Method, apparatus and system for providing user data

Abstract

Embodiments of the present specification disclose a method and device for providing user data. The method can be applied to a terminal device on the user side, and includes: receiving a data acquisition request sent by a data platform; wherein the data acquisition request carries a user data identifier required by a data use system, and a first public key corresponding to the data use system; performing calculation by using a second private key corresponding to the user and the first public key obtained from the data acquisition request to obtain an authorization key; and sending the authorization key to the data platform. Embodiments of the present specification can more efficiently provide user data to various data use systems.

Description

Technical Field

[0001] This specification relates to network communication technology in one or more embodiments, and more particularly to methods, apparatus and systems for providing user data. Background Technology

[0002] With the continuous development of Internet technology and big data technology, various data usage systems in various business scenarios need to use relevant user data.

[0003] See Figure 1 Different types of user data are stored and provided by different data providing systems. For example, a user's educational background information is provided by data providing system 1, their ID card information by data providing system 2, their disability information by data providing system 3, their transaction information by data providing system 4, and so on. Thus, in existing technology, see [reference needed] Figure 1 When a data-using system, such as data-using system 1, needs to obtain one type of user data, data-using system 1 needs to interface with a data-providing system, such as data-providing system 3, that provides that type of user data, and obtain the corresponding user data. When data-using system 1 needs to obtain another type of user data, data-using system 1 needs to interface with a data-providing system, such as data-providing system 1, that provides that other type of user data, and obtain the corresponding user data.

[0004] It is evident that in existing technologies, if n data-using systems need to obtain various user data from m data-providing systems, m*n connections are required, resulting in low efficiency in providing user data. Summary of the Invention

[0005] This specification describes one or more embodiments of methods, apparatuses, and systems for providing user data, which can improve the efficiency of providing user data to data-using systems.

[0006] According to the first aspect, a method for providing user data is provided, the method being applied to a user-side terminal device, comprising:

[0007] Receive data acquisition requests from the data platform; the data acquisition request carries the user data identifier required by the data usage system and the first public key corresponding to the data usage system;

[0008] The authorization key is calculated using the second private key corresponding to the user and the first public key obtained from the data acquisition request;

[0009] Send the authorization key to the data platform.

[0010] The user data refers to user data that has been signed by the data providing system.

[0011] Before receiving the data acquisition request from the data platform, the process further includes: acquiring various types of user data of the user from each data providing system; encrypting each type of user data using the second public key corresponding to the user; and sending each type of encrypted user data to the data platform.

[0012] or,

[0013] After receiving the data acquisition request from the data platform, the process further includes: acquiring user data from a data provider system that provides user data of the corresponding type, based on the user data identifier carried in the data acquisition request; encrypting the acquired user data using the second public key corresponding to the user; and sending the encrypted user data to the data platform.

[0014] The process further includes, after receiving the data acquisition request from the data platform and before calculating the authorization key using the user's second private key and the first public key obtained from the data acquisition request:

[0015] Initiate an authorization request to the user, which includes an identifier of the user data that the data-using system needs to access;

[0016] Determine whether the user's authorization consent instruction has been received. If so, continue with the step of calculating the authorization key using the user's second private key and the first public key obtained from the data acquisition request.

[0017] Based on the second aspect, a method for providing user data is proposed, which is applied to a data platform and includes:

[0018] The system receives user data requests from the data usage system; these requests include the user data identifier required by the data usage system, the first public key corresponding to the data usage system, and callback interface information.

[0019] A data acquisition request is generated based on the received user data request and sent to the user's terminal device; the data acquisition request carries the identifier of the user data that the data use system needs to use and the first public key corresponding to the data use system;

[0020] Based on the identifier of the user data carried in the user data application, the user data is obtained after being encrypted using the second public key corresponding to the user.

[0021] Receive the authorization key sent by the terminal device;

[0022] Using the authorized key, the first public key, and the second public key to encrypt the user data, we obtain the user data encrypted with the first public key;

[0023] Using the callback interface information carried in the user data application, the user data encrypted with the first public key is sent to the data usage system.

