WO2007051394A1

WO2007051394A1 - Structure and method of realizing privacy protection in mobile application

Info

Publication number: WO2007051394A1
Application number: PCT/CN2006/002726
Authority: WO
Inventors: Lan Chen; Yuanping Zhou
Original assignee: Zte Corporation
Priority date: 2005-11-01
Filing date: 2006-10-17
Publication date: 2007-05-10
Also published as: CN1960559A

Abstract

A structure and method of realizing privacy protection in mobile application. The structure of realizing privacy protection sets distributed layers for the privacy authentication, involves: service authentication layer, providiing the user's privacy control of the specific service, authenticating the validity of the specific service; integrated service authentication layer, providing the user's privacy control relative to user and the usage protocol of the service; user's privacy authentication layer, providing the privacy control of the called user to service supplier and the called user to calling user.

Description

A privacy protection in mobile applications

Architecture and method

TECHNICAL FIELD The present invention relates to mobile communications or, in particular, to privacy protection techniques in mobile communications. BACKGROUND OF THE INVENTION In mobile applications, since the terminal is related to personal information, it is inevitable to involve protection of personal privacy. In a multi-participating mobile application, the system must ensure that either party can protect information related to its privacy, such as location information, in accordance with individual will. The protection of privacy in mobile applications involves two aspects of authentication, including: Question 1: Identification of end users; Question 2: Identification of initiators and originating services. Specifically, question 1: To confirm whether the end user is the user himself or herself; Question 2: To confirm whether the requester of the information and the service used are allowed by the information provider. In the prior art, in order to solve these two problems, the following means are adopted: For the problem 1, a third-party authentication, such as an operator's special service number authentication, needs to be added. Question 1 is a relatively easy problem to solve and will not be repeated here. For question 2, comprehensive control of the calling, called, and using services is required, that is, the calling party can determine whether its own information is used for different called and specific services. As shown in FIG. 1 , the prior art uses a single privacy authentication module, that is, a single module method to solve the problem 2, that is, all privacy-related authentication is processed by one module, and the module needs to solve the increase and deletion of user privacy. , modify, save, need to distinguish each user's trust relationship with different application requesters, applications, application providers, but also need to consider many related factors, such as time period and so on. These relationships become extremely complex due to the diversity of applications. Therefore, the single-module approach leads to the complexity of the privacy authentication module itself, and the efficiency and maintainability are declining. More seriously, the essence of business requirements includes constant The changing factor, the single-module approach can't cope with such rapid changes. At the same time, in multi-party joint development, the single-module coupling is too large, it is difficult to divide, which leads to the progress bottleneck, and neither party can fully understand all the requirements in time. This lag in information can also lead to low development efficiency. SUMMARY OF THE INVENTION The main objective of the present invention is to provide an architecture and method for implementing privacy protection in a mobile application. The single module privacy authentication scheme used in the existing mobile application is poor in maintainability, slow in response, and difficult to jointly develop. Such defects can fully and quickly solve the privacy authentication problem in mobile applications. In order to achieve the above object, according to a first aspect of the present invention, the present invention provides an architecture for implementing privacy protection in a mobile application. The architecture that implements privacy protection performs distributed layer setting on privacy authentication, including: service authentication layer, providing user privacy control policy for specific services; integrated service authentication layer, providing user privacy related to user's service agreement Control policy; user privacy authentication layer, providing the user's privacy control policy for the called party to the service provider and the called user to the calling party. Further, the above three levels can be flexibly configured, and sever in several levels in actual use. Further, when the integrated service authentication is passed, the privacy condition may be considered to be satisfied, and the user privacy authentication layer is skipped. In order to achieve the above object, according to a second aspect of the present invention, the present invention provides a method of implementing privacy protection in a mobile application. The privacy protection method performs distributed processing on the privacy authentication, and the following steps are performed: Step 1: The user initiates the use request; Step 2: The service authentication layer performs the privacy right of the specific service level according to the user's use request. Step 3: The service authentication layer passes the usage request to the integrated service authentication layer. Step 4: The integrated service authentication layer performs the user and service usage agreement level according to the service authentication layer authentication result and the use request. Privacy authentication; Step 5: The user service authentication layer is passed through the use request of the integrated service authentication layer authentication; Step 6: The user privacy authentication layer enters the called user according to the integrated service authentication layer authentication result and the use request. The provider and the called user authenticate the privacy of the calling party; Step 7: Send the relevant service module to the request through the authentication request. Further, the above steps can be flexibly performed, skipping several steps in actual use. Further, when the integrated service authentication is passed, the usage request may be deemed to have met the privacy condition, the user privacy authentication step is skipped, and the related service module is directly sent to perform the service processing. In order to achieve the above object, according to a third aspect of the present invention, the present invention provides a method of implementing privacy protection in a mobile application. The privacy protection method performs distributed processing on the privacy authentication, including the following step stamps: Step 1: The user initiates the use request; Step 2: The service authentication layer performs privacy authentication at the specific service level according to the user's use request; 3: The service authentication layer passes the use request to the user privacy authentication layer; Step 4: The user privacy authentication layer initiates the integrated service authentication, and the