A data use authorization method, device, and storage medium for anonymous query
The authorization center manages encryption keys and digital signatures to enable secure and compliant anonymous data queries, addressing the contradiction between data user anonymity and provider authorization requirements.
Patent Information
- Application Number
- CN202210071550.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-01-21
- Publication Date
- 2024-12-20
- Estimated Expiration
- 2042-01-21
AI Technical Summary
Data providers are required to obtain authorization from individuals before providing personal data, while data users want to query this data anonymously to protect their business secrets, creating a contradiction where the provider cannot authorize the query without knowing the requester's identity.
A data use authorization method, device, and storage medium for anonymous query, utilizing an authorization center to generate and manage encryption keys and digital signatures to ensure secure and compliant data access.
Ensures secure and compliant data access by anonymizing query requests, protecting both user and provider privacy, and preventing unauthorized access or tampering.
Smart Images
Figure CN114491591B_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of computer security technology, and in particular to a data use authorization method, device, and storage medium for anonymous query. Background Art
[0002] As data becomes a new factor of production, strengthening data circulation and promoting data development and utilization are important means to give full play to the value of data. The introduction of laws and regulations such as the Personal Information Protection Law and the Data Security Law provides a legal basis for protecting data security and personal privacy in data processing activities. These laws and regulations require data providers to obtain authorization and consent from individuals before providing personal data.
[0003] In the process of data circulation, when the data user queries the data provider for personal data, in order to protect their own business secrets, they do not want the data provider to know who is being queried. Therefore, when querying, the real query target needs to be hidden from the data provider.
[0004] However, according to the Personal Information Protection Law and other regulations, the data provider must first obtain the authorization and consent of the individual before providing the relevant information of the individual. This creates a contradiction: the data provider needs to obtain authorization from the person being queried before providing the data, while the data user does not want the provider to know who the person being queried is. However, the data provider does not know the person being queried and therefore cannot obtain the person's authorization and thus cannot provide the data. Summary of the invention
[0005] The present application provides a data use authorization method, device, and storage medium for anonymous query, which solves the above-mentioned problems.
[0006] A data use authorization method for anonymous query, applied to data users, authorization centers, and data providers, including:
[0007] The data user sends n identity IDs including the identity ID to be queried to the authorization center;
[0008] The authorization center applies for authorization from the object to be queried according to the identity ID to be queried. After the authorization center obtains the authorization from the object to be queried, it generates n keys corresponding to the n identity IDs; wherein the key corresponding to the identity ID to be queried is a valid key;
[0009] The authorization center encrypts the valid key according to the first public key corresponding to the identity ID to be queried provided by the data provider to form an encryption key, and replaces the valid key with the encryption key;
[0010] The authorization center digitally signs the n identity IDs and the n keys including the encryption key, and sends the digitally signed data and the original valid key to the data user;
[0011] The data user sends the digitally signed data returned by the authorization center to the data provider;
[0012] The data provider determines whether the digital signature is correct; if so, the data provider sequentially decrypts the n keys including the encryption key according to the first private key;
[0013] The data provider queries the information corresponding to the n identity IDs, then encrypts the n query results according to the decrypted n keys, and then sends the encrypted n query results to the data user;
[0014] The data user decrypts the query result of the identity ID to be queried according to the original valid key to obtain the query result of the identity ID to be queried.
[0015] In one embodiment of the present application, the authorization center digitally signs the n identity IDs and the n keys including the encryption key, specifically including: the authorization center arranges and encodes the n identity IDs and the n keys including the encryption key according to a preset order, and then performs a hash operation to obtain a corresponding digital summary; encrypts the digital summary according to the second private key in the second public-private key generated by the authorization center to obtain a digital signature.
[0016] In one embodiment of the present application, the data provider determines whether the digital signature is correct, specifically including: the data provider decrypts the digital signature according to the second public key of the authorization center to obtain a first digital summary; the data provider performs the same hash operation as the authorization center on the n identity IDs and the n keys including the encryption key to obtain a second digital summary; the first digital summary and the second digital summary are compared to determine whether the first digital summary and the second digital summary are equal; if so, the verification is successful.