[0024] Before receiving the user data request from the system, the method further includes: receiving and storing various types of user data encrypted using the second public key corresponding to the user from the terminal device; correspondingly, obtaining the user data encrypted using the second public key corresponding to the user based on the user data identifier carried in the user data request includes: obtaining the user data encrypted using the second public key corresponding to the user, corresponding to the user data identifier, from the pre-stored encrypted user data of various types;

[0025] or,

[0026] The step of obtaining the user data encrypted with the second public key corresponding to the user based on the user data identifier carried in the user data application includes: receiving the user data encrypted with the second public key corresponding to the user, which corresponds to the user data identifier, sent by the terminal device.

[0027] According to the third aspect, a method for providing user data is proposed, which is applied to a data providing system, including:

[0028] Receive user data download requests from user's terminal device, which carry the user identifier.

[0029] Based on the user identifier, the user data of the user is obtained;

[0030] The obtained user data is sent to the terminal device.

[0031] Based on the fourth aspect, a method for providing user data is proposed, which is applied to a data usage system, including:

[0032] Send a user data request to the data platform; the user data request includes the user data identifier required by the data use system, the first public key corresponding to the data use system, and callback interface information;

[0033] Receive user data encrypted using the first public key from the data platform;

[0034] The user data is decrypted using the system's corresponding first private key.

[0035] The user data includes the data provider's signature information;

[0036] After decrypting the user data using the system's corresponding first private key, the process further includes: verifying the signature of the user data.

[0037] According to the fifth aspect, an apparatus for providing user data is proposed, which is applied to a user-side terminal device, comprising:

[0038] The request receiving module is configured to receive data acquisition requests sent by the data platform; wherein, the data acquisition request carries the user data identifier required by the data use system and the first public key corresponding to the data use system;

[0039] The authorization key calculation module is configured to calculate the authorization key using the second private key corresponding to the user and the first public key obtained from the data acquisition request.

[0040] The key sending module is configured to send the authorization key to the data platform.

[0041] According to the sixth aspect, an apparatus for providing user data is proposed, which is applied to a data platform and includes:

[0042] The first interface module is configured to receive user data requests sent by the data usage system; wherein, the user data request carries the user data identifier required by the data usage system, the first public key corresponding to the data usage system, and callback interface information;

[0043] The second interface processing module is configured to generate a data acquisition request based on the received user data application and send it to the user's terminal device; wherein, the data acquisition request carries the identifier of the user data that the data use system needs to use and the first public key corresponding to the data use system;

[0044] The re-encryption processing module is configured to obtain user data encrypted using the second public key corresponding to the user based on the identifier of the user data carried in the user data application; receive the authorization key sent by the terminal device; and obtain user data encrypted using the first public key using the authorization key, the first public key, and the second public key.

[0045] The third interface module is configured to use the callback interface information carried in the user data application to send the user data encrypted with the first public key to the data usage system.

[0046] According to the seventh aspect, an apparatus for providing user data is proposed, the apparatus being applied to a data providing system, comprising:

[0047] The download request receiving module is configured to receive user data download requests sent by the user's terminal device, and the user data request carries the user's identifier.

[0048] The data determination module is configured to obtain the user's user data based on the user's identifier;

[0049] The data sending module is configured to send the received user data to the terminal device.

[0050] According to the eighth aspect, an apparatus for providing user data is proposed, which is applied to a data usage system, comprising:

[0051] The data request module is configured to send a user data request to the data platform; the user data request carries the user data identifier required by the data usage system, the first public key corresponding to the data usage system, and callback interface information.

[0052] The data receiving module is configured to receive user data encrypted using the first public key sent by the data platform;

[0053] The decryption module is configured to use the system's corresponding first private key to decrypt user data.

[0054] According to the ninth aspect, a system for providing user data is proposed, the system including means for providing user data applied in a terminal device according to the embodiments of this specification, means for providing user data applied in a data platform according to the embodiments of this specification, means for providing user data applied in a data providing system according to the embodiments of this specification, and means for providing user data applied in a data usage system according to the embodiments of this specification.

[0055] According to a tenth aspect, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method described in any embodiment of this specification.