integrated service authentication layer according to the service authentication layer authentication result and the use request Perform privacy authentication at the user and service usage protocol level; Step 5: Enter the user privacy authentication layer through the use request of the integrated service authentication layer authentication; Step 6: The user privacy authentication layer is authenticated according to the integrated service authentication layer The result and the use request are used to perform the privacy authentication of the called party to the service provider and the called user to the calling party; Step 7: Send the related service module to the request by using the authentication. Further, the above steps can be flexibly performed, skipping several steps in actual use. Further, when the integrated service authentication is passed, the usage request may be deemed to have met the privacy condition, the user privacy authentication step is skipped, and the related service module is directly sent to perform the service processing. Through the above technical solution, the privacy of the present invention is compared with the existing single module privacy authentication technology. The protection architecture and method adopt a layered mode with clear logic, clear module relationship, high maintainability, and easy development and maintenance. BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are set to illustrate,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, In the drawings: FIG. 1 is a schematic diagram of a prior art single module privacy authentication mode in accordance with the present invention; FIG. 2 is a block diagram of an architecture for implementing privacy protection in a mobile application in accordance with the present invention; FIG. 3 is in accordance with the present invention. A flowchart of a method for implementing privacy protection in a mobile application; FIG. 4 is a flowchart of a method for implementing privacy protection in a mobile application according to the present invention; FIG. 5 is a schematic diagram of a privacy authentication mode according to an embodiment of the present invention; FIG. 7 is a flow chart of a short message manner of a service ordering process according to an embodiment of the present invention; FIG. 8 is a flow chart of a short message mode according to a service usage flow according to an embodiment of the present invention; . DETAILED DESCRIPTION OF THE INVENTION The present invention will be described in detail below with reference to the accompanying drawings. Referring to FIG. 2, the architecture for implementing privacy protection in a mobile application according to the present invention performs distributed layer setting on privacy authentication, including: a service authentication layer, which is used to provide user privacy control of a specific service, and is legal for a specific service. Authentication is performed; the integrated service authentication layer is used to provide user privacy control related to the user's service agreement; and the user privacy authentication layer is used to provide the called user to the service provider and the called user to the calling party. User privacy 4 is empty. The user privacy control performed by the user privacy authentication layer includes access control to any service provider/requester, division of time slots, and notification to the user when the service is in use. When the authentication of the service authentication layer is passed, the authentication of the integrated service authentication layer is entered. When the authentication of the integrated service authentication layer is passed, if it is determined that the privacy condition has been met, then The private protection process is completed, otherwise, the authentication of the user privacy authentication layer is entered. Referring to FIG. 3, a method for implementing privacy protection in a mobile application according to the present invention performs distributed processing on privacy authentication, including the following steps: Step 1: A user initiates a use request; Step 2: A service authentication layer according to a user's use request , performing privacy authentication at a specific service level; Step 3: The use authentication request passed by the service authentication layer is transferred to the integrated service authentication layer; Step 4: The integrated service authentication layer is based on the service authentication layer authentication result and the use request , the user and the business use ten-party level of privacy authentication; Step 5: The comprehensive service authentication layer authentication through the use request is not determined to meet the privacy conditions, enter the user privacy authentication layer; Step six The user privacy authentication layer performs privacy authentication on the calling party to the service provider and the called user according to the authentication result and the use request of the integrated service authentication layer; Step 7: Sending the request by using the authentication Related business module processing. In step 5, if the use request passed by the integrated service authentication layer authentication is determined to have met the privacy condition, the user privacy authentication layer is not authenticated, and the use request is directly sent to the relevant service module for processing. In step 6, the privacy authentication performed by the user privacy authentication layer includes access control for any service provider/excited requester, division of time slots, and notification of the user when the service is used. Referring to FIG. 4, a method for implementing privacy protection in a mobile application according to the present invention performs privacy authentication on distributed processing, including the following steps: Step 1: User initiates a use request; Step 2: The service authentication layer is based on The user's use request, perform privacy authentication at a specific service level; Step 3: The use authentication request passed by the service authentication layer is transferred to the user privacy authentication layer; Step 4: The user privacy authentication layer initiates the integrated service authentication, so that the integrated service authentication layer performs the privacy authentication of the user and the service use protocol level according to the service authentication layer authentication result and the use request; Step 5: Comprehensive service The use request passed by the right layer authentication enters the user privacy authentication layer if it is not determined that the privacy condition has been met; Step 6: The user privacy authentication layer performs the authentication result based on the integrated service authentication layer and the use request. The user is asked to authenticate the privacy of the calling party to the service provider and the called user. Step 7: The request is sent to the relevant service module through the use request of the authentication. In step 5, if the use request passed by the integrated service authentication layer authentication is determined to have met the privacy condition, the user privacy authentication layer is not authenticated, and the use request is directly sent to the relevant service module for processing. In step 6, the privacy authentication performed by the user privacy authentication layer includes access control