A method, system and storage medium for secure transmission of trusted digital identity

Abstract

The present application provides a method, system and storage medium for secure transmission of a trusted digital identity. The method for secure transmission of a trusted digital identity is applied to a trusted digital identity secure transmission system, which includes a trusted digital identity verification device and a trusted digital identity transmission device. The method includes: the trusted digital identity verification device receives user identity information from an Internet trusted digital identity verification platform, and obtains plaintext or ciphertext identity information based on the user identity information; the trusted digital identity verification device transmits plaintext or ciphertext identity information to the trusted digital identity transmission device through a trusted digital identity output dedicated interface, wherein the trusted digital identity transmission device is configured with a network unidirectional security isolation facility; the trusted digital identity transmission device transmits the plaintext or ciphertext identity information to the security inspection system through the network unidirectional security isolation facility, so that the identity verification result obtained by the external network verification can be used in the subsequent workflow of the intranet.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a method, system and storage medium for securely transmitting a trusted digital identity. Background Art

[0002] Generally, national government agencies and public security management departments that need to verify the real identity information of customers all use the second-generation ID card. The second-generation ID card is an offline carrier, and the sensitive identity information is stored inside the certificate. The ID card reader can only read the data in the certificate, but cannot output data to the certificate, so there is no need to worry about the leakage of the intranet system when using the second-generation ID card.

[0003] If you don't use the second-generation ID card, there are some digital network identity verification methods. However, this method can only be implemented in the agency's private network to ensure the credibility of the verification results. Although there are many mobile Internet identity verification technologies, through digital identity + biometrics (such as face recognition), it can achieve more efficient and reliable identity verification than the second-generation ID card alone (the second-generation ID card has the problem of being used by similar people).

[0004] However, the results of identity verification through the Internet are difficult to be accepted by private network systems because the authenticity of the verification results cannot be confirmed, and it is unknown whether the results have been forged or tampered with, so they cannot be trusted. Summary of the invention

[0005] The present application provides a method, system and storage medium for secure transmission of a trusted digital identity. It can achieve physical isolation between a closed private network and the Internet, and its real identity is obtained by verification of the Internet (extranet), while the identity information is checked in the closed private network (intranet), and the identity verification results obtained by the external network can be used in the subsequent work flow of the intranet. For example, occasions such as civil aviation airport security counters where it is necessary to check and verify the real identity information of customers. It can be applicable to national mandatory agencies that need to check and verify the real identity information of customers or occasions where the law requires strict management.

[0006] In view of this, the first aspect of the present application provides a method for secure transmission of a trusted digital identity, characterized in that the method for secure transmission of a trusted digital identity is applied to a trusted digital identity secure transmission system, the trusted digital identity secure transmission system comprising a trusted digital identity verification device and a trusted digital identity transmission device, wherein the trusted digital identity verification device is connected to the trusted digital identity transmission device via a dedicated interface for trusted digital identity output, the method comprising: the trusted digital identity verification device receives user identity information from an Internet trusted digital identity verification platform, and obtains plaintext or ciphertext identity information based on the user identity information; the trusted digital identity verification device transmits the plaintext or ciphertext identity information to the trusted digital identity transmission device via the dedicated interface for trusted digital identity output, wherein the trusted digital identity transmission device is configured with a network unidirectional security isolation facility; the trusted digital identity transmission device transmits the plaintext or ciphertext identity information to the security inspection system via the network unidirectional security isolation facility, so that the identity verification result obtained by the external network verification can be used in the subsequent work flow of the intranet.

[0007] Optionally, in combination with the first aspect, in a possible implementation, the trusted digital identity verification device includes a network communication interface, an operating system, and a cybertrusted identity (CTID) security module, and the method further includes: the CTID security module receives a digital identity in the form of a QR code through the network communication interface to authenticate the validity and legality of the digital identity in the form of a QR code, thereby preventing attacks by forged and counterfeit QR codes, wherein the digital identity in the form of a QR code includes a desensitized and declassified identity of the user.