[0056] The methods and apparatus for providing user data provided in the embodiments of this specification, individually or in combination, have at least the following beneficial effects:

[0057] 1. In the embodiments of this specification, the overall user data connection efficiency becomes m+n. Compared to the connection efficiency of m*n in the prior art, the method of this embodiment significantly reduces the number of connections. Furthermore, the larger the number of data providing systems m and the number of data using systems n, the greater the difference in connection efficiency between this embodiment and the prior art. Therefore, the method of this embodiment can accelerate the flow of user data and reduce problems such as complex interface protocols and excessive network transmission resource consumption caused by excessive connections.

[0058] 2. In one embodiment of this specification, the user can control their own user data, and the system can require the user to authorize the use of the user's data whenever it needs to use the user's data; otherwise, the user's user data cannot be used.

[0059] 3. The data-using system can verify the signature of the data-providing system to determine whether the user data sent by the data platform has been tampered with, thus ensuring the trustworthiness of the user data. Attached Figure Description

[0060] To more clearly illustrate the technical solutions in the embodiments or prior art of this specification, the drawings used in the description of the embodiments or prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0061] Figure 1 This is a schematic diagram of a system that provides user data in the existing technology.

[0062] Figure 2 This is a schematic diagram of the system architecture used in one embodiment of this specification.

[0063] Figure 3 This is a flowchart illustrating an embodiment of the method for providing user data in a user's terminal device.

[0064] Figure 4 This is a flowchart illustrating an embodiment of the method for providing user data in a data platform.

[0065] Figure 5 This is a flowchart illustrating an embodiment of a method for providing user data in a data providing system.

[0066] Figure 6 This is a flowchart illustrating an embodiment of the method for providing user data in a data usage system.

[0067] Figure 7 This is a flowchart of a method for a terminal device and a data platform to obtain various user data from a data providing system in advance, according to one embodiment of this specification.

[0068] Figure 8 This is a flowchart illustrating a method for providing user data implemented through cooperation among various parties in one embodiment of this specification.

[0069] Figure 9 This is a schematic diagram of a device for providing user data in a terminal device according to one embodiment of this specification.

[0070] Figure 10 This is a schematic diagram of a device for providing user data in a data platform, as described in one embodiment of this specification.

[0071] Figure 11 This is a schematic diagram of a device for providing user data in a data providing system according to one embodiment of this specification.

[0072] Figure 12 This is a schematic diagram of a device for providing user data applied in a data usage system according to one embodiment of this specification. Detailed Implementation

[0073] The solution provided in this specification will now be described with reference to the accompanying drawings.

[0074] First, it should be noted that the terminology used in the embodiments of this invention is for the purpose of describing specific embodiments only and is not intended to limit the invention. The singular forms “a,” “the,” and “the” used in the embodiments of this invention and the appended claims are also intended to include the plural forms, unless the context clearly indicates otherwise.

[0075] It should be understood that the term "and / or" used in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0076] To facilitate understanding of the methods provided in this manual, the system architecture involved and applicable to this manual is first described. For example... Figure 2 As shown, the system architecture mainly includes four types of network nodes: user-side terminal equipment, data platform, at least one data providing system, and at least one data using system.

[0077] It should be understood that Figure 2 The number of terminal devices, data platforms, data providing systems, and data using systems shown is merely illustrative. Any number can be selected and deployed as needed.

[0078] Terminal devices, data platforms, data provision systems, and data usage systems work together to efficiently acquire various types of user data. The following describes different methods for providing user data implemented in terminal devices, data platforms, data provision systems, and data usage systems, respectively, through different embodiments.

[0079] Figure 3This is a flowchart illustrating one embodiment of a method for providing user data in a user's terminal device. It is understood that this method can also be executed by any device, apparatus, platform, or cluster of devices with computing and processing capabilities. See also... Figure 2 , Figure 3 The method includes:

[0080] Step 301: The terminal device receives a data acquisition request from the data platform; wherein, the data acquisition request carries the user data identifier required by the data use system and the public key (referred to as the first public key) corresponding to the data use system.

[0081] Step 303: The terminal device uses the user's corresponding private key (referred to as the second private key) and the first public key obtained from the data acquisition request to calculate and obtain the authorization key.

[0082] Step 305: The terminal device sends the authorization key to the data platform.

