one user and the name of the at least one user, the identity authentication module 106 confirms the data owner 2's identity is invalid.

Step S12, after the identity of the data owner 2 is authenticated, the authorization certificate generation module 103 generates an authorization certificate according to the authorization request of the data owner 2.

In the present embodiment, the data provider 11 as the manager of the data, after confirming that the identity of the material owner 2 is valid, generates an authorization certificate according to the authorization request of the material owner 2.

In this embodiment, the authorization certificate corresponds to the authorization request, and the authorization certificate generation module 103 determines the authorization range according to the content of the authorization request.

In this embodiment, the authorization certificate includes a combination of one or more of the following:

The identity certificate of the data owner 2, the name of the data owner 2, the identity certificate of the data provider 11, the name of the data provider 11, the identity certificate of the data requester 3, the said The name of the data requester 3, the scope of the authorization scope, and so on.

The authorization scope condition includes one or more of the following combinations: the querier (data demand side 3), the query validity period, the maximum number of queries that can be queried, the query subject, and the time point of the query subject.

In this embodiment, the authorization certificate generation module 103 generates the authorization certificate according to the authorization request of the data owner 2, and includes the following two methods:

(1) The authorization certificate generation module 103 determines an authorization scope according to the authorization request, and generates a file and a set of token Tokens corresponding to the file according to the authorization scope, and stores the file in the data. Within the library 13.

(2) The authorization certificate generation module 103 determines an authorization range according to the authorization request, and generates a digital rights file according to the authorization range.

The token Token is a token used for identity authentication. Different Tokens correspond to different data operations.

The processing method of the digital copyright file includes performing the signature encryption processing of the data provider 11 on the data of the authorization scope content, and attaching the usage rule, so that only the preset user can unlock the password according to the usage rule and by using the password. Information to use the information.

Of course, in other embodiments, the authorization certificate generation module 103 may generate another authorization manner according to the authorization request of the data owner 2, and the present invention does not limit the manner in which the authorization certificate is generated.

In step S13, the sending module 104 sends the generated authorization certificate to the data owner 2 to cause the data owner 2 to provide the generated authorization certificate to the data requester 3.

In the present embodiment, the manner in which the material owner 2 provides the generated authorization certificate to the data requester 3 is not limited. For example, the data owner 2 may provide the generated authorization certificate to the data requester 3 by means of mail, social software, electronic files, or the like.

In step S14, the receiving module 101 receives the authorization certificate provided by the data requester 3.

In this embodiment, after the sending module 104 sends the generated authorization certificate to the data owner 2, the data owner 2 receives the generated authorization certificate, and the generated A certificate of authorization is provided to the data requester 3 . The data requester 3 sends the generated authorization certificate to the data provider 11, and the data provider 11 receives the authorization certificate provided by the data requester 3 through the receiving module 101.

In this embodiment, the receiving module 101 is further configured to receive the query information of the data requester 3.

In this embodiment, the query information includes a range and content of the data requestor 3 that needs to perform query authorization.

In step S15, the authorization certification module 102 authenticates whether the authorization certificate provided by the data requester 3 is valid.

In this embodiment, the authorization certificate authentication module 102 confirms the validity of the authorization certificate provided by the data requester 3 according to the information provided in the authorization certificate provided by the data requester 3.

In this embodiment, the authorization certificate authentication module 102 matches the authorization certificate provided by the data requester 3 with the pre-stored authorization certificate sent to the data owner 2.

When the authorization certificate provided by the data requester 3 completely matches the pre-stored authorization certificate information sent to the data owner 2, the authorization certification module 102 confirms the authorization certificate provided by the data requester 3. Valid; when the authorization certificate provided by the data requester 3 does not completely match the pre-stored authorization certificate information sent to the data owner 2, the authorization certification module 102 confirms that the data requester 3 provides The authorization certificate is invalid.

Specifically, the authorization certification module 102 authenticates the validity of the authorization certificate provided by the data requester 3 according to different forms of the authorization certificate provided by the data demander 3 in the following two specific manners:

(1) When the authorization certificate provided by the data requester 3 is Token, the authorization certification module 102 sends the information in the Token provided by the data requester 3 to the data owner in advance. The information in the Token of 2 is matched; when the information in the Token provided by the data requester 3 completely matches the information stored in the Token sent to the material owner 2 in advance, the authorization certification module Determining that the Token provided by the data demander 3 is valid; when the information in the Token provided by the data requester 3 is pre-stored and sent to the data owner When the information in the Token does not completely match, the authorization certificate authentication module 102 determines that the Token provided by the data requester 3 is invalid.

For example, the authorization certificate authentication module 102 confirms that the token Token corresponds to the database, and the querier represented by the token Token is the data demander 3, whether the query time is valid during the query, and whether the query number has been More than the maximum number of queries can be queried.