[0017] In one embodiment of the present application, before querying the data, the method also includes: determining the number n of identity IDs for each query agreed upon by the data user and the data provider and the encryption / decryption algorithm of the n query results corresponding to the n identity IDs; the data provider generates n pairs of first public and private keys according to the number n of identity IDs for each query; and sending the first public key of the n pairs of first public and private keys and the serial number of the first public key to the authorization center.
[0018] In one embodiment of the present application, before the data user sends n identity IDs including the identity ID to be queried to the authorization center, the method also includes: the data user generates n-1 identity IDs other than the identity ID to be queried based on the number n; determines the serial number of the identity ID to be queried, and marks the identity ID to be queried; and sends the n identity IDs including the marked identity ID to be queried to the authorization center.
[0019] In one embodiment of the present application, the method further includes: determining whether the encryption / decryption algorithms are all XOR operations, and if so, the form of the key generated by the authorization center includes at least one of the following: a random number.
[0020] In one embodiment of the present application, after the authorization center applies for authorization from the queried object according to the identity ID to be queried, the method further includes: determining whether the queried object is authorized, and if not, the authorization center sends authorization failure information to the data user.
[0021] In one embodiment of the present application, the data provider determines whether the digital signature is correct based on the second public key of the authorization center, and the method further includes: if not, sending a query failure message to the data user.
[0022] A data use authorization device for anonymous query, comprising:
[0023] at least one processor; and,
[0024] a memory communicatively connected to the at least one processor; wherein,
[0025] The memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to:
[0026] The data user sends n identity IDs including the identity ID to be queried to the authorization center;
[0027] The authorization center applies for authorization from the object to be queried according to the identity ID to be queried. After the authorization center obtains the authorization from the object to be queried, it generates n keys corresponding to the n identity IDs; wherein the key corresponding to the identity ID to be queried is a valid key;
[0028] The authorization center encrypts the valid key according to the first public key corresponding to the identity ID to be queried provided by the data provider to form an encryption key, and replaces the valid key with the encryption key;
[0029] The authorization center digitally signs the n identity IDs and the n keys including the encryption key, and sends the digitally signed data and the original valid key to the data user;
[0030] The data user sends the digitally signed data returned by the authorization center to the data provider;
[0031] The data provider determines whether the digital signature is correct; if so, the data provider sequentially decrypts the n keys including the encryption key according to the first private key;
[0032] The data provider queries the information corresponding to the n identity IDs, then encrypts the n query results according to the decrypted n keys, and then sends the encrypted n query results to the data user;
[0033] The data user decrypts the query result of the identity ID to be queried according to the original valid key to obtain the query result of the identity ID to be queried.
[0034] A non-volatile storage medium storing computer executable instructions, wherein the computer executable instructions are configured to:
[0035] The data user sends n identity IDs including the identity ID to be queried to the authorization center;
[0036] The authorization center applies for authorization from the object to be queried according to the identity ID to be queried. After the authorization center obtains the authorization from the object to be queried, it generates n keys corresponding to the n identity IDs; wherein the key corresponding to the identity ID to be queried is a valid key;
[0037] The authorization center encrypts the valid key according to the first public key corresponding to the identity ID to be queried provided by the data provider to form an encryption key, and replaces the valid key with the encryption key;
[0038] The authorization center digitally signs the n identity IDs and the n keys including the encryption key, and sends the digitally signed data and the original valid key to the data user;
[0039] The data user sends the digitally signed data returned by the authorization center to the data provider;
[0040] The data provider determines whether the digital signature is correct; if so, the data provider sequentially decrypts the n keys including the encryption key according to the first private key;
[0041] The data provider queries the information corresponding to the n identity IDs, then encrypts the n query results according to the decrypted n keys, and then sends the encrypted n query results to the data user;
[0042] The data user decrypts the query result of the identity ID to be queried according to the original valid key to obtain the query result of the identity ID to be queried.