[0083] Figure 4 This is a flowchart illustrating one embodiment of a method for providing user data in a data platform, as described in this specification. It is understood that this method can also be executed by any device, apparatus, platform, or cluster of devices with computing and processing capabilities. See also... Figure 2 , Figure 4 The method includes:

[0084] Step 401: The data platform receives a user data request from the data usage system; the user data request carries the user data identifier required by the data usage system, the first public key corresponding to the data usage system, and callback interface information.

[0085] Step 403: The data platform generates a data acquisition request based on the received user data application and sends it to the user's terminal device; wherein, the data acquisition request carries the identifier of the user data required by the data use system and the first public key corresponding to the data use system.

[0086] Step 405: The data platform obtains the user data encrypted using the user's corresponding public key (referred to as the second public key) based on the identifier of the user data carried in the user data application.

[0087] Step 407: The data platform receives the authorization key sent by the terminal device.

[0088] Step 409: The data platform uses the authorized key, the first public key, and the second public key to encrypt the user data, and obtains the user data encrypted with the first public key.

[0089] Step 411: The data platform uses the callback interface information carried in the user data application to send the user data encrypted with the first public key to the data usage system.

[0090] Figure 5 This is a flowchart illustrating one embodiment of a method for providing user data in a data provision system according to this specification. It is understood that this method can also be executed by any device, apparatus, platform, or cluster of devices with computing and processing capabilities. See also... Figure 2 , Figure 5 The method includes:

[0091] Step 501: The data providing system receives a user data download request from the user's terminal device, and the user data download request carries the user identifier.

[0092] Step 503: The data providing system obtains the user data stored in its own database based on the user identifier.

[0093] Step 505: The data providing system sends the obtained user data to the terminal device.

[0094] Figure 6 This is a flowchart illustrating one embodiment of a method for providing user data in a data usage system according to this specification. It is understood that this method can also be executed by any device, apparatus, platform, or cluster of devices with computing and processing capabilities. See also... Figure 2 , Figure 6 The method includes:

[0095] Step 601: The data-using system sends a user data request to the data platform; wherein, the user data request carries the user data identifier that the data-using system needs to use, the first public key corresponding to the data-using system, and callback interface information.

[0096] Step 603: The data usage system receives user data encrypted with the first public key from the data platform.

[0097] Step 605: The data usage system uses the corresponding private key (called the first private key) to decrypt the user data.

[0098] See Figures 1 to 6To efficiently provide various user data to various data-using systems, compared to the system architecture of existing technologies, the system architecture of this specification's embodiments adds user-side terminal devices and a pre-set data platform. That is, the user data provision process involves not only the processing of the data-using system and the data-providing system, but also the processing of the user-side terminal devices and the pre-set data platform. In this specification's embodiments, the data-using system no longer directly interacts with the data-providing system to obtain user data. All data-providing systems directly provide various types of user data to the user's terminal device. Subsequently, when a data-using system needs to use a particular type of user data, it submits the data to that data-using system through the user's terminal device and the data platform. Therefore, for a single set of user data, the data-providing system only needs to provide the user data to the user's terminal device once, i.e., it only needs to interface with the terminal device once and provide the data once, instead of requiring the data-providing system to interface with and provide the data n times for n data-using systems as in existing technologies. In the embodiments of this specification, all n data-using systems can directly interface with the data platform and obtain user data. Therefore, the overall user data interface efficiency becomes m+n, which is significantly less than the existing interface efficiency of m*n. Furthermore, the larger the number of data-providing systems (m) and the number of data-using systems (n), the greater the difference in interface efficiency between this embodiment and existing technologies. Thus, the method of this embodiment can accelerate the flow of user data and reduce problems such as complex interface protocols and excessive network transmission resource consumption caused by excessive interfaces.

[0099] In the embodiments of this specification, user data can be any kind of user-related data, such as the user's ID card, academic certificate, historical transaction records, and the user's past outings.

[0100] In actual business implementation, user terminal devices can obtain user data in the following two ways:

[0101] Method 1: Before providing user data to various data-using systems, the terminal device pre-obtains various types of user data from each data-providing system and sends them to the data platform for storage.

[0102] In one embodiment of this specification, see [reference needed]. Figure 7 The specific implementation process of this method one includes:

[0103] Step 701: Before receiving a data acquisition request from the data platform, the user-side terminal device sends a user data download request carrying the user identifier to each data providing system.