(2) When the authorization certificate provided by the data requester 3 is a digital copyright file, the authorization certificate authentication module 102 decrypts the digital copyright file provided by the data requester 3 to obtain the decrypted digital copyright file. And signing the signature of the decrypted digital copyright file as the signature of the data provider 11. When the signature of the decrypted digital copyright file is the signature of the data provider 11, the authorization certification module 102 determines that the digital copyright file provided by the data requester 3 is valid; When the signature of the decrypted digital copyright file is not the signature of the data provider 11, the authorization certification module 102 determines that the digital copyright file provided by the data requester 3 is invalid.

For example, the authorization certificate authentication module 102 confirms whether the querier is the data demander in the digital copyright file, whether the query time is valid during the query, whether the query times have exceeded the maximum number of queries, and the like.

In step S16, when the authorization certificate provided by the data requester 3 is valid, the authorization certification operation module 105 calculates the data required by the data demander 3 according to the authorization certificate provided by the data demander 3.

In this embodiment, the authorization certification operation module 105 calculates the information required by the data requester 3 according to the authorization certificate provided by the data requester 3, including:

(1) When the authorization certificate provided by the data requester 3 is Token, the authorization certification operation module 105 according to the query scope and condition corresponding to the Token provided by the data demander 3 in the database 13 , query the required information.

(2) when the authorization certificate provided by the data requester 3 is a digital copyright file, the authorization certification operation module 105 generates a query scope and conditions corresponding to the digital copyright file provided by the data demander 3, and according to The scope of the digital copyright file is queried and the information required for the conditional inquiry.

Of course, in other embodiments, the authorization certification operation module 105 may perform other methods according to the authorization certificate provided by the data requester 3 to calculate the data required by the data requester 3, and the present invention does not limit.

In step S17, the sending module 104 sends the data to the data requester 3.

In this embodiment, when the receiving module 101 receives the authorization certificate provided by the data requester 3, it also receives the query information of the data requester 3, and the data requester 3 provides When the authorization certificate is valid, the authorization certificate calculation module 105 calculates the data required by the data requester 3 according to the authorization certificate provided by the data requester 3 and the inquiry information.

Specifically, the data query system 10 of the identity authentication and authorization certificate performs the following steps:

(1) When the authorization certificate provided by the data requester 3 is Token, query the query scope and conditions corresponding to the Token provided by the data requester 3 in the database 13, and according to the query information Searching within the query scope and conditions corresponding to the Token provided by the data requester 3, obtaining the retrieved document, and transmitting the retrieved document to the data requester 3.

(2) When the authorization certificate provided by the data requester 3 is a digital copyright file, the search scope and conditions of the digital copyright file provided by the data requester 3 are searched according to the query information, and the retrieved document is obtained. And sending the retrieved document to the data requester 3.

Referring to FIG. 4, it is a schematic diagram of a preferred embodiment of the data query system of the identity authentication and authorization certificate of the present invention interacting with the data owner. The order of the steps in the flowchart may be changed according to different requirements, and some steps may be omitted or combined.

In the present embodiment, the data authentication system 10 of the identity authentication and authorization certificate is applied to the data provider 11, and the data provider 11 communicates with the data owner 2. The data query system 10 of the identity authentication and authorization certificate performs steps S10, S11, S12, and S13 in the process of interacting with the material owner 2. That is, the receiving module 101 receives the authorization request sent by the data owner 2, and the identity authentication module 106 authenticates the identity of the data owner 2. After the identity of the data owner 2 is authenticated, the authorization certificate generation module 103 generates an authorization certificate according to the authorization request of the data owner 2. The sending module 104 sends the generated authorization certificate to the material owner 2 to cause the material owner 2 to provide the generated authorization certificate to the data requester 3.

Referring to FIG. 5, it is a schematic diagram of a preferred embodiment of the data query system of the identity authentication and authorization certificate of the present invention interacting with the data requester. The order of the steps in the flowchart may be changed according to different requirements, and some steps may be omitted or combined.

In the present embodiment, the data authentication system 10 for the identity authentication and authorization certificate is applied to the data provider 11, and the data provider 11 communicates with the data requester 3. The data query system 10 of the identity authentication and authorization certificate performs steps S14, S15, S16, and S17 in the process of interacting with the data requester 3. That is, the receiving module 101 receives the authorization certificate provided by the data requester 3, and the authorization certification module 102 authenticates whether the authorization certificate provided by the data requester 3 is valid, when the authorization certificate provided by the data requester 3 is valid. The authorization verification operation module 105 calculates the data required by the data requester 3 according to the authorization certificate provided by the data requester 3, and the transmission module 104 transmits the data to the data requester.