[0008] Optionally, in combination with the first aspect, in a possible implementation, the CTID security module specifically includes an optical code scanning component, a QR code decoding component and a CTID trusted digital identity security chip, the user identity information includes a CTID trusted digital identity QR code image, and obtaining plaintext or ciphertext identity information based on the user identity information specifically includes: the optical code scanning component photographs the CTID trusted digital identity QR code image; the QR code decoding component parses the QR code data from the QR code image; and the CTID trusted digital identity security chip decrypts the corresponding identity identifier from the QR code data.

[0009] Optionally, in combination with the first aspect, in a possible implementation, the method further includes: receiving a captured facial image through the Internet trusted digital identity platform, and verifying the facial image.

[0010] Optionally, in combination with the first aspect, in a possible implementation, the network unidirectional security isolation facility includes unidirectional optical isolation and / or USB flash drive lock isolation.

[0011] Optionally, in combination with the first aspect, in a possible implementation, the trusted digital identity transmission device also includes a dedicated adapter board, which is used to adapt the data message received through the trusted digital identity output dedicated interface and send the adapted data message to the network unidirectional security isolation facility.

[0012] Optionally, in combination with the first aspect, in a possible implementation, the dedicated adapter board is also used to verify the reliability of the data message, and to splice a complete data file based on the data message, and store the data file in the file sending directory of the network unidirectional security isolation facility.

[0013] Optionally, in combination with the first aspect, in a possible implementation method, the trusted digital identity transmission device transmits the plaintext or encrypted identity information to the network ID card security inspection system through the network unidirectional security isolation facility, specifically including: transmitting the plaintext or encrypted identity information to the security inspection system through the intranet interface.

[0014] The second aspect of the present application provides a trusted digital identity security transmission system, characterized in that the trusted digital identity security transmission system includes a trusted digital identity verification device and a trusted digital identity transmission device, wherein the trusted digital identity verification device and the trusted digital identity transmission device are connected via a trusted digital identity output dedicated interface, the trusted digital identity verification device is used to receive user identity information from an Internet trusted digital identity verification platform, and obtain plaintext or ciphertext identity information based on the user identity information; the trusted digital identity verification device is used to transmit the plaintext or ciphertext identity information to the trusted digital identity transmission device via the trusted digital identity output dedicated interface, wherein the trusted digital identity transmission device is configured with a network unidirectional security isolation facility; the trusted digital identity transmission device is used to transmit the plaintext or ciphertext identity information to the security inspection system via the network unidirectional security isolation facility for identity verification.

[0015] The third aspect of the present application provides a computer-readable storage medium, which stores a computer program, and the computer program includes program instructions. When the program instructions are executed by a processor, the processor executes the method for secure transmission of a trusted digital identity as described in any one of the first aspect to the first aspect of the present application.

[0016] The present application provides a method, system and storage medium for secure transmission of a trusted digital identity. The method for secure transmission of a trusted digital identity is applied to a trusted digital identity secure transmission system, the trusted digital identity secure transmission system comprising a trusted digital identity verification device and a trusted digital identity transmission device, wherein the trusted digital identity verification device is connected to the trusted digital identity transmission device via a trusted digital identity output dedicated interface, the method comprising: the trusted digital identity verification device receives user identity information from an Internet trusted digital identity verification platform, and obtains plaintext or ciphertext identity information based on the user identity information; the trusted digital identity verification device transmits the plaintext or ciphertext identity information to the trusted digital identity transmission device via the trusted digital identity output dedicated interface, wherein the trusted digital identity transmission device is configured with a network unidirectional security isolation facility; the trusted digital identity transmission device transmits the plaintext or ciphertext identity information to a security inspection system via the network unidirectional security isolation facility, so that the identity verification result obtained by the external network verification can be used in the subsequent workflow of the intranet.