[0104] Step 703: After receiving a user data download request from a user's terminal device, each data providing system obtains a type of user data corresponding to that user identifier based on the user identifier, and sends the obtained user data of that type to the terminal device.

[0105] Step 705: The terminal device receives various types of user data from each data providing system; it encrypts each type of user data using the user's second public key, and sends each type of encrypted user data to the data platform.

[0106] Step 707: Before receiving the user data request from the data usage system, the data usage system receives and saves various types of user data encrypted using the user's corresponding second public key from the terminal device.

[0107] For example, user A's terminal device obtains user A's educational background information from data provider system 1, user A's ID card information from data provider system 2, user A's disability certificate information from data provider system 3, and user A's historical transaction information from data provider system 4. The terminal device uses user A's public key A to encrypt each type of user information individually, and sends each encrypted type of user data to the data platform. In this way, the data platform stores various encrypted user data of user A, such as educational background information encrypted with public key A, ID card information encrypted with public key A, disability information encrypted with public key A, and historical transaction information encrypted with public key A.

[0108] Method 2: When a data-using system needs a type of user data, such as type 1, the terminal device, after receiving a data acquisition request from the data platform, retrieves the type 1 user data from the corresponding data-providing system and sends it to the data platform.

[0109] The following describes the method for providing user data in this specification, using specific embodiments and taking the first method described above as an example. See also... Figure 8 In one embodiment of this specification, the method for providing user data includes:

[0110] Step 801: The data-using system sends a user data request to the data platform; the user data request carries the user data identifier that the data-using system needs to use, the data-using system's own first public key, and callback interface information.

[0111] As can be seen, in the embodiments of this specification, the data-using system does not send a user data request to the data-providing system to obtain the corresponding user data, but rather sends a user data request to the data platform to obtain the corresponding user data.

[0112] Step 803: The data platform generates a data acquisition request based on the received user data application and sends it to the user's terminal device; wherein, the data acquisition request carries the identifier of the user data required by the data use system and the first public key corresponding to the data use system.

[0113] Step 805: The terminal device initiates an authorization request to the user, which carries an identifier of the user data that the data usage system needs to use. For example, the identifier of the user data indicates that the user's ID card information is required.

[0114] Step 807: The terminal device determines whether it has received the user's authorization consent instruction. If yes, proceed to step 809; otherwise, end the current process. Figure 8 The process is shown below.

[0115] In existing technologies, user data, such as academic certificates, is directly exchanged between the data providing system and the data using system without the user's consent. Therefore, users have no control over their own user data. However, in one embodiment of this specification, users can control their own user data. Through the processing in steps 805 and 807 above, it can be ensured that whenever a data using system needs to use a user's data, the user must authorize it; otherwise, the user's user data cannot be used.

[0116] It should be noted that if the user's terminal device and data platform are to obtain the user's data using the second method described above, then after executing step 807 and before executing step 809, the process further includes: the terminal device obtaining the user data from the data provider system that provides the corresponding type of user data based on the user data identifier carried in the data acquisition request; encrypting the obtained user data using the user's corresponding second public key; and sending the encrypted user data to the data platform. Furthermore, if the second method is used, step 813 is not required.

[0117] Step 809: The terminal device uses the user's second private key and the first public key obtained from the data acquisition request to perform irreversible computation to obtain the authorization key.

[0118] Step 811: The terminal device sends the authorization key to the data platform.

[0119] Step 813: The data platform obtains the user data corresponding to the user data identifier carried in the user data application from the various types of user data of the user that are stored in advance, and the user data is encrypted with the second public key.

[0120] Step 815: The data platform uses the authorized key, the first public key, and the second public key to encrypt the user data, and obtains the user data encrypted with the first public key.

[0121] In steps 809 and 815 above, Proxy Re-Encryption (PRE) technology is used. The data platform can convert user data encrypted with the second public key of the terminal device into ciphertext that can be decrypted using the system's first private key, thereby achieving password sharing. The data platform transfers the key from one entity corresponding to a public key to another entity corresponding to a different public key without knowing the key content.

[0122] Step 817: The data platform uses the callback interface information carried in the user data application to send the user data encrypted with the first public key to the data usage system.

[0123] Step 819: The data usage system uses the first private key corresponding to the data usage system to decrypt the received encrypted user data and extract the user data.