Referring to FIG. 6, it is a flowchart of a preferred embodiment of the data query method for identity authentication and authorization certificate with Token as the authorization certificate. The order of the steps in the flowchart may be changed according to different requirements, and some steps may be omitted or combined.

In step S20, the receiving module 101 receives an authorization request sent by the data owner 2.

In step S21, the identity authentication module 106 authenticates the identity of the data owner 2.

Step S22, after the identity of the data owner 2 is authenticated, the authorization certificate generation module 103 determines an authorization range according to the authorization request, and generates an archive and a set of files corresponding to the file according to the authorization scope. The token Token stores the file in the database 13.

In this embodiment, the file includes the information requesting system 10 of the identity authentication and authorization certificate, and the data request available from the data owner 2 according to the application scope and the query condition of the authorization certificate. Party 3 to query the information.

In this embodiment, the database 13 stores the query scope and conditions of the data owner 2, and the authorization data generated by the data provider 11.

In this embodiment, the generated Token is unique, that is, in a single authorization process, a unique set of Tokens is generated.

In step S23, the sending module 104 sends the generated Token to the data owner 2 to enable the data owner 2 to provide the generated Token to the data requester 3.

In step S24, the receiving module 101 receives the Token provided by the data requester 3.

In step S25, the authorization certification module 102 authenticates whether the Token provided by the data requester 3 is valid.

In this embodiment, the authorization certificate authentication module 102 matches the information in the Token provided by the data requester 3 with the pre-stored information in the Token sent to the data owner 2; When the information in the Token provided by the data requester 3 and the pre-stored information in the Token sent to the data owner 2 are completely matched, the authorization certification module 102 determines that the Token provided by the data requester is valid; When the information in the Token provided by the data requester 3 does not completely match the pre-stored information in the Token sent to the data owner, the authorization certification module 102 determines the provision provided by the data requester. Token is invalid.

In this embodiment, it should be noted that when the authorization certificate authentication module 102 confirms that the Token provided by the data requester is invalid, the query is terminated.

In step S26, when the Token provided by the data requester 3 is valid, the authorization certification operation module 105 compares the query range and the condition of the Token provided in the database 13 with the data requester 3. Determine the information required for the data requester 3.

In step S27, the sending module 104 sends the data to the data requester 3.

Referring to FIG. 7, it is a schematic diagram of a preferred embodiment of the data query system of the present invention for interacting with the data owner with the identity authentication and authorization certificate of Token as the authorization certificate. The order of the steps in the flowchart may be changed according to different requirements, and some steps may be omitted or combined.

In the present embodiment, the data authentication system 10 of the identity authentication and authorization certificate is applied to the data provider 11, and the data provider 11 communicates with the data owner 2. The data query system 10 of the identity authentication and authorization certificate performs steps S20, S21, S22, and S23 in the process of interacting with the material owner 2. That is, the receiving module 101 receives the authorization request sent by the data owner 2, and the identity authentication module 106 authenticates the identity of the data owner 2. After the identity of the data owner 2 is authenticated, the authorization certificate generation module 103 determines an authorization range according to the authorization request, and generates an archive and a set of token Tokens corresponding to the file according to the authorization scope. The file is stored in the database 13. The sending module 104 sends the generated Token to the data owner 2 to cause the data owner 2 to provide the generated Token to the data requester 3.

Referring to FIG. 8 , it is a schematic diagram of a preferred embodiment of the present invention for interacting with a data requesting party by using a Token as an authentication certificate and an authentication certificate. The order of the steps in the flowchart may be changed according to different requirements, and some steps may be omitted or combined.

In the present embodiment, the data authentication system 10 for the identity authentication and authorization certificate is applied to the data provider 11, and the data provider 11 communicates with the data requester 3. The identity The data inquiry system 10 of the certificate and the authorization certificate executes steps S24, S25, S26, and S27 in the process of interacting with the material demander 3. That is, the receiving module 101 receives the Token provided by the data requester 3, and the authorization certification module 102 authenticates whether the Token provided by the data requester 3 is valid. When the Token provided by the data requester 3 is valid, the data corresponding to the query range and the condition of the Token provided by the data requester 3 in the database 13 of the authorization certification operation module 105 is determined as Information required by the data requester 3. The sending module 104 sends the data to the data requester 3.

Referring to FIG. 9, a flow chart of a preferred embodiment of the data query method for identity authentication and authorization certificate using the digital copyright file as an authorization certificate is shown. The order of the steps in the flowchart may be changed according to different requirements, and some steps may be omitted or combined.

Step S30, the receiving module 101 receives an authorization request sent by the data owner 2.

In step S31, the identity authentication module 106 authenticates the identity of the data owner 2.

Step S32, after the identity of the data owner 2 is authenticated, the authorization certificate generation module 103 determines an authorization scope according to the authorization request, and generates a digital copyright file according to the authorization scope.