[0017] The closed private network intranet must be physically isolated from the Internet in accordance with information security requirements. If there is a data channel between the Internet verification device and the port for receiving the verification result is maliciously attacked or exploited, if the sensitive information of the private network is leaked to the outside through the port, the consequences are unimaginable. Therefore, the trusted digital identity security transmission method provided by the present application can achieve the physical isolation of the closed private network and the Internet. Its real identity is obtained by verification of the Internet (extranet), and the information is checked in the closed private network (intranet). The identity verification results obtained by the external network verification can be used in the subsequent work flow of the intranet. For example, occasions such as civil aviation airport security counters where it is necessary to check and verify the real identity information of customers. It can be applicable to national mandatory agencies that need to check and verify the real identity information of customers or occasions where the law requires strict management. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 This is a schematic diagram of the architecture of a trusted digital identity security transmission system in an embodiment of the present application;

[0019] Figure 2 This is a schematic diagram of the structure of a CTID security module in an embodiment of the present application;

[0020] Figure 3 A flowchart of a method for securely transmitting a trusted digital identity in an embodiment of the present application;

[0021] Figure 4 This is a structural diagram of a trusted digital identity verification device in an embodiment of the present application. DETAILED DESCRIPTION

[0022] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0023] The term "and / or" in this application can be a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this application generally indicates that the associated objects before and after are in an "or" relationship.

[0024] The terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or modules is not necessarily limited to those steps or modules that are clearly listed, but may include other steps or modules that are not clearly listed or inherent to these processes, methods, products or devices.

[0025] Generally, national government agencies and public security management departments that need to verify the real identity information of customers all use the second-generation ID card. The second-generation ID card is an offline carrier, and the sensitive identity information is stored inside the ID card. The ID card reader can only read the data in the ID card, but cannot output data to the ID card, so there is no need to worry about the leakage of the intranet system when using the second-generation ID card.

[0026] If you don't use the second-generation ID card, there are some digital network identity verification methods. However, this method can only be implemented in the agency's private network to ensure the credibility of the verification results. Although there are many mobile Internet identity verification technologies, through digital identity + biometrics (such as face recognition), it can achieve more efficient and reliable identity verification than the second-generation ID card alone (the second-generation ID card has the problem of being used by similar people).

[0027] However, the results of identity verification through the Internet are difficult to be accepted by private network systems because the authenticity of the verification results cannot be confirmed, and it is unknown whether the results have been forged or tampered with, so they cannot be trusted.

[0028] Therefore, this application first provides a trusted digital identity security delivery system, see Figure 1The system comprises:

[0029] A trusted digital identity verification device and a trusted digital identity transmission device, wherein the trusted digital identity verification device and the trusted digital identity transmission device are connected via a trusted digital identity output dedicated interface.

[0030] The trusted digital identity verification device includes a network communication interface, an operating system and a CTID security module, and the network communication interface, the operating system and the CTID security module are connected in sequence. Among them, the CTID security module includes a transmission control security chip. The network communication interface is connected to the Internet trusted digital identity verification platform.

[0031] The trusted digital identity transmission device includes a network unidirectional security isolation facility and a dedicated adapter board, which communicates unidirectionally with the network unidirectional security isolation facility, and the network unidirectional security isolation facility communicates unidirectionally with the security inspection system through an intranet interface.

[0032] Furthermore, this application also provides a CTID security module, see Figure 2 . The security module may specifically include: an optical code scanning component, a QR code decoding component, and a CTID trusted digital identity security chip. Specifically, the optical code scanning component includes: a scanning window, a lens, and a photosensitive chip. The QR code decoding component includes: a decoding chip and firmware. The optical code scanning component is used to capture an image of the CTID trusted digital identity QR code. The QR code decoding component is used to parse the QR code data from the image, and the CTID trusted digital identity security chip is used to decrypt specific encrypted information from the QR code data. According to the verification business requirements, the QR code data or specific encrypted information is submitted to the CTID platform by the terminal application (application, APP) in the prescribed format for identity verification.

[0033] The core of this application is the CTID security module, which has a built-in CTID trusted digital identity security chip and verification mechanism. The trusted digital identity verification process is implemented through the Internet with the help of the operating system and network facilities on the device. The verification results are output by the security module through a dedicated interface.

[0034] The trusted digital identity verification involved in this application is realized by relying on the authoritative identity authentication agency of the state or the Ministry of Public Security. Currently, it is the CTID platform of the Ministry of Public Security, and it may be a national platform in the future. These platforms can provide real identity verification results with legal effect, and their verification interfaces support multiple levels and forms.