to any service provider/requester, division of time slots, and notification of the user when the service is in use. The detailed implementation of the present invention will be specifically described below with reference to the accompanying drawings. Because of the variety of business content, the current single-module privacy authentication scheme is increasing in complexity, maintainability is declining, and the response to changes is very slow. In multi-party joint development, task partitioning is also a problem. Due to the multi-faceted nature of privacy authentication, it is necessary to divide and adopt a layered model, so that each role in the system can undertake part of the privacy authentication function to achieve a comprehensive adaptation to a variety of specific needs, and can respond quickly and flexibly. Changes in specific applications. The present invention is directed to a framework mode for comprehensively and quickly solving privacy authentication problems. The present invention provides an architecture for implementing privacy protection in a mobile application, including the following parts: a service authentication layer, providing a user privacy control policy for a specific service; and an integrated service authentication layer providing user privacy related to a service usage agreement of the user Control policy; user privacy authentication layer, providing the user's privacy control policy for the called party to the service provider and the called user to the calling party. The arrangement of the architecture of the present invention is completely different from the prior art. The architectural mode of the present invention fully considers the source of the demand, and the problem is summarized into three levels. The business authentication level is directly related to the business, such as user classification, organizational structure, and this part will be processed first. The first winner of this part of the demand is the service provider. The integrated service authentication level is related to the subscription/use agreement logic. This part is not directly related to privacy, but can be used to make user group mapping. To help users with more detailed privacy authentication at the privacy authentication level, the first to get the demand for this part is the operator. The user privacy authentication layer is the core part of privacy authentication. It provides the most detailed user-to-service provider, called user privacy control policy for the calling party, including access control to any SP/requester, time period. Divide, whether to notify the user when the business is used, this is the last step, its execution logic has a dependency on the results of the first two steps, the first winner of this part of the demand is the business engine. As shown in FIG. 5, it is a schematic diagram of a privacy authentication mode of the present invention. When a user uses a service that requires privacy authentication, the privacy authentication process uses the following mode: First, the user initiates a use request. In the second step, the service authentication layer (SERVICE-AUTH) performs privacy authentication at a specific service level according to the user's use request; and the third step, the service authentication layer passes the use request to the integrated service authentication layer. (INTEGRATED_SERVICE_AUTH); In the fourth step, the integrated service authentication layer performs privacy authentication on the user-service agreement level according to the service authentication layer authentication result and the use request; and the fifth step, the integrated service authentication layer authentication The user request authentication layer (USER_PRIVACY_AUTH) is passed through the use request; in the sixth step, the user privacy authentication layer performs the called user to the service provider and the called user to the main user according to the integrated service authentication layer authentication result and the use request. The privacy authentication of the layer is called; the seventh step is to send the relevant service module to the processing through the use request of the authentication. As shown in FIG. 6 , it is another schematic diagram of the privacy authentication mode of the present invention. When a user uses a service that requires privacy authentication, the privacy authentication process uses the following mode: First, the user initiates the use. In the second step, the service authentication layer performs the privacy response of the specific service level according to the user's use request; the third step, the service authentication layer passes the use request to the user privacy authentication; In the fourth step, the user privacy authentication layer initiates the integrated service authentication, and the integrated service authentication layer performs the privacy authentication of the user and the service use protocol level according to the service authentication layer authentication result and the use request; The authentication request passed by the authentication layer enters the user privacy authentication layer. In the sixth step, the user privacy authentication layer performs the called user to the service provider and the called user to the primary according to the integrated service authentication layer authentication result and the use request. The privacy authentication of the layer is called; the seventh step is to send the relevant service module to the processing through the use request of the authentication. The difference between the two modes shown in Fig. 5 and Fig. 6 is that the initiators of the integrated service rights are different. Figure 5 is directly initiated by the service authentication layer. Figure 6 is initiated by the user privacy authentication layer and can be flexibly selected according to the trust relationship. Authentication related to specific services, such as user grouping, organizational structure, placed in the business authentication layer; authentication related to the user/service usage agreement, such as the matching of the subscription relationship, is implemented in the integrated service authentication layer; The authentication related to the trust relationship between the user/user and the user/service provider is handled in the user privacy authentication layer. At the same time, whether each of these three levels can be flexibly configured at each level, skips several levels in the actual use, and the order of each level in the process can also be adjusted. For example, in some cases, when the integrated service authentication is passed, it can be considered that the privacy condition has been met, so the user privacy authentication level can be skipped, such as finding a friend service in the virtual community, when the two parties pass the business authentication and integrated service. After authentication, they can be considered to be mutual trust, and the business can be executed immediately without having to authenticate the user. The following is a detailed description of the implementation of the technical solution by referring to two specific service cases in conjunction with FIG. 7 and FIG. 8. The modes adopted by the two embodiments are embodied in the manner described in FIG. 6, because the integrated service authentication in the existing network. There is a trust relationship with user privacy authentication, but no trust for business authentication.