[0124] Step 821: The data usage system performs signature verification on the user data.

[0125] To enhance security, the data providing system can sign each piece of user data provided to the terminal device. Therefore, the signature verification process in step 821 can be performed. If the verification is successful, it means that the user data has not been tampered with, and the data user system can be used with confidence.

[0126] In one embodiment of this specification, an apparatus for providing user data is provided, which is applied to a user-side terminal device. See [link to relevant documentation]. Figure 9 The device includes:

[0127] The request receiving module 901 is configured to receive data acquisition requests sent by the data platform; wherein, the data acquisition request carries the user data identifier required by the data use system and the first public key corresponding to the data use system;

[0128] The authorization key calculation module 902 is configured to calculate the authorization key using the second private key corresponding to the user and the first public key obtained from the data acquisition request.

[0129] The key sending module 903 is configured to send the authorization key to the data platform.

[0130] In the embodiments of the device described in this specification, the user data obtained by the terminal device is user data that has been signed by the data providing system.

[0131] exist Figure 9 In the embodiment of the device shown in this specification, a first user data download module (not shown in the figure) is further included;

[0132] The first user data download module is configured to, before the request receiving module 901 receives the data acquisition request sent by the data platform, acquire various types of user data of the user from each data providing system; encrypt each type of user data using the second public key corresponding to the user; and send each type of encrypted user data to the data platform.

[0133] exist Figure 9 In the embodiment of the device shown in this specification, a second user data download module (not shown in the figure) is further included;

[0134] The second user data download module is configured to, after the request receiving module 901 receives a data acquisition request from the data platform, acquire user data from the data providing system that provides user data of the corresponding type based on the user data identifier carried in the data acquisition request; encrypt the acquired user data using the second public key corresponding to the user; and send the encrypted user data to the data platform.

[0135] exist Figure 9 In the embodiment of the device shown in this specification, it further includes: an authorization module (not shown in the figure);

[0136] The authorization module is configured to initiate an authorization request to the user after the request receiving module 901 receives a data acquisition request from the data platform. The authorization request carries an identifier of the user data that the data use system needs to use. The module determines whether it has received the user's authorization consent instruction. If so, it triggers the authorization key calculation module 902 to perform the calculation. Otherwise, it notifies the authorization key calculation module 902 not to perform the calculation.

[0137] In one embodiment of this specification, an apparatus for providing user data is provided, which is applied to a data platform. See [link to relevant documentation]. Figure 10 The device includes:

[0138] The first interface module 1001 is configured to receive user data requests sent by the data usage system; wherein, the user data request carries the user data identifier required by the data usage system, the first public key corresponding to the data usage system, and callback interface information.

[0139] The second interface processing module 1002 is configured to generate a data acquisition request based on the received user data application and send it to the user's terminal device; wherein, the data acquisition request carries the identifier of the user data that the data use system needs to use and the first public key corresponding to the data use system;

[0140] The re-encryption processing module 1003 is configured to obtain user data encrypted using the second public key corresponding to the user based on the identifier of the user data carried in the user data application; receive the authorization key sent by the terminal device; and obtain user data encrypted using the first public key using the authorization key, the first public key, and the second public key.

[0141] The third interface module 1004 is configured to send user data encrypted with the first public key to the data usage system using the callback interface information carried in the user data application.

[0142] exist Figure 10 In one embodiment of the device shown in this specification, it further includes: a first user data storage module (not shown in the figure);

[0143] The first user data storage module is configured to receive and store various types of user data encrypted using the second public key corresponding to the user, sent by the terminal device, before the first interface module 1001 receives the user data request sent by the data usage system.

[0144] Accordingly, the re-encryption processing module 1003 obtains the user data, which corresponds to the user data identifier and is encrypted using the second public key corresponding to the user, from the pre-saved encrypted user data of various types.

[0145] exist Figure 10 In one embodiment of the device shown in this specification, the re-encryption processing module 1003 is configured to: after receiving a user data request from the data usage system, receive user data sent by the terminal device, which is encrypted using the second public key corresponding to the user and corresponds to the user data identifier.