In this embodiment, the generated digital copyright file is a signature encrypted file. The data query system 10 of the identity authentication and authorization certificate may decrypt the generated digital copyright file to read the content of the generated digital copyright file.

Step S33, the sending module 104 sends the generated digital copyright file to the data owner 2 to enable the data owner 2 to provide the generated digital copyright file to the data requester 3.

Step S34, the receiving module 101 receives the digital copyright file provided by the data requester 3.

In step S35, the authorization certification module 102 authenticates whether the digital copyright file provided by the data requester 3 is valid.

In this embodiment, the authorization certificate authentication module 102 decrypts the digital copyright file provided by the data requester 3, and decrypts the information contained in the archived file and the pre-stored information to be sent to the data. The information of the digital copyright file of the person 2 is matched; when the information contained in the file after the decryption check is completely matched with the information stored in advance to the digital copyright file of the material owner 2, the authorization certificate is authenticated. The module 102 determines that the digital copyright file provided by the data requester 3 is valid; when the information contained in the decrypted file does not completely match the information stored in advance to the digital copyright file of the data owner 2, The authorization certificate authentication module 102 determines that the digital copyright file provided by the data requester 3 is invalid.

In this embodiment, the decrypted file includes information including the identity certificate of the data owner 2, the name of the data owner 2, the identity certificate of the data provider 11, and the data provider. The name of 11, the identification of the data requester 3, the name of the data requester 3, the scope of the authorization scope, and the like.

The authorization scope condition includes a combination of one or more of the following: a valid period, a maximum number of queries, a time point of querying a subject, a query subject, and the like.

In this embodiment, it should be noted that when the authorization certificate authentication module 102 confirms that the digital copyright file provided by the data requester 3 is invalid, the current query is terminated.

Step S36, when the digital copyright file provided by the data requester 3 is valid, the authorization certification operation module 105 generates the data demander 3 corresponding to the digital copyright file provided by the data requester 3 to read Encrypting the file and determining the encrypted file as the data required by the data requester 3.

In step S37, the sending module 104 sends the data to the data requester 3.

Referring to FIG. 10, it is a schematic diagram of a preferred embodiment of the data query system for interacting with the data owner of the identity authentication and authorization certificate with the digital copyright file as the authorization certificate. The order of the steps in the flowchart may be changed according to different requirements, and some steps may be omitted or combined.

In the present embodiment, the data authentication system 10 of the identity authentication and authorization certificate is applied to the data provider 11, and the data provider 11 communicates with the data owner 2. The data query system 10 of the identity authentication and authorization certificate performs steps S30, S31, S32, and S33 in the process of interacting with the material owner 2. That is, the receiving module 101 receives the authorization request sent by the data owner 2. The identity authentication module 106 authenticates the identity of the data owner 2. After the identity of the data owner 2 is authenticated, the authorization certificate generation module 103 determines an authorization scope according to the authorization request, and generates a digital copyright file according to the authorization scope. The sending module 104 sends the generated digital copyright file to the data owner 2 to enable the data owner 2 to provide the generated digital copyright file to the data requester 3.

Referring to FIG. 11, it is a schematic diagram of a preferred embodiment of the data query system for interacting with the data requester of the present invention with the digital copyright file as the authorization certificate. The order of the steps in the flowchart may be changed according to different requirements, and some steps may be omitted or combined.

In the present embodiment, the data authentication system 10 for the identity authentication and authorization certificate is applied to the data provider 11, and the data provider 11 communicates with the data requester 3. The data query system 10 of the identity authentication and authorization certificate performs steps S34, S35, S36, and S37 in the process of interacting with the data requester 3. That is, the receiving module 101 receives the digital copyright file provided by the data requester 3. The authorization certification module 102 authenticates whether the digital copyright file provided by the data requester 3 is valid. When the digital copyright file provided by the data requester 3 is valid, the authorization certification operation module 105 generates the data corresponding to the digital copyright file provided by the data requester 3. The encrypted file that the demanding party 3 can read and determines the encrypted file as the data required by the data demander 3. The sending module 104 sends the data to the data requester 3.

Referring to FIG. 12, it is a flowchart of a preferred embodiment of the data query method of the present invention for authenticating and receiving the identity authentication and authorization certificate of the query information. The order of the steps in the flowchart may be changed according to different requirements, and some steps may be omitted or combined.

Step S40, the receiving module 101 receives an authorization request sent by the data owner 2.

In step S41, the identity authentication module 106 authenticates the identity of the data owner 2.

Step S42, after the identity of the data owner 2 is authenticated, the authorization certificate generation module 103 determines an authorization scope according to the authorization request, and generates an archive and a set of files corresponding to the file according to the authorization scope. The token Token stores the file in the database 13.

In step S43, the sending module 104 sends the generated Token to the data owner 2 to enable the data owner 2 to provide the generated Token to the data requester 3.