[0043] The present application provides a data use authorization method, device, and storage medium for anonymous query, which at least include the following beneficial effects: n keys are generated by the authorization center to ensure the security of the key. The authorization center encrypts the key of the kth identity ID that is actually queried, which can ensure that only the kth key is encrypted by the first public key, and can avoid the data user from tampering with the key. The authorization center digitally signs the n identity IDs to be queried and their corresponding keys, and the data user uses the signed information to query, which can avoid the data user from tampering with the query conditions. The authorization center is used to apply for authorization to use data from the queried object, which avoids the problem that the data user can forge authorization because the queried object is not disclosed to the data provider. The digital signature of the authorization center allows the data provider to confirm that the query is authorized by the queried object and strictly meets the legal requirements before providing the data. The authorization information of the queried object is stored in the authorization center for later audit and query. The authorization center can be conveniently expanded to store the authorization information on the blockchain to prevent denial of all parties. By using an authorized center to generate an encryption key and encrypt it, it can be easily extended to similar anonymous query technologies. BRIEF DESCRIPTION OF THE DRAWINGS
[0044] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:
[0045] Figure 1 A schematic diagram of data use authorization steps for an anonymous query provided in an embodiment of the present application;
[0046] Figure 2 A schematic diagram of the composition of a data usage authorization device for anonymous query provided in an embodiment of the present application. DETAILED DESCRIPTION
[0047] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be described clearly and completely in conjunction with the specific embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.
[0048] As data becomes a new factor of production, strengthening data circulation and promoting data development and utilization are important means to give full play to the value of data. The introduction of laws and regulations such as the Personal Information Protection Law and the Data Security Law provides a legal basis for protecting data security and personal privacy in data processing activities. These laws and regulations require data providers to obtain authorization and consent from individuals before providing personal data. At the same time, the protection of trade secrets has always been valued by businesses, but the query conditions for querying data will also reveal business information.
[0049] For example, in the scenario of an individual taking out a loan, Bank A inquires about the arrears of borrower B from telecom operator C in order to understand the credit status of borrower B. As a result, telecom operator C knows that borrower B is taking out a loan from Bank A. If operator C discloses this information to other banks, it will create business competition for Bank A. Therefore, Bank A hopes that operator C can find out the arrears of borrower B without knowing who is being inquired.
[0050] This application provides a data use authorization method, device, and storage medium for anonymous query. When bank A queries the arrears of borrower B, it can mix in the information of several (for example, 9) other people at the same time, and send the identity IDs of these 10 people to operator C at the same time for query; after operator C finds out the arrears of these 10 people, it encrypts them and then returns them all to bank A; bank A obtains the arrears information of these 10 people, and based on the anonymous query technology, it can decrypt the arrears information of borrower B, but cannot decrypt the arrears information of others. In this way, bank A has inquired about the arrears information of borrower B, but operator C only knows that bank A has inquired about 10 people, but does not know who among these people is taking out loans. The following is a detailed explanation.
[0051] It should be noted that, in the present invention, the personal information of users / data subjects obtained complies with the provisions of relevant laws and policies.
[0052] Figure 1 A schematic diagram of a method for authorizing the use of data for anonymous query provided in an embodiment of the present application may include the following steps:
[0053] S101: The data user sends n identity IDs including the identity ID to be queried to the authorization center.
[0054] In one embodiment of the present application, before querying data, the number n of identity IDs to be queried each time and the encryption / decryption algorithm of the n query results corresponding to the n identity IDs agreed upon by the data user and the data provider are determined; the data provider generates n pairs of first public and private keys according to the number n of identity IDs to be queried each time; and sends the first public key of the n pairs of first public and private keys and the serial number of the first public key to the authorization center.
[0055] The public and private keys are asymmetric keys, which require different keys to complete encryption and decryption operations respectively. One is published publicly, namely the public key, and the other is kept secretly by the user himself, namely the private key. The sender of the information uses the public key to encrypt, and the receiver of the information uses the private key to decrypt.
[0056] Specifically, the data user and the data provider reach a consensus on the number n of identity IDs for each query, that is, it is determined that n-1 obfuscated identity IDs are added for each query; the data provider generates n pairs of first public and private keys, number them in sequence, and sends all first public keys and their numbers to the authorization center; the data provider and the data user also reach a consensus on the encryption / decryption algorithm for the query results, the encryption algorithm is represented by E (message, key), and the decryption algorithm is represented by D (secret, key), and the same key is used for encryption / decryption, for example, both the encryption algorithm and the decryption algorithm use XOR operations.