[First Embodiment] The characteristics of the dating application of the virtual community: The users in the community trust each other, and the mutual relationship is controlled by the business authentication layer, and the user privacy authentication layer is not strictly restricted. Solution implementation: In the integrated service authentication layer, an attribute flag is added to the positioning service to indicate whether it is a community application. When the service is applied, the SP (service provider) needs to add an attribute of the service to indicate whether the service is a community class. Business, this property will be stored in the database. During the ordering and use process, the integrated service authentication layer returns the authentication result to the user privacy authentication layer by judging this attribute, and the user privacy authentication layer no longer performs privacy authentication on the community type service. 7 is a flow chart of a short message method in a service ordering process of the first embodiment, and the main steps include:

1. The user sends a subscription request to the integrated service authentication layer;

2. The integrated service authentication layer determines whether the request is a community-based service;

3. If the integrated service authentication layer returns successfully, the subscription relationship is generated. In the normal case, when the location service is ordered, the user privacy authentication layer is required to determine whether there is a trust relationship between the master and the called party, so as to ensure that the user privacy authentication can be passed during use, but in this application. Because the users in the same community have mutual trust relationship, it is not necessary to do user privacy authentication, so you can skip this step. 8 is a flow chart of a short message method in a service usage flow according to the first embodiment. When the service authentication layer sends a location request to the user privacy authentication layer, the user privacy authentication layer sends an authentication request to the integrated service authentication layer. The integrated service authentication layer discriminates the user subscription relationship. The main steps include:

1. The user issues a usage request;

2. The service authentication layer performs service-related privacy authentication on the user request;

3. After the authentication of the service authentication layer is passed, the user will be sent a privacy authentication layer;

4. The user privacy authentication layer forwards the request to the integrated service authentication layer (transferred from the user privacy authentication layer because the service authentication layer is not trusted);

5. The integrated service authentication layer determines whether the service is a community service according to the service ID in the request sent by the user privacy authentication layer, and if so, whether the calling user and the called user both subscribe to the service, and then to the user. The privacy authentication layer sends the discriminating result;

6. After the user privacy authentication layer obtains the authentication result of the integrated service authentication layer, according to the service genus Sexually decide whether to perform user privacy authentication. If it is a community-based service and the integrated service authentication layer is successfully authenticated, the user privacy authentication layer is skipped and the positioning process is directly entered.