Step S44, the receiving module 101 receives the Token and the query information provided by the data requester 3.

In this embodiment, the query information includes a range and content of the query that the data requester 3 needs to perform.

In step S45, the authorization certification module 102 authenticates whether the Token provided by the data requester 3 is valid.

In this embodiment, it should be noted that when the authorization certificate authentication module 102 confirms that the Token provided by the data requester 3 is invalid, the current query is terminated.

In step S46, when the Token provided by the data requester 3 is valid, the authorization certification operation module 105 queries the database 13 for the Token provided by the data requester 3. The data corresponding to the scope and the condition is searched, and the search information is searched according to the query information and the data corresponding to the query scope and the condition provided by the data requester 3, and the retrieved document is obtained.

Step S47, the sending module 104 sends the retrieved document to the data requester 3.

Referring to FIG. 13, it is a schematic diagram of a preferred embodiment of the present invention for interacting with a data owner by using a Token as an authorization certificate and receiving an identity authentication and authorization certificate for querying information. The order of the steps in the flowchart may be changed according to different requirements, and some steps may be omitted or combined.

In the present embodiment, the data authentication system 10 of the identity authentication and authorization certificate is applied to the data provider 11, and the data provider 11 communicates with the data owner 2. The data query system 10 of the identity authentication and authorization certificate performs steps S40, S41, S42, and S43 in the process of interacting with the material owner 2. That is, the receiving module 101 receives the authorization request sent by the data owner 2. The identity authentication module 106 authenticates the identity of the data owner 2. After the identity of the data owner 2 is authenticated, the authorization certificate generation module 103 determines an authorization range according to the authorization request, and generates an archive and a set of token Tokens corresponding to the file according to the authorization scope. The file is stored in the database 13. The sending module 104 sends the generated Token to the data owner 2 to cause the data owner 2 to provide the generated Token to the data requester 3.

Referring to FIG. 14, it is a schematic diagram of a preferred embodiment of the present invention for interacting with a data requesting party by using a Token as an authorization certificate and receiving an identity authentication and authorization certificate for querying information. The order of the steps in the flowchart may be changed according to different requirements, and some steps may be omitted or combined.

In the present embodiment, the data authentication system 10 for the identity authentication and authorization certificate is applied to the data provider 11, and the data provider 11 communicates with the data requester 3. The identity The data inquiry system 10 of the certificate and the authorization certificate executes steps S44, S45, S46 and S47 in the process of interacting with the material demander 3. That is, the receiving module 101 receives the Token and the query information provided by the data requester 3. The authorization certificate authentication module 102 authenticates whether the Token provided by the data requester 3 is valid. When the Token provided by the data requester 3 is valid, the authorization certification operation module 105 queries the database 13 for the data corresponding to the query scope and condition of the Token provided by the data requester 3, and according to The query information is searched in the data corresponding to the query scope and the condition of the Token provided by the data requester 3, and the retrieved document is obtained. The sending module 104 sends the retrieved document to the data requester 3.

Referring to FIG. 15, a flow chart of a preferred embodiment of the present invention for authenticating a digital copyright file as an authorization certificate and receiving an identity verification and authorization certificate for querying information is shown. The order of the steps in the flowchart may be changed according to different requirements, and some steps may be omitted or combined.

Step S50, the receiving module 101 receives an authorization request sent by the data owner 2.

In step S51, the identity authentication module 106 authenticates the identity of the data owner 2.

Step S52: After the identity of the data owner 2 is authenticated, the authorization certificate generation module 103 determines an authorization scope according to the authorization request, and generates a digital copyright file according to the authorization scope.

Step S53, the sending module 104 sends the generated digital copyright file to the data owner 2 to enable the data owner 2 to provide the generated digital copyright file to the data requester 3.

Step S54, the receiving module 101 receives the digital copyright file and the query information provided by the data requester 3.

Step S55, the authorization certificate authentication module 102 decrypts the digital copyright file provided by the data requester 3, and authenticates whether the digital copyright file provided by the data requester 3 is valid according to the information contained in the file after decryption and verification. .

In this embodiment, it should be noted that when the authorization certificate authentication module 102 confirms that the digital copyright file provided by the data requester 3 is invalid, the current query is terminated.

In step S56, when the digital copyright file provided by the data requester 3 is valid, the authorization certification operation module 105 searches the file after the decryption and verification according to the query information, and obtains the retrieved document. Encrypting the retrieved document.

In step S57, the sending module 104 sends the encrypted retrieved document to the data requester 3.

In this embodiment, the encrypted retrieved document is readable only by the data requester 3.

Referring to FIG. 16, it is a schematic diagram of a preferred embodiment of the present invention for interacting with a data owner by using a digital copyright file as an authorization certificate and receiving an identity authentication and authorization certificate for querying information. The order of the steps in the flowchart may be changed according to different requirements, and some steps may be omitted or combined.