[0035] The CTID security module confirms the authenticity and validity of the verification device through the built-in security chip, effectively blocking the illegal access of unauthorized devices. The verification mechanism complies with the corresponding rules of CTID or the national platform, and implements identity verification by combining digital identity identification with biometric features.

[0036] The CTID security module mainly receives digital identity in the form of a QR code, which contains the user's desensitized and declassified identity (not sensitive information such as ID number / name, etc.). Relying on the security chip in the module, the validity and legality of the QR code can be identified to prevent various attacks such as forgery and counterfeit codes.

[0037] Biometrics are usually live facial images. The verification device can access the Internet through wired broadband, WIFI or 4G communication cards, and send the identity output by the CTID security module and the facial image captured on site to CTID and other platforms through the Internet for identity verification, and receive the verification results and hand them over to the security module for directional transmission.

[0038] The trusted digital identity verification result output by the trusted digital identity output dedicated interface must pass through the network one-way security isolation facility before entering the intranet. The network one-way security isolation facility usually meets the "GB / T20279-2015 Information Security Technology Network and Terminal Equipment Isolation Component Security Technical Requirements" standard and relevant regulations of the State Administration of State Security, passes information security technology certification or confidentiality technology testing, and has a one-way security isolation function.

[0039] According to GB standard requirements, network isolation equipment is divided into three categories: terminal isolation products, network isolation products, and network one-way import products. According to the requirements of this application, the Internet identity verification results need to be transmitted to the closed private network, so a network one-way import product that meets GB requirements should be used.

[0040] The verification device implements trusted digital identity verification through the Internet. For the one-way network import device, it belongs to the data sender. The device that receives the identity verification result in the closed intranet belongs to the data receiver. The physical isolation mechanism of the one-way network import device ensures that data can only be transmitted from the data sender to the data receiver in a trusted one-way manner, thereby ensuring that confidential information in the closed intranet will not be leaked.

[0041] The series connection between the two facilities generally requires a dedicated transmission cable or adapter board. According to the interface characteristics of the network unidirectional security isolation, the input end needs to be adapted through the adapter board. In practice, the adapter board and the network unidirectional security isolation facility can be encapsulated together in a reliable shell to ensure the safety and reliability of their connection and communication. The two facilities are used in series, which not only ensures the authenticity and reliability of the identity information, but also ensures that the private network information will not be leaked, and the security can be trusted.

[0042] Since the network one-way import equipment uses the file ferrying method, and the output of the CTID security module uses a conventional communication port, an adapter board is required to collect and store the communication messages as static data files. Considering that the identity verification result data may contain a large amount of content, in addition to the name, ID number, etc., it may also include multiple verification photos, as well as other information specified by management requirements (terminal number, timestamp, serial number, response code, etc.), in communication transmission, it is generally necessary to use packet sending, per-packet verification, error retransmission, unpacking combination, etc., to piece together the complete data content at the receiving end, and save it as a static file in a predetermined format, and then ferry it to the closed intranet through the network one-way import equipment.

[0043] In view of the above-mentioned trusted digital identity secure transmission system, this application provides a trusted digital identity secure transmission method. Figure 3 , the method comprising:

[0044] S110. The trusted digital identity verification device receives user identity information from the Internet trusted digital identity verification platform, and obtains plaintext or ciphertext identity information based on the user identity information.

[0045] The trusted digital identity verification device receives user identity information from the Internet trusted digital identity verification platform, and obtains plaintext or ciphertext identity information based on the user identity information. The identity information is understandable and meaningful information about the user's identity, such as name, ID number, etc. Among them, the plaintext identity information can be used directly, while the ciphertext identity information can be converted into plaintext identity information through decryption operations.

[0046] Specifically, the CTID security module includes an optical code scanning component, a QR code decoding component and a CTID trusted digital identity security chip. The user identity information includes a CTID trusted digital identity QR code image. The obtaining of plaintext or ciphertext identity information based on the user identity information includes: the optical code scanning component photographs the CTID trusted digital identity QR code image; the QR code decoding component parses the QR code data from the QR code image; the CTID trusted digital identity security chip decrypts the corresponding identity identifier from the QR code data.

