A method and system for realizing cross-network application of sensitive identity information
By transmitting encrypted information between the server encryption machine and the decryptor on the Internet side and the secure isolated network side, using QR code to realize cross-net application of sensitive identity information, the problem of hardware carrier dependence in the existing technology is solved, and efficient Secure and sensitive identity information decrypts, simplifying device management and maintenance.
Patent Information
- Application Number
- CN202210134074.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-02-14
- Publication Date
- 2024-12-17
- Estimated Expiration
- 2042-02-14
AI Technical Summary
When implementing cross-network applications of sensitive identity information, the existing technology needs to rely on hardware carriers, such as second-generation ID cards or QR code readers with security chips, which has a large transformation cost, especially in those that have been deployed. When the device is updated.
By setting up server encryption and decryption machines on the Internet and secure isolation networks, using QR codes to transmit encrypted information, and decrypting them in the isolation network, hardware transformation of the scanning code device is avoided, and isolation gates and files are used The switch performs key synchronization update.
It supports the decryption of sensitive identity information in the isolated network without modifying the original scanning device, simplifying management and maintenance, improving operational efficiency and security, and reducing equipment update costs.
Smart Images
Figure CN114491641B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of data security technology, and in particular to a method and system for implementing cross-network application of sensitive identity information. Background Art
[0002] Generally, national government agencies and public security management departments that need to verify the true identity information of customers all use the method of checking the second-generation ID card. The second-generation ID card is an offline carrier, and the sensitive identity information is stored inside the certificate. The ID card reader can only read the data in the certificate, but cannot output data to the certificate, so there is no need to worry about the leakage of the intranet system when using the second-generation ID card. Reading the sensitive identity information of the second-generation ID card does not require access to the network, and the business process uses the read information to proceed.
[0003] Another way to transmit identity information is to use a QR code as a storage medium. The information generator encrypts the sensitive information and compiles it into the QR code. At the same time, a QR code reader equipped with a specific security chip is used in the isolated network to scan the QR code and use the security chip to decrypt the sensitive identity information, thus achieving the function of obtaining sensitive identity information offline.
[0004] The above two methods either rely on hardware carriers (second-generation ID cards). If electronic information carriers (such as QR codes) are used, the reader needs to be equipped with a corresponding security chip to decrypt the information. For the deployed equipment, there is a large cost for transformation. Summary of the invention
[0005] The present application provides a method and system for implementing cross-network application of sensitive identity information, which can be applied to scenarios where sensitive identity data generated by the Internet is applied offline in a strictly isolated network.
[0006] In view of this, the first aspect of the present application provides a method for implementing cross-network application of sensitive identity information, characterized in that the method is applied to an implementation system of cross-network application of sensitive identity information, the implementation system of cross-network application of sensitive identity information includes an Internet end, a user terminal, an isolation network gate and a security isolation network end, the Internet end includes a first application system and a server encryption machine, the security isolation network includes a code scanning device, a second application system, and a server decryption machine, the method includes: the server encryption machine requests sensitive identity information from the identity library system, and encrypts the sensitive identity information and transmits it to the first application system; the first application system generates a QR code based on the encrypted sensitive identity information; the user terminal obtains the QR code from the Internet end and displays the QR code to the code scanning device; the code scanning device scans the QR code and transmits the read QR code data to the second application system; the second application system transmits the QR code data to the server decryption machine; the server decryption machine decrypts the QR code data to obtain sensitive identity information and related business information.
[0007] Optionally, in combination with the first aspect, in a possible implementation, a network access relationship is established between the server decryption machine and the second application system, the isolation network gateway is arranged between the Internet end and the secure isolation network end, and the Internet end and the secure isolation network end are respectively provided with a file switch.
[0008] Optionally, in combination with the first aspect, in a possible implementation, the method further includes: the server encryption machine periodically generates a key file and submits it to the server decryption machine through an isolation network gate to achieve synchronous update and replacement of the key, wherein the key file is protected by a digital envelope.