[0146] In one embodiment of this specification, an apparatus for providing user data is also provided, which is applied to a data providing system. See [link to relevant documentation]. Figure 11 ,include:

[0147] Download request receiving module 1101 is configured to receive user data download requests sent by user terminal devices, and the user data request carries the user's identifier.

[0148] The data determination module 1102 is configured to obtain the user data of the user based on the user identifier;

[0149] The data sending module 1103 is configured to send the obtained user data to the terminal device.

[0150] In one embodiment of this specification, an apparatus for providing user data is also provided, which is applied to a data usage system; see [link to relevant documentation]. Figure 12 ,include:

[0151] The data request module 1201 is configured to send a user data request to the data platform; wherein, the user data request carries the user data identifier required by the data use system, the first public key corresponding to the data use system, and callback interface information;

[0152] The data receiving module 1202 is configured to receive user data encrypted using the first public key sent by the data platform;

[0153] The decryption module 1203 is configured to use the system's corresponding first private key to decrypt user data.

[0154] exist Figure 12 In one embodiment of the device shown in this specification, the decrypted user data includes the signature information of the data provider; the device further includes: a signature verification module (not shown in the figure), configured to perform signature verification on the user data after the decryption module 1203 decrypts the user data.

[0155] This specification provides an embodiment of a system for providing user data, which includes any device for providing user data applied in a terminal device, any device for providing user data applied in a data platform, any device for providing user data applied in a data providing system, and any device for providing user data applied in a data usage system.

[0156] This specification provides, in one embodiment, a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the methods of any embodiment in the specification.

[0157] This specification provides a computing device according to one embodiment, including a memory and a processor, wherein the memory stores executable code, and the processor executes the executable code to perform the method of any embodiment of the specification.

[0158] It is understood that the structures illustrated in the embodiments of this specification do not constitute a specific limitation on the apparatus of the embodiments of this specification. In other embodiments of the specification, the above-described apparatus may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0159] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the apparatus embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0160] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made on the basis of the technical solution of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for providing user data, the method being applied to a user-side terminal device, including: Before the user-side terminal device receives the data acquisition request from the data platform, the process includes: the user-side terminal device acquiring various types of user data from each data providing system; encrypting each type of user data using the second public key corresponding to the user; and sending each type of encrypted user data to the data platform. The user-side terminal device receives a data acquisition request from the data platform; the data acquisition request carries the user data identifier required by the data usage system and the first public key corresponding to the data usage system. The user-side terminal device initiates an authorization request to the user, which carries an identifier of the user data that the data usage system needs to use; The user-side terminal device determines whether it has received the user's authorization consent instruction. If so, it calculates the authorization key using the user's second private key and the first public key obtained from the data acquisition request. The user's terminal device sends the authorization key to the data platform, which then uses the authorization key, the first public key, and the second public key to encrypt the user data, obtains the user data encrypted with the first public key, and sends it to the data usage system.

2. The method according to claim 1, wherein, The user data is user data that has been signed by the data providing system.

3. A method for providing user data, the method being applied to a data platform, and the method being implemented based on any one of the methods for providing user data applied to a user-side terminal device as described in claims 1 to 2, comprising: Before receiving user data requests from the system, the data platform receives and saves various types of user data encrypted using the user's second public key from the user's terminal device. The system receives user data requests from the data usage system; these requests include the user data identifier required by the data usage system, the first public key corresponding to the data usage system, and callback interface information. A data acquisition request is generated based on the received user data request and sent to the user's terminal device; the data acquisition request carries the identifier of the user data that the data use system needs to use and the first public key corresponding to the data use system; From the pre-saved encrypted user data of various types, obtain the user data that corresponds to the user data identifier and is encrypted using the second public key corresponding to the user; Receive the authorization key sent by the terminal device; Using the authorized key, the first public key, and the second public key to encrypt the user data, we obtain the user data encrypted with the first public key; Using the callback interface information carried in the user data application, the user data encrypted with the first public key is sent to the data usage system.

4. A method for providing user data, the method being applied to a data providing system, and the method being implemented based on any one of the methods for providing user data applied to a user-side terminal device as described in claims 1 to 2; comprising: Receive user data download requests from user's terminal device, which carry the user identifier. Based on the user identifier, the user data of the user is obtained; The obtained user data is sent to the terminal device.