[0047] It should be pointed out that the identity identifier is a desensitized data defined in the identity verification platform provided by this application. It can be identified as a certain person within the platform, but it cannot be matched to a person outside the platform. The identity verification platform stores a large amount of identity information and photo library. It determines the identity of a person by checking whether the identity identifier and the face photo are of the same person and returns the verification result. Specifically, the desensitized identity identifier is a string of irregular garbled codes generated by converting the identity plaintext through digital encryption and obfuscation. Only the platform that masters the conversion algorithm can know which specific identity the string of garbled codes corresponds to. Since the identity information cannot be converted or retrieved to identity-sensitive identity information, it can be called desensitized.

[0048] S120. The trusted digital identity verification device transmits plaintext or ciphertext identity information to the trusted digital identity transmission device through the trusted digital identity output dedicated interface.

[0049] The trusted digital identity verification device transmits the plaintext or ciphertext identity information to the trusted digital identity transmission device through the trusted digital identity output dedicated interface, wherein the trusted digital identity transmission device is configured with a network unidirectional security isolation facility.

[0050] S130. The trusted digital identity transmission device transmits the plaintext or encrypted identity information to the security inspection system through the network one-way security isolation facility.

[0051] The trusted digital identity transmission device transmits the plaintext or ciphertext identity information to the security inspection system through the network unidirectional security isolation facility for identity verification.

[0052] Furthermore, the trusted digital identity verification device includes a network communication interface, an operating system and a CTID security module. The method also includes: the CTID security module receives a digital identity identifier in the form of a QR code through the network communication interface to authenticate the validity and legality of the digital identity identifier in the form of a QR code, thereby preventing attacks from counterfeit and fake QR codes, wherein the digital identity identifier in the form of a QR code includes a desensitized and declassified identity identifier of the user.

[0053] Furthermore, the method also includes: receiving the captured facial image through the Internet trusted digital identity platform, and verifying the facial image.

[0054] The trusted digital identity transmission device also includes a dedicated adapter plate, which is used to adapt the data message received through the trusted digital identity output dedicated interface, and send the adapted data message to the network unidirectional security isolation facility. The dedicated adapter plate is also used to verify the reliability of the data message, and splice a complete data file based on the data message, and store the data file in the file sending directory of the network unidirectional security isolation facility. The trusted digital identity transmission device transmits the plaintext or ciphertext identity information to the network ID card security inspection system through the network unidirectional security isolation facility, specifically including: transmitting the plaintext or ciphertext identity information to the security inspection system through the intranet interface.

[0055] It should be noted that the network unidirectional security isolation facility includes unidirectional optical isolation and / or USB flash drive lock isolation. Traditional network unidirectional isolation equipment includes mechanical and electrical physical isolation (such as CD transfer, hard disk rewiring, dual-port gate), etc. One-way isolation is achieved by these methods, with great delay and slow speed. The network unidirectional isolation equipment provided in this application includes but is not limited to two types: unidirectional optical isolation and USB flash drive lock isolation. Among them, optical isolation utilizes the characteristics of unidirectional optical fiber, with one end sending light and the other end receiving light, ensuring that information can only be transmitted in one direction. The network optical gate machine commonly used in general closed intranet systems belongs to this type of equipment. This application is applicable to small and micro optical gate devices, typically desktop unidirectional optical guide devices. USB flash drive lock isolation utilizes the characteristics of USB flash drive unidirectional locks, and through special underlying means, it can only read data from the USB flash drive but not write data. This application is applicable to various USB flash drive unidirectional locks.

[0056] The network unidirectional security isolation facilities generally limit the unidirectional data transmission to the form of files. The dedicated output interface of the CTID security module is generally UART / USB, etc., using the data message format. The dedicated adapter board needs to run a specific program to receive the data message (one or more) sent by the CTID security module in real time, check the data reliability, and splice it into a complete data file format, which is stored in the file sending directory area of ​​the optical unidirectional isolation device, or in the USB directory of the USB unidirectional lock.

[0057] In summary, the trusted digital identity secure transmission method and system provided by the present application can combine data trust with network isolation, and therefore has the following advantages:

[0058] 1. CTID security module ensures the correctness of Internet identity information verification results;

[0059] 2. The CTID security module directly outputs the identity information verification results through a dedicated interface to ensure the reliability of the data and avoid interception and theft;

[0060] 3. The verification results are transmitted to the closed private network through the network's one-way security isolation facilities, which can effectively protect the physical isolation security of the private network and prevent the leakage of private network information from the access port.