[0009] Optionally, in combination with the first aspect, in a possible implementation, the method further includes: the server encryption machine configures a setting number for the key file, and distributes the setting number to the server decryption machine; the server decryption machine retains the key file with the setting number, and when the server decryption machine receives the QR code, the setting number is used to instruct the server decryption machine to select and use the corresponding key file; when the server encryption machine determines that the timing for switching the key file has arrived based on the setting number, it switches to the key file corresponding to the setting number.
[0010] Optionally, in combination with the first aspect, in a possible implementation, the method further includes: the server encryption machine sets the plaintext or plaintext transformation value of the set number in the sensitive identity information ciphertext; the server decryption machine reads the plaintext or plaintext transformation value of the set number according to the sensitive identity information ciphertext; the server decryption machine determines the corresponding key file according to the plaintext or plaintext transformation value of the set number, and decrypts the sensitive identity information ciphertext according to the corresponding key file.
[0011] The second aspect of the present application provides a system for implementing cross-network application of sensitive identity information, characterized in that the system for implementing cross-network application of sensitive identity information includes an Internet terminal, a user terminal, an isolation network gate and a security isolation network terminal, the Internet terminal includes a first application system and a server encryption machine, the security isolation network includes a code scanning device, a second application system, and a server decryption machine, the server encryption machine is used to request sensitive identity information from the identity library system, and encrypt the sensitive identity information and transmit it to the first application system; the first application system is used to generate a QR code based on the encrypted sensitive identity information; the user terminal is used to obtain the QR code from the Internet terminal and display the QR code to the code scanning device; the code scanning device is used to scan the QR code and transmit the read QR code data to the second application system; the second application system is used to transmit the QR code data to the server decryption machine; the server decryption machine is used to decrypt the QR code data to obtain sensitive identity information and related business information.
[0012] Optionally, in combination with the second aspect, in a possible implementation, a network access relationship is established between the server decryption machine and the second application system, the isolation network gateway is arranged between the Internet end and the secure isolation network end, and the Internet end and the secure isolation network end are respectively provided with a file switch.
[0013] Optionally, in combination with the second aspect, in a possible implementation, the server encryption machine is also used to periodically generate key files and submit them to the server decryption machine through an isolation network gate to achieve synchronous update and replacement of keys, wherein the key files are protected by a digital envelope.
[0014] Optionally, in combination with the second aspect, in a possible implementation, the server encryption machine is also used to configure a setting number for the key file and distribute the setting number to the server decryption machine; the server decryption machine is also used to retain the key file with the setting number, and when the server decryption machine receives the QR code, the setting number is used to instruct the server decryption machine to select and use the corresponding key file; the server encryption machine is also used to switch to the key file corresponding to the setting number when it is determined according to the setting number that the switching timing of the key file has arrived.
[0015] Optionally, in combination with the second aspect, in a possible implementation method, the server encryption machine is used to set the plaintext or plaintext transformation value of the set number in the sensitive identity information ciphertext; the server decryption machine is used to read the plaintext or plaintext transformation value of the set number according to the sensitive identity information ciphertext; the server decryption machine is used to determine the corresponding key file according to the plaintext or plaintext transformation value of the set number, and decrypt the sensitive identity information ciphertext according to the corresponding key file.