In the present embodiment, the data authentication system 10 of the identity authentication and authorization certificate is applied to the data provider 11, and the data provider 11 communicates with the data owner 2. The data query system 10 of the identity authentication and authorization certificate performs steps S50, S51, S52, and S53 in the process of interacting with the material owner 2. That is, the receiving module 101 receives the authorization request sent by the data owner 2. The identity authentication module 106 authenticates the identity of the data owner 2. After the identity of the data owner 2 is authenticated, the authorization certificate generation module 103 determines an authorization scope according to the authorization request, and generates a digital copyright file according to the authorization scope. The sending module 104 The generated digital copyright file is sent to the material owner 2 to cause the material owner 2 to provide the generated digital copyright file to the material demander 3.

Referring to FIG. 17, it is a schematic diagram of a preferred embodiment of the present invention for interacting with a data requesting party by using a digital copyright file as an authorization certificate and receiving an identity authentication and authorization certificate for querying information. The order of the steps in the flowchart may be changed according to different requirements, and some steps may be omitted or combined.

In the present embodiment, the data authentication system 10 for the identity authentication and authorization certificate is applied to the data provider 11, and the data provider 11 communicates with the data requester 3. The data query system 10 of the identity authentication and authorization certificate performs steps S54, S55, S56, and S57 in the process of interacting with the data requester 3. That is, the receiving module 101 receives the digital copyright file and the query information provided by the data requester 3. The authorization certificate authentication module 102 decrypts the digital copyright file provided by the data requester according to the verification, and authenticates whether the digital copyright file provided by the data requester 3 is valid according to the information contained in the file after the decryption check. When the digital copyright file provided by the data requester 3 is valid, the authorization certification operation module 105 performs a search in the file after the decryption and verification according to the query information, and obtains the retrieved document, and simultaneously The retrieved document is encrypted. The sending module 104 sends the encrypted retrieved document to the data requester 3.

The above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to be limiting, and the present invention will be described in detail with reference to the preferred embodiments. Neither should the spirit and scope of the technical solutions of the present invention be deviated.

In the several embodiments provided by the present invention, it should be understood that the disclosed system, apparatus, and method may be implemented in other manners. For example, the device embodiments described above are merely illustrative. For example, the division of the modules is only a logical function division, and the actual implementation may have another division manner.

The modules described as separate components may or may not be physically separated. The components displayed as modules may or may not be physical units, that is, may be located in one place, or may be distributed to multiple networks. On the unit. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, each functional module in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of hardware plus software function modules.

The above-described integrated unit implemented in the form of a software function module can be stored in a computer readable storage medium. The software function module is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) or a processor to execute various embodiments of the present invention. Part of the steps of the method.

Some computer program product requests in the scope of subsequent patent applications are all computer programs. Based on the flow, it corresponds to the content of the computer program flow in the above flow chart. Therefore, these computer program product requests should be understood as a functional module architecture that implements the foregoing solution mainly through the computer program described in the specification, and should not be construed as a physical device that implements the solution mainly by hardware.

It is apparent to those skilled in the art that the present invention is not limited to the details of the above-described exemplary embodiments, and the present invention can be embodied in other specific forms without departing from the spirit or essential characteristics of the invention. Therefore, the embodiments are to be considered as illustrative and not restrictive, and the scope of the invention is defined by the scope of the appended claims rather than the description All changes that come within the meaning and range of equivalents of the scope of the invention are included in the invention. Any accompanying drawing marks in the scope of the patent application should not be construed as limiting the scope of the patent application involved. In addition, it is to be understood that the word "comprising" does not exclude other elements or steps. system A plurality of units or devices recited in the scope of the claims may also be implemented by a unit or device through software or hardware. Words such as "first" and "second" (if present) are used to denote a name and do not denote any particular order.

It should be noted that the above embodiments are only for explaining the technical solutions of the present invention and are not intended to be limiting, and the present invention will be described in detail with reference to the preferred embodiments. Modifications or equivalents are made without departing from the spirit and scope of the invention.