[0061] The trusted digital identity secure transmission method, system and storage medium provided by the present application can be applied to various occasions where identity verification is required, such as when a user is required to submit an ID card and a boarding pass during a security check, where the ID card is used to determine identity information and the boarding pass indicates business information. However, the current practice is that the user does not need to use the ID card during the security check, because a special device (the trusted digital identity verification device in this article) directly notifies the security check system through a transmission device (the trusted digital identity transmission device) that the user's identity has been verified.

[0062] Since the identity verification is done by a national authority or a trusted platform, there is no possibility of tampering or forgery during the transmission of the verification result, so the result of the identity verification can be trusted. In the process of transmitting and receiving information, the security of the security inspection system itself can also be ensured. Therefore, in the security inspection system, only the business information needs to be further processed according to the confirmed identity information.

[0063] This application also provides a structural diagram of a trusted digital identity verification device, see Figure 4 , the trusted digital identity verification device 200 may have relatively large differences due to different configurations or performances, and may include one or more processors (central processing units, CPU) 210 (for example, one or more processors) and memory 220, one or more storage media 230 (for example, one or more mass storage devices) storing application programs 233 or data 232. Among them, the memory 220 and the storage medium 230 can be short-term storage or permanent storage. The program stored in the storage medium 230 may include one or more modules (not shown in the figure). Furthermore, the processor 210 can be configured to communicate with the storage medium 330 to execute a series of instruction operations in the storage medium 20 on the trusted digital identity verification device 200.

[0064] The trusted digital identity verification device 200 may also include one or more power supplies 240, one or more wired or wireless network interfaces 250, one or more input and output interfaces 260, and / or one or more operating systems 231, such as Windows Server, Mac OS X, Unix, Linux, FreeBSD, etc. The trusted digital identity verification device 200 may also include a CTID security module 270, which is as described above and Figure 2As shown, no further details will be given here. Those skilled in the art will understand that Figure 4 The structure of the trusted digital identity verification device shown does not constitute a limitation on the trusted digital identity verification device, and may include more or fewer components than shown in the figure, or a combination of certain components, or a different arrangement of components.

[0065] The present application also provides a computer-readable storage medium, which may be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium. Instructions are stored in the computer-readable storage medium. When the instructions are executed on a computer, the computer executes the steps of the method for securely delivering a trusted digital identity.

[0066] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0067] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0068] In the embodiments provided in this application, it should be understood that the disclosed methods can be implemented in other ways without exceeding the spirit and scope of this application. The current embodiment is only an illustrative example and should not be used as a limitation. The specific content given should not limit the purpose of this application. For example, some features can be ignored or not executed.

[0069] The technical means disclosed in the present application are not limited to the technical means disclosed in the above-mentioned implementation methods, but also include technical solutions composed of any combination of the above technical features. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of this application, and these improvements and modifications are also regarded as the protection scope of this application.

[0070] The above is a detailed introduction to a method, system and storage medium for secure transmission of a trusted digital identity provided by the embodiments of the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method and its core idea of ​​the present application. At the same time, for those of ordinary skill in the art, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application. Although the present application has been described in detail with reference to the aforementioned embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the aforementioned embodiments, or replace some of the technical features therein by equivalents; and these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for securely transmitting a trusted digital identity, characterized in that: The trusted digital identity security transmission method is applied to a trusted digital identity security transmission system, the trusted digital identity security transmission system includes a trusted digital identity verification device and a trusted digital identity transmission device, wherein the trusted digital identity verification device is connected to the trusted digital identity transmission device via a trusted digital identity output dedicated interface, and the method includes: The trusted digital identity verification device receives user identity information from the Internet trusted digital identity verification platform, and obtains plaintext or ciphertext identity information based on the user identity information; The trusted digital identity verification device transmits the plaintext or ciphertext identity information to the trusted digital identity transmission device through the trusted digital identity output dedicated interface, wherein the trusted digital identity transmission device is configured with a network unidirectional security isolation facility; The trusted digital identity transmission device transmits the plaintext or encrypted identity information to the security inspection system through the network unidirectional security isolation facility for identity verification; The trusted digital identity verification device includes a network communication interface, an operating system, and a CTID security module. The method further includes: The CTID security module receives the digital identity information in the form of a QR code through the network communication interface to authenticate the validity and legality of the digital identity in the form of a QR code, thereby preventing attacks by forged or counterfeit QR codes, wherein the digital identity in the form of a QR code includes a desensitized and declassified identity of the user; The CTID security module specifically includes an optical code scanning component, a two-dimensional code decoding component, and a CTID trusted digital identity security chip. The user identity information includes a CTID trusted digital identity two-dimensional code image. The obtaining of plaintext or ciphertext identity information according to the user identity information specifically includes: The optical code scanning component captures the CTID trusted digital identity two-dimensional code image; The two-dimensional code decoding component parses the two-dimensional code data from the two-dimensional code image; The CTID trusted digital identity security chip decrypts the corresponding identity information from the two-dimensional code data.