5. A method for providing user data, the method being applied to a data usage system, and the method being implemented based on any one of the methods for providing user data applied to a user-side terminal device as described in claims 1 to 2; comprising: Send a user data request to the data platform; the user data request includes the user data identifier required by the data use system, the first public key corresponding to the data use system, and callback interface information; Receive user data encrypted using the first public key from the data platform; The user data is decrypted using the system's corresponding first private key.

6. The method for providing user data according to claim 5, wherein the user data includes the signature information of the data provider; After decrypting the user data using the system's corresponding first private key, the process further includes: Perform signature verification on user data.

7. A device for providing user data, the device being used in a user-side terminal device, comprising: The request receiving module is configured to receive data acquisition requests sent by the data platform; wherein, the data acquisition request carries the user data identifier required by the data use system and the first public key corresponding to the data use system; The authorization key calculation module is configured to calculate the authorization key using the second private key corresponding to the user and the first public key obtained from the data acquisition request. The key sending module is configured to send the authorization key to the data platform, and the data platform uses the authorization key, the first public key, and the second public key to encrypt the user data, obtain the user data encrypted with the first public key, and send it to the data usage system. The device further includes: an authorization module; The authorization module is configured to initiate an authorization request to the user after the request receiving module receives a data acquisition request from the data platform. The authorization request carries an identifier of the user data that the data use system needs to use. It determines whether the user's authorization consent instruction has been received. If so, it triggers the authorization key calculation module to perform the calculation. Otherwise, it notifies the authorization key calculation module not to perform the calculation. Further includes: a first user data download module; The first user data download module is configured to, before the request receiving module receives the data acquisition request sent by the data platform, acquire various types of user data of the user from each data providing system; encrypt each type of user data using the second public key corresponding to the user; and send each type of encrypted user data to the data platform.

8. An apparatus for providing user data, applied to a data platform, the apparatus being implemented based on the apparatus for providing user data applied to a user-side terminal device as described in claim 7; comprising: The first interface module is configured to receive user data requests sent by the data usage system; wherein, the user data request carries the user data identifier required by the data usage system, the first public key corresponding to the data usage system, and callback interface information; The second interface processing module is configured to generate a data acquisition request based on the received user data application and send it to the user's terminal device; wherein, the data acquisition request carries the identifier of the user data that the data use system needs to use and the first public key corresponding to the data use system; The re-encryption processing module is configured to obtain user data encrypted using the second public key corresponding to the user based on the identifier of the user data carried in the user data application; receive the authorization key sent by the terminal device; and obtain user data encrypted using the first public key using the authorization key, the first public key, and the second public key. The third interface module is configured to send the user data encrypted with the first public key to the data usage system using the callback interface information carried in the user data application; The device further includes: a first user data storage module; The first user data storage module is configured to receive and store various types of user data encrypted using the second public key corresponding to the user, sent by the terminal device, before the first interface module receives the user data request sent by the data usage system. The re-encryption processing module obtains the user data, which corresponds to the user data identifier and is encrypted using the second public key corresponding to the user, from the pre-saved encrypted user data of various types.

9. An apparatus for providing user data, applied to a data providing system, the apparatus being implemented based on the apparatus for providing user data applied to a user-side terminal device as described in claim 7; comprising: The download request receiving module is configured to receive user data download requests sent by the user's terminal device, and the user data request carries the user's identifier. The data determination module is configured to obtain the user's user data based on the user's identifier; The data sending module is configured to send the received user data to the terminal device.

10. An apparatus for providing user data, applied to a data usage system, the apparatus being implemented based on the apparatus for providing user data applied to a user-side terminal device as described in claim 7; comprising: The data request module is configured to send a user data request to the data platform; the user data request carries the user data identifier required by the data usage system, the first public key corresponding to the data usage system, and callback interface information. The data receiving module is configured to receive user data encrypted using the first public key sent by the data platform; The decryption module is configured to use the system's corresponding first private key to decrypt user data.

11. A system for providing user data, comprising the means for providing user data applied to a user-side terminal device as described in claim 7, the means for providing user data applied to a data platform as described in claim 8, the means for providing user data applied to a data providing system as described in claim 9, and the means for providing user data applied to a data usage system as described in claim 10.

12. A computing device comprising a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method of any one of claims 1-6.

Images