Claims (19)

A data inquiry system for identity authentication and authorization certificate is applied to a data provider, and the data inquiry system of the identity authentication and authorization certificate communicates with a data owner and a data requester, wherein the identity authentication and authorization certificate information The query system includes: a receiving module, configured to receive an authorization request sent by the data owner; an identity authentication module, configured to authenticate the identity of the data owner; and an authorization certificate generating module, configured to After the identity of the data owner is authenticated, an authorization certificate is generated according to the authorization request of the data owner; and the sending module is configured to send the generated authorization certificate to the data owner to enable the data owner to The generated authorization certificate is provided to the data requesting party; the receiving module is further configured to receive the authorization certificate provided by the data requesting party, wherein the data requesting party provides the authorization certificate to the receiving module Provided by the data owner to the data requester; the authorization certification module is used to authenticate the data requester Whether the authorization certificate is valid; the authorization certification operation module is configured to calculate the information required by the data demander according to the authorization certificate provided by the data requester when the authorization certificate provided by the data requester is valid; And the sending module is further configured to send the data to the data requester. The information inquiry system of the identity authentication and authorization certificate described in claim 1, wherein the authorization certification module authenticates whether the authorization certificate is valid or not: the authorization certificate provided by the data requester and the advance The stored authorization certificate sent to the data owner is matched; when the authorization certificate provided by the data requester completely matches the pre-stored authorization certificate information sent to the data owner, the data requester is confirmed The proof of authorization provided is valid; or When the authorization certificate provided by the data requester does not completely match the pre-stored authorization certificate information sent to the data owner, it is confirmed that the authorization certificate provided by the data requester is invalid. The information inquiry system of the identity authentication and authorization certificate described in claim 1, wherein the data authentication system of the identity authentication and authorization certificate includes a database, and the database stores user-related fields in various fields. The important data item includes one or more of the following combinations: account book, deposit amount and offer amount, transaction time, balance, transaction record, asset data, debt data, medical record data, credit data, and academic data. The information inquiry system of the identity authentication and authorization certificate described in claim 1, wherein the authorization certification generation module is specifically configured to: determine an authorization scope according to the authorization request, and generate an archive according to the authorization scope. And a set of token Token corresponding to the file, storing the file in a database; or determining an authorization scope according to the authorization request, and generating a digital copyright file according to the authorization scope. The information inquiry system of the identity authentication and authorization certificate described in claim 4, wherein the authorization certification module is specifically configured to: when the authorization certificate provided by the data requester is Token, The information in the Token provided by the data requester matches the pre-stored information in the Token sent to the data owner; when the information in the Token provided by the data requester is pre-stored and sent to the data When the information in the Token is completely matched, it is determined that the Token provided by the data requester is valid; when the information in the Token provided by the data requester and the pre-stored information in the Token sent to the data owner are not In the case of a complete match, it is determined that the Token provided by the data requester is invalid; or when the authorization certificate provided by the data requester is a digital copyright file, the digital copyright file provided by the data requester is decrypted, and the decrypted content is obtained. Signature of digital copyright file and verify decryption Whether the signature of the subsequent digital copyright file is a signature of the data provider; and when the signed signature of the decrypted digital copyright file is a signature of the data provider, determining the data The digital copyright file provided by the demanding party is valid; when the signed signature of the decrypted digital copyright file is not the signature of the data provider, it is determined that the digital copyright file provided by the data requester is invalid. The information inquiry system of the identity authentication and authorization certificate described in claim 4, wherein the authorization certification operation module is specifically configured to: when the authorization certificate provided by the data requester is Token, The data in the database corresponding to the scope and condition of the Token provided by the data requester is determined as the data required by the data requester; or when the authorization certificate provided by the data requester is a digital copyright file, Generating a query scope and conditions corresponding to the digital copyright file provided by the data requester, and querying the data required by the data demander according to the query scope and condition of the digital copyright file. The information inquiry system of the identity authentication and authorization certificate described in claim 4, wherein the receiving module is further configured to: receive the query information of the data requester; and the authorization certification operation module, And when the authorization certificate provided by the data requester is valid, calculating the information required by the data demander according to the authorization certificate provided by the data requester and the inquiry information. The information inquiry system of the identity authentication and authorization certificate described in claim 7 , wherein the authorization certification operation module is specifically configured to: when the authorization certificate provided by the data requester is Token, Querying the scope and condition of the query corresponding to the Token provided by the data requester in the database, and searching according to the query information in the query scope and condition corresponding to the Token provided by the data requester to obtain the retrieved document; The sending module sends the retrieved document to the data requester; or when the authorization certificate provided by the data requester is a digital copyright file, according to the query information provided by the data requester The search scope and conditions of the digital copyright file are searched to obtain the retrieved document; the sending module sends the retrieved document to the data requester. The information inquiry system of the identity authentication and authorization certificate according to any one of claims 1 to 8, wherein the authorization certificate includes a combination of one or more of the following: an identity certificate of the data owner; The name of the owner of the data, the identification of the data provider, the name of the data provider, the identification of the data requester, the name of the data requester, the scope of the authorization, the scope of the