2. The method for securely transmitting a trusted digital identity according to claim 1, characterized in that: The method further comprises: The captured facial image is received through the Internet trusted digital identity verification platform, and the facial image is verified.

3. The method for securely transmitting a trusted digital identity according to claim 1, characterized in that: The network unidirectional security isolation facility includes unidirectional optical isolation and / or USB disk lock isolation.

4. The method for securely transmitting a trusted digital identity according to claim 1, characterized in that: The trusted digital identity transmission device also includes a dedicated adapter board, The dedicated adapter board is used to adapt the data message received through the trusted digital identity output dedicated interface, and send the adapted data message to the network unidirectional security isolation facility.

5. The method for securely transmitting a trusted digital identity according to claim 4, characterized in that: The dedicated adapter board is also used to check the reliability of the data message, and to splice a complete data file according to the data message, and store the data file in the file sending directory of the network unidirectional security isolation facility.

6. The method for securely transmitting a trusted digital identity according to claim 1, characterized in that: The trusted digital identity transmission device transmits the plaintext or ciphertext identity information to the security inspection system through the network unidirectional security isolation facility, specifically including: The plaintext or encrypted identity information is transmitted to the security inspection system through an intranet interface.

7. A trusted digital identity secure delivery system, characterized in that: The trusted digital identity security transmission system includes a trusted digital identity verification device and a trusted digital identity transmission device, wherein the trusted digital identity verification device is connected to the trusted digital identity transmission device via a trusted digital identity output dedicated interface. The trusted digital identity verification device is used to receive user identity information from the Internet trusted digital identity verification platform and obtain plaintext or ciphertext identity information based on the user identity information; The trusted digital identity verification device is used to transmit the plaintext or ciphertext identity information to the trusted digital identity transmission device through the trusted digital identity output dedicated interface, wherein the trusted digital identity transmission device is configured with a network unidirectional security isolation facility; The trusted digital identity transmission device is used to transmit the plaintext or encrypted identity information to the security inspection system through the network unidirectional security isolation facility for identity verification; The trusted digital identity verification device includes a network communication interface, an operating system and a CTID security module. The CTID security module is used to receive a digital identity in the form of a two-dimensional code through the network communication interface to authenticate the validity and legality of the digital identity in the form of a two-dimensional code, thereby preventing attacks by forged or counterfeit two-dimensional codes, wherein the digital identity in the form of a two-dimensional code includes a desensitized and declassified identity of the user; The CTID security module specifically includes an optical code scanning component, a two-dimensional code decoding component, and a CTID trusted digital identity security chip. The user identity information includes a CTID trusted digital identity two-dimensional code image. The obtaining of plaintext or ciphertext identity information according to the user identity information specifically includes: The optical code scanning component captures the CTID trusted digital identity two-dimensional code image; The two-dimensional code decoding component parses the two-dimensional code data from the two-dimensional code image; The CTID trusted digital identity security chip decrypts the corresponding identity information from the two-dimensional code data.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which includes program instructions. When the program instructions are executed by a processor, the processor executes the method for securely transmitting a trusted digital identity as described in any one of claims 1 to 6.

Images