[0016] The present application provides a method and system for implementing cross-network application of sensitive identity information. The method is applied to the implementation system of cross-network application of sensitive identity information. The implementation system of cross-network application of sensitive identity information includes an Internet terminal, a user terminal, an isolation network gate and a security isolation network terminal. The Internet terminal includes a first application system and a server encryption machine. The security isolation network includes a code scanning device, a second application system, and a server decryption machine. The method includes: the server encryption machine requests sensitive identity information from an identity library system, and encrypts the sensitive identity information and transmits it to the first application system; the first application system generates a QR code based on the encrypted sensitive identity information; the user terminal obtains the QR code from the Internet terminal and displays the QR code to the code scanning device; the code scanning device scans the QR code and transmits the read QR code data to the second application system; the second application system transmits the QR code data to the server decryption machine; the server decryption machine decrypts the QR code data to obtain sensitive identity information and related business information. Compared with the method of introducing a security chip on the scanning device side, this method does not require the original scanning devices to be modified one by one. It only needs to add a server decryption machine in an isolated network to support all scanning devices in the isolated network to realize the function of decrypting sensitive identity information. BRIEF DESCRIPTION OF THE DRAWINGS
[0017] Figure 1 A schematic diagram of a system for implementing cross-network application of sensitive identity information in an embodiment of the present application;
[0018] Figure 2A flowchart of a method for implementing cross-network application of sensitive identity information in an embodiment of the present application. DETAILED DESCRIPTION
[0019] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.
[0020] The term "and / or" in this application can be a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this application generally indicates that the associated objects before and after are in an "or" relationship.
[0021] The terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or modules is not necessarily limited to those steps or modules that are clearly listed, but may include other steps or modules that are not clearly listed or inherent to these processes, methods, products or devices.
[0022] Generally, national government agencies and public security management departments that need to verify the true identity information of customers all use the method of checking the second-generation ID card. The second-generation ID card is an offline carrier, and the sensitive identity information is stored inside the certificate. The ID card reader can only read the data in the certificate, but cannot output data to the certificate, so there is no need to worry about the leakage of the intranet system when using the second-generation ID card. Reading the sensitive identity information of the second-generation ID card does not require access to the network, and the business process uses the read information to proceed.
[0023] Another way to transmit identity information is to use a QR code as a storage medium. The information generator encrypts the sensitive information and compiles it into the QR code. At the same time, a QR code reader equipped with a specific security chip is used in the isolated network to scan the QR code and use the security chip to decrypt the sensitive identity information, thus achieving the function of obtaining sensitive identity information offline.
[0024] The above two methods either rely on hardware carriers (second-generation ID cards). If electronic information carriers (such as QR codes) are used, the reader needs to be equipped with a corresponding security chip to decrypt the information. For the deployed equipment, there is a large cost for transformation.
[0025] Therefore, this application provides a system for implementing cross-network application of sensitive identity information. Figure 1 The implementation system of the cross-network application of sensitive identity information includes an Internet terminal, a secure isolation network terminal, a user terminal and an isolation network gate, wherein the Internet terminal includes a first application system, a server encryption machine and a file switch. The secure isolation network terminal includes a code scanning device, a second application system, a server decryption machine, and a file switch.
[0026] Based on the implementation system of the cross-network application of sensitive identity information, this application provides a method for implementing the cross-network application of sensitive identity information, please refer to Figure 2 , the method comprising:
[0027] S110. The server encryption machine requests the sensitive identity information from the identity database system, and encrypts the sensitive identity information and transmits it to the first application system.
[0028] The data carrier that carries sensitive identity information is a QR code. The Internet application system encrypts the sensitive identity information through a dedicated server encryption machine and puts it into the QR code. A dedicated server decryption machine is deployed in the strictly isolated network end to decrypt the sensitive identity information. The two networks are isolated by an isolation network gate, and direct network access is not possible.
[0029] The QR code is generated by the first application system on the Internet, and before the code is generated, it needs to request sensitive identity information from the identity database system. The identity database system uses a dedicated server encryption machine to encrypt the sensitive identity information and then hand it over to the first application system.
[0030] S120. The first application system generates a QR code according to the encrypted sensitive identity information.
[0031] The first application system organizes the ciphertext into the QR code data and then generates the QR code as a whole.
[0032] S130: The user terminal obtains the QR code from the Internet terminal and displays the QR code to the scanning device.
[0033] The user terminal obtains the QR code from the first application system through an application (APP), and displays it to the scanning device for the device in the safety isolation network to scan. The scanning device can be an existing ordinary scanning gun, scanner, etc., without modification.
[0034] S