[Second example] Enterprise positioning application demand characteristics of vehicle usage: The users in the enterprise application trust each other, and the relationship is controlled by the business authentication layer, but the application is related to time, and the user privacy authentication during working hours is not restricted; User privacy authentication remains valid for the rest of the period. Specific implementation process Under the mouth: Preconditions:

1. The service authentication layer implements a set of user management logic and user authentication procedures;

2. The integrated business authentication layer 4 generates the ordering relationship for the application for the enterprise;

3. The business authentication layer establishes a set of user information and sets logical relationships for the enterprise. Privacy authentication execution steps:

1. The user authentication request is processed by the service authentication layer according to the user authentication of the application;

2. If the service authentication passes, send a user location request to the user privacy authentication layer;

3. The user privacy authentication layer sends an authentication request to the integrated service authentication layer, and the integrated service authentication layer authenticates the subscription relationship between the calling party and the service (the service type must be 'enterprise application, and both the calling and the called are ordered. This business can only be passed);

4. The user privacy authentication layer ^ ^ judges whether the enterprise application is based on the authentication result of the integrated service authentication layer. If the authentication result is determined to be an enterprise application and the application is configured not to the user privacy authentication layer privacy authentication, the positioning is immediately started. If the authentication result is determined to be an enterprise application and the application is configured to perform user privacy authentication layer privacy authentication, it is determined whether to start the positioning process according to the user privacy authentication result. Compared with the existing single-module technology, the layered mode of the present invention is much clearer in logic, the complexity of the module is greatly reduced, the maintainability is improved, and the requirements can be clearly defined due to the clear structure. Implementation, improved development efficiency and code stability. At the same time, when multi-party cooperation is developed, the layered method is easy to realize task division and realize parallel development. Now the guarantee of progress. The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

Claims An architecture for implementing privacy protection in a mobile application, characterized in that the distributed level setting of privacy authentication comprises:

The service authentication layer is used to provide user privacy control for specific services, and to authenticate the legality of specific services;

An integrated service authentication layer for providing user privacy control related to the user's usage agreement;

The user privacy authentication layer is configured to provide user privacy control of the called user to the service provider and the called user. The architecture according to claim 1, wherein the user privacy control performed by the user privacy authentication layer includes access control to any service provider/requestor, time division, and whether the service is in use. Notify the user. The architecture according to claim 1, wherein when the authentication of the service authentication layer passes, the authentication of the integrated service authentication layer is entered. The architecture according to claim 1 or 3, wherein when the authentication of the integrated service authentication layer is passed, if the privacy condition is determined to have been met, the privacy protection process is completed, otherwise, the user privacy policy is entered. Authorization of the right level. A method for implementing privacy protection in a mobile application, characterized in that distributed processing of privacy authentication includes the following steps:

Step 1: The user initiates a use request;

Step 2: The service authentication layer performs privacy authentication at a specific service level according to the usage request of the user;

Step 3: The use request that is passed by the service authentication layer is transferred to the integrated service authentication layer;

Step 4: The integrated service authentication layer 4 performs privacy authentication on the user-service agreement level according to the service authentication layer authentication result and the use request.

Step 5: The use request of the comprehensive service authentication layer authentication is not If it is determined that the privacy condition has been met, the user privacy authentication layer is entered; Step 6: The user privacy authentication layer performs the called user according to the integrated service authentication layer authentication result and the use request. Privacy authentication of the calling party to the service provider and the called party;

Step 7: The related service module is processed by the use request of the authentication.

The method according to claim 5, wherein in step 5, if the usage request passed by the integrated service authentication layer authentication is determined to have met a privacy condition, the user privacy is not performed. The authentication of the authentication layer directly sends the use request to the relevant service module for processing.

The method according to claim 5, wherein in step 6, the privacy authentication performed by the user privacy authentication layer includes access control to any service provider/requester, time division, Whether to notify the user when the business is in use.

A method for implementing privacy protection in a mobile application, characterized in that distributed processing of privacy authentication includes the following steps:

Step 1: The user initiates a use request;

Step 3: The use request that is passed by the service authentication layer is forwarded to the user privacy authentication layer;

Step 4: The user privacy authentication layer initiates the integrated service authentication, so that the integrated service authentication layer performs the privacy authentication of the user and the service use protocol level according to the service authentication layer authentication result and the use request.

Step 5: The use request that is passed by the integrated service authentication layer authentication enters the user privacy authentication layer if it is not determined that the privacy condition has been met;

Step 6: The user privacy authentication layer performs privacy authentication on the calling party to the service provider and the called user according to the integrated service authentication layer authentication result and the use request.

Step 7: The related service module is processed by the use request for authentication.

The method according to claim 8, wherein in step 5, if the usage request passed by the integrated service authentication layer authentication is determined to have met a privacy condition, the user privacy is not performed. The authentication of the authentication layer directly sends the use request to the relevant service module for processing.

10. The method according to claim 8, wherein in step 6, the privacy authentication performed by the user privacy authentication layer includes access control, time period of any service provider/requester Divide, notify the user when the business is in use.