authorization It includes one or more of the following: valid period, maximum number of queries, time point for querying the subject, and query subject. A data query method for identity authentication and authorization certificate, wherein the method comprises: a first receiving step of receiving an authorization request sent by the data owner; an identity authentication step, authenticating an identity of the data owner; and an authorization certificate a generating step, when the identity of the data owner is authenticated, generating an authorization certificate according to the authorization request of the data owner; the first sending step, sending the generated authorization certificate to the data owner to enable the The data owner provides the generated authorization certificate to the data requester; and the second receiving step receives the authorization certificate provided by the data requester, wherein the data requester provides authorization to the receiving module The proof is provided by the data owner to the data requester; the authorization certification step is to verify whether the authorization certificate provided by the data requester is valid; the authorization certification operation step, when the data requester provides the authorization certificate When valid, calculate the data requester according to the authorization certificate provided by the data requester Information; and The second sending step sends the data to the data requester. The method for querying the identity authentication and authorization certificate according to claim 10, wherein the authorization certification step of authenticating the authorization certificate comprises: authenticating the authorization certificate provided by the data requester with pre-storage The authorization certificate sent to the data owner is matched; when the authorization certificate provided by the data requester completely matches the pre-stored authorization certificate information sent to the data owner, the data requester is confirmed to provide The authorization certificate is valid; or when the authorization certificate provided by the data requester does not completely match the pre-stored authorization certificate information sent to the data owner, it is confirmed that the authorization certificate provided by the data requester is invalid. The method for querying the identity authentication and authorization certificate according to claim 10, wherein the data authentication system for the identity authentication and authorization certificate includes a database, and the database stores user-related fields in various fields. The important data item includes one or more of the following combinations: account book, deposit amount and offer amount, transaction time, balance, transaction record, asset data, debt data, medical record data, credit data, and academic data. The method for querying the identity authentication and authorization certificate according to claim 10, wherein the authorization certification generating step specifically includes: determining an authorization scope according to the authorization request, and generating an archive according to the authorization scope and And the token Token corresponding to the file is stored in the database; or the authorization scope is determined according to the authorization request, and a digital copyright file is generated according to the authorization scope. The method for querying the identity authentication and authorization certificate according to claim 13 of the patent application, wherein the authorization certification step comprises: when the authorization certificate provided by the data requester is Token, the data requirement is The information in the Token provided by the party is compared with the pre-stored information in the Token sent to the data owner. When the information in the Token provided by the data requester completely matches the information stored in the Token of the data owner, the Token provided by the data requester is determined to be valid; When the information in the Token provided by the party does not completely match the pre-stored information in the Token sent to the data owner, it is determined that the Token provided by the data requester is invalid; or when the data requester provides the authorization certificate When the digital copyright file is a digital copyright file, decrypt the digital copyright file provided by the data requester, obtain the signed signature of the decrypted digital copyright file, and verify whether the decrypted digital copyright file signature is provided for the data a signature of the person; when the signature of the decrypted digital copyright file is a signature of the data provider, determining that the digital copyright file provided by the data requester is valid; When the signature of the digital copyright file is not the signature of the data provider, it is determined that the digital copyright file provided by the data requester is invalid. The method for querying the identity authentication and authorization certificate according to claim 13 , wherein the authorization verification operation step specifically includes: when the authorization certificate provided by the data requester is Token, the database is The data corresponding to the scope and condition of the Token provided by the data requester is determined as the data required by the data requester; or when the authorization certificate provided by the data requester is a digital copyright file, a corresponding Querying the scope and conditions of the digital copyright file provided by the data requester, and querying the data required by the data demander according to the scope and conditions of the digital copyright file. The method for querying the identity authentication and authorization certificate according to claim 13 , wherein the receiving step further comprises: receiving the query information of the data requester; and The authorization verification operation step further includes: when the authorization certificate provided by the data requester is valid, calculating the information required by the data demander according to the authorization certificate provided by the data requester and the query information. The method for querying the identity authentication and authorization certificate according to claim 16 , wherein the authorization verification operation step specifically includes: when the authorization certificate provided by the data requester is Token, in the database Querying the scope and condition of the query corresponding to the Token provided by the data requester, and searching according to the query information in the query scope and condition corresponding to the Token provided by the data requester to obtain the retrieved document; Sending, the retrieved document is sent to the data requester; or when the authorization certificate provided by the data requester is a digital copyright file, the digital copyright file provided by the data requester according to the query information Searching within the scope and condition of the query to obtain a retrieved document; the transmitting step, transmitting the retrieved document to the data requester. The method for querying the identity authentication and authorization certificate according to any one of claims 10 to 17, wherein the authorization certificate comprises a combination of one or more of the following: an identity certificate of the data owner The name of the owner of the data, the identification of the data provider, the name of the data provider, the identification of the data requester, the name of the data requester, the scope of the authorization, the scope of the authorization It includes one or more of the following: valid period, maximum number of queries, time point for querying the subject, and query subject. A computer program product, when the computer is loaded into the computer program and executed, the data query method for the identity authentication and authorization certificate described in any one of the patent applications 10 to 18 can be completed.