[0057] In one embodiment of the present application, before the data user sends n identity IDs including the identity ID to be queried to the authorization center, the data user generates n-1 identity IDs other than the identity ID to be queried based on the number n, determines the serial number of the identity ID to be queried, and marks the identity ID to be queried; and sends the n identity IDs including the marked identity ID to be queried to the authorization center.
[0058] Specifically, each time the data user makes a query, n-1 identity IDs are generated for obfuscation. These identity IDs used for obfuscation should also be valid IDs, otherwise it is easy for the data provider to determine which one is the real query object; the data user sends these n identity IDs to the authorization center, and at the same time indicates the identity ID that is actually queried, that is, the serial number of the identity ID to be queried among these n identity IDs, such as k.
[0059] S102: The authorization center applies for authorization from the queried object according to the identity ID to be queried. After obtaining the authorization from the queried object, the authorization center generates n keys corresponding to n identity IDs; among which, the key corresponding to the identity ID to be queried is a valid key. If the queried object does not authorize, the authorization center sends a message of authorization failure to the data user.
[0060] Specifically, the authorization center obtains the kth identity ID to be queried and applies for authorization to the queried object corresponding to the identity ID to be queried. It should be noted that this application does not restrict the specific implementation method of applying for authorization. If the queried object does not agree to the authorization, the authorization center returns the authorization failure information to the data user.
[0061] When the authorization center obtains the authorization of the queried object, it generates a key for each identity ID. Different identity IDs have different keys. These keys will be used to encrypt the query results. The key corresponding to the kth identity ID to be queried is the valid key. For scenarios where the encryption / decryption algorithms are all XOR operations, the key can be a random number. In other scenarios, the key can also be a string, etc.
[0062] The authorization center generates a symmetric key for each identity ID. Symmetric key encryption means that the sender and receiver of the information use the same key to encrypt and decrypt data. Its biggest advantage is fast encryption / decryption speed, which is suitable for encrypting large amounts of data, but key management is difficult.
[0063] S103: The authorization center encrypts the valid key according to the first public key corresponding to the identity ID to be queried provided by the data provider to form an encryption key, and replaces the valid key with the encryption key.
[0064] Specifically, after the kth valid key is encrypted and replaced, among all the n keys, only the kth is encrypted by the first public key, and the others are still the original valid keys.
[0065] S104: The authorization center digitally signs the n identity IDs and the n keys including the encryption keys, and sends the digitally signed data and the original valid keys to the data user.
[0066] In one embodiment of the present application, the authorization center arranges and encodes n identity IDs and n keys containing encryption keys according to a preset order, and then performs a hash operation to obtain a corresponding digital summary; the digital summary is encrypted according to the second private key in the second public-private key generated by the authorization center to obtain a digital signature.
[0067] Specifically, the authorization center arranges and encodes the n identity IDs and their keys in sequence and then digitally signs them; the authorization center returns the signed n identity IDs and their n key information to the data user, where the kth key is encrypted with the public key; the authorization center also sends the kth key before encryption to the data user, so that the data user has the original valid key of the kth key.
[0068] S105: The data user sends the digitally signed data returned by the authorization center to the data provider.
[0069] Specifically, the data user sends the digitally signed information returned by the authorization center as query conditions to the data provider for query, but the kth original valid key must be retained by itself and cannot be sent to the data provider.
[0070] S106: The data provider determines whether the digital signature is correct; if so, the data provider decrypts the n keys including the encryption key in sequence according to the first private key. If not, a query failure message is sent to the data user.
[0071] In one embodiment of the present application, the data provider decrypts the digital signature according to the second public key of the authorization center to obtain a first digital summary; the data provider performs the same hash operation as the authorization center on n identity IDs and n keys containing encryption keys to obtain a second digital summary; the first digital summary and the second digital summary are compared to determine whether the first digital summary and the second digital summary are equal; if so, the verification is successful.
[0072] Specifically, the data provider verifies the digital signature of the received query condition with the second public key of the authorization center. If the signature verification fails, it indicates that the query condition has been tampered with, and a query failure message is returned to the data user.
[0073] If the signature confirmation is correct, it means that the query has been authorized by the queried object, and the corresponding query results can be provided to the data user.
[0074] S107: The data provider queries the information corresponding to the n identity IDs, then encrypts the n query results according to the decrypted n keys, and then sends the encrypted n query results to the data user.
[0075] Specifically, the data provider decrypts the key corresponding to each identity ID using the first private key in the corresponding order. After decryption, the kth encrypted key is restored to the original valid key. Since other keys are not encrypted using the first public key, they become new uncertain content after the decryption operation.
[0076] When the data provider sends the query result to the data user, the query result is encrypted by the data provider using the encryption algorithm E(message, key) agreed upon by both parties. During encryption, the query result of the i-th (1≤i≤n) identity is encrypted using the corresponding i-th key; only the k-th query result is encrypted using the original valid key, while the other query results are encrypted using uncertain content; for the data provider, he does not know which of the n keys is encrypted by the first public key, so the data provider does not know who the real queried object is.
[0077] S108: The data user decrypts the query result of the identity ID to be queried according to the original valid key to obtain the query result of the identity ID to be queried.
[0078] When receiving the encrypted query result, the data user adopts the decryption algorithm D (secret, key) agreed upon by both parties, and uses the k-th original valid key obtained from the authorization center to decrypt the k-th result, thereby obtaining the desired data. Since the data user does not know the first private key of the data provider, he cannot obtain the key used to encrypt other query results, that is, he cannot decrypt other query results.
[0079] The method provided in this application is applied to the data provider, the data user, and the authorization center. The authorization center is used to apply for authorization to the queried object and generate a key for encrypting the query result. The key exchange between the data user and the data provider is realized through a public key mechanism: the authorization center encrypts the kth key to be queried with the kth first public key of the data provider, and the data provider decrypts it with the kth first private key to obtain the original key, which is used to encrypt the kth query result. Each time a query is made, n keys are generated by the authorization center, which ensures the security of the key. The authorization center encrypts the key of the kth identity ID that is actually queried to ensure that only the kth key is encrypted by the first public key, which can avoid the data user from tampering with the key. The authorization center digitally signs the n identity IDs to be queried and their corresponding keys, and the data user takes the signed information to query, which can avoid the data user from tampering with the query conditions. The authorization center is operated to apply for authorization to use data from the queried object, which avoids the problem that the data user can forge authorization because the queried object is not disclosed to the data provider.
[0080] The above is a data usage authorization method for anonymous query provided by an embodiment of the present application. Based on the same inventive idea, an embodiment of the present application also provides a corresponding data usage authorization device for anonymous query, such as Figure 2 shown.
[0081] This embodiment provides a data use authorization device for anonymous query, including:
[0082] at least one processor; and,
[0083] a memory communicatively connected to at least one processor; wherein,
[0084] The memory stores instructions executable by at least one processor, the instructions being executed by at least one processor to enable the at least one processor to:
[0085] The data user sends n identity IDs including the identity ID to be queried to the authorization center;
[0086] The authorization center applies for authorization from the object to be queried based on the identity ID to be queried. After obtaining the authorization from the object to be queried, the authorization center generates n keys corresponding to n identity IDs; among them, the key corresponding to the identity ID to be queried is the valid key;
[0087] The authorization center encrypts the valid key according to the first public key corresponding to the identity ID to be queried provided by the data provider to form an encryption key, and replaces the valid key with the encryption key;
[0088] The authorization center digitally signs n identity IDs and n keys containing encryption keys, and sends the digitally signed data and the original valid keys to the data user;
[0089] The data user sends the digitally signed data returned by the authorization center to the data provider;
[0090] The data provider determines whether the digital signature is correct; if so, the data provider decrypts the n keys including the encryption key in sequence according to the first private key;
[0091] The data provider queries the information corresponding to n identity IDs, then encrypts the n query results according to the decrypted n keys, and then sends the encrypted n query results to the data user;
[0092] The data user decrypts the query result of the identity ID to be queried according to the original valid key to obtain the query result of the identity ID to be queried.
[0093] Based on the same idea, some embodiments of the present application also provide a medium corresponding to the above method.
[0094] Some embodiments of the present application provide a data usage authorization storage medium for anonymous query, which stores computer executable instructions, and the computer executable instructions are configured as follows:
[0095] The data user sends n identity IDs including the identity ID to be queried to the authorization center;
[0096] The authorization center applies for authorization from the object to be queried based on the identity ID to be queried. After obtaining the authorization from the object to be queried, the authorization center generates n keys corresponding to n identity IDs; among them, the key corresponding to the identity ID to be queried is the valid key;
[0097] The authorization center encrypts the valid key according to the first public key corresponding to the identity ID to be queried provided by the data provider to form an encryption key, and replaces the valid key with the encryption key;
[0098] The authorization center digitally signs n identity IDs and n keys containing encryption keys, and sends the digitally signed data and the original valid keys to the data user;
[0099] The data user sends the digitally signed data returned by the authorization center to the data provider;
[0100] The data provider determines whether the digital signature is correct; if so, the data provider decrypts the n keys including the encryption key in sequence according to the first private key;
[0101] The data provider queries the information corresponding to n identity IDs, then encrypts the n query results according to the decrypted n keys, and then sends the encrypted n query results to the data user;
[0102] The data user decrypts the query result of the identity ID to be queried according to the original valid key to obtain the query result of the identity ID to be queried.
[0103] Each embodiment in this application is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the method and medium embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.
[0104] The methods and media provided in the embodiments of the present application correspond one-to-one to the method, and therefore, the methods and media also have similar beneficial technical effects as the corresponding methods. Since the beneficial technical effects of the methods have been described in detail above, the beneficial technical effects of the methods and media will not be repeated here.
[0105] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or method including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or method. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or method including the elements.
[0106] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.
Claims
1. A data use authorization method for anonymous query, characterized in that: Applicable to data users, authorization centers, and data providers, including: The data user sends n identity IDs including the identity ID to be queried to the authorization center; The authorization center applies for authorization from the object to be queried according to the identity ID to be queried. After the authorization center obtains the authorization from the object to be queried, it generates n keys corresponding to the n identity IDs; wherein the key corresponding to the identity ID to be queried is a valid key; The authorization center encrypts the valid key according to the first public key corresponding to the identity ID to be queried provided by the data provider to form an encryption key, and replaces the valid key with the encryption key; The authorization center digitally signs the n identity IDs and the n keys including the encryption key, and sends the digitally signed data and the original valid key to the data user; The data user sends the digitally signed data returned by the authorization center to the data provider; The data provider determines whether the digital signature is correct; if so, the data provider sequentially decrypts the n keys including the encryption key according to the first private key; The data provider queries the information corresponding to the n identity IDs, then encrypts the n query results according to the decrypted n keys, and then sends the encrypted n query results to the data user; The data user decrypts the query result of the identity ID to be queried according to the original valid key to obtain the query result of the identity ID to be queried; Before querying the data, the method further includes: Determine the number n of identity IDs agreed upon by the data user and the data provider for each query and the encryption / decryption algorithm of the n query results corresponding to the n identity IDs; The data provider generates n pairs of first public and private keys according to the number n of identity IDs queried each time; and sending the first public key of the n pairs of first public and private keys and the serial number of the first public key to the authorization center; Before the data user sends n identity IDs including the identity ID to be queried to the authorization center, the method further includes: The data user generates n-1 identity IDs other than the identity ID to be queried according to the number n; Determine the serial number of the identity ID to be queried, and mark the identity ID to be queried; The n identity IDs including the marked identity ID to be queried are sent to the authorization center.
2. The method according to claim 1, characterized in that The authorization center digitally signs the n identity IDs and the n keys containing the encryption key, specifically including: The authorization center arranges and encodes the n identity IDs and the n keys including the encryption key according to a preset order, and then performs a hash operation to obtain a corresponding digital summary; The digital summary is encrypted according to the second private key in the second public-private key generated by the authorization center to obtain a digital signature.
3. The method according to claim 1, characterized in that: The data provider determines whether the digital signature is correct, specifically including: The data provider decrypts the digital signature according to the second public key of the authorization center to obtain a first digital summary; The data provider performs the same hash operation as the authorization center on the n identity IDs and the n keys including the encryption key to obtain a second digital summary; Comparing the first digital digest with the second digital digest to determine whether the first digital digest is equal to the second digital digest; If yes, the verification is successful.
4. The method according to claim 1, characterized in that: The method further comprises: Determine whether the encryption / decryption algorithms are all XOR operations. If so, the key generated by the authorization center includes at least one of the following forms: a random number.
5. The method according to claim 1, characterized in that After the authorization center applies for authorization from the queried object according to the identity ID to be queried, the method further includes: Determine whether the queried object is authorized. If not, the authorization center sends authorization failure information to the data user.
6. The method according to claim 1, characterized in that The data provider determines whether the digital signature is correct based on the second public key of the authorization center, and the method further includes: If not, a query failure message is sent to the data user.
7. A data use authorization device for anonymous query, characterized in that: include: at least one processor; as well as, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to: The data user sends n identity IDs including the identity ID to be queried to the authorization center; The authorization center applies for authorization from the object to be queried according to the identity ID to be queried. After the authorization center obtains the authorization from the object to be queried, it generates n keys corresponding to the n identity IDs; wherein the key corresponding to the identity ID to be queried is a valid key; The authorization center encrypts the valid key according to the first public key corresponding to the identity ID to be queried provided by the data provider to form an encryption key, and replaces the valid key with the encryption key; The authorization center digitally signs the n identity IDs and the n keys including the encryption key, and sends the digitally signed data and the original valid key to the data user; The data user sends the digitally signed data returned by the authorization center to the data provider; The data provider determines whether the digital signature is correct; if so, the data provider sequentially decrypts the n keys including the encryption key according to the first private key; The data provider queries the information corresponding to the n identity IDs, then encrypts the n query results according to the decrypted n keys, and then sends the encrypted n query results to the data user; The data user decrypts the query result of the identity ID to be queried according to the original valid key to obtain the query result of the identity ID to be queried; Before querying data, also include: Determine the number n of identity IDs agreed upon by the data user and the data provider for each query and the encryption / decryption algorithm of the n query results corresponding to the n identity IDs; The data provider generates n pairs of first public and private keys according to the number n of identity IDs queried each time; and sending the first public key of the n pairs of first public and private keys and the serial number of the first public key to the authorization center; Before the data user sends the n identity IDs including the identity ID to be queried to the authorization center, the method further includes: The data user generates n-1 identity IDs other than the identity ID to be queried according to the number n; Determine the serial number of the identity ID to be queried, and mark the identity ID to be queried; The n identity IDs including the marked identity ID to be queried are sent to the authorization center.
8. A non-volatile storage medium storing computer executable instructions, characterized in that: The computer executable instructions are configured to: The data user sends n identity IDs including the identity ID to be queried to the authorization center; The authorization center applies for authorization from the object to be queried according to the identity ID to be queried. After the authorization center obtains the authorization from the object to be queried, it generates n keys corresponding to the n identity IDs; wherein the key corresponding to the identity ID to be queried is a valid key; The authorization center encrypts the valid key according to the first public key corresponding to the identity ID to be queried provided by the data provider to form an encryption key, and replaces the valid key with the encryption key; The authorization center digitally signs the n identity IDs and the n keys including the encryption key, and sends the digitally signed data and the original valid key to the data user; The data user sends the digitally signed data returned by the authorization center to the data provider; The data provider determines whether the digital signature is correct; if so, the data provider sequentially decrypts the n keys including the encryption key according to the first private key; The data provider queries the information corresponding to the n identity IDs, then encrypts the n query results according to the decrypted n keys, and then sends the encrypted n query results to the data user; The data user decrypts the query result of the identity ID to be queried according to the original valid key to obtain the query result of the identity ID to be queried; Before querying data, also include: Determine the number n of identity IDs agreed upon by the data user and the data provider for each query and the encryption / decryption algorithm of the n query results corresponding to the n identity IDs; The data provider generates n pairs of first public and private keys according to the number n of identity IDs queried each time; and sending the first public key of the n pairs of first public and private keys and the serial number of the first public key to the authorization center; Before the data user sends the n identity IDs including the identity ID to be queried to the authorization center, the method further includes: The data user generates n-1 identity IDs other than the identity ID to be queried according to the number n; Determine the serial number of the identity ID to be queried, and mark the identity ID to be queried; The n identity IDs including the marked identity ID to be queried are sent to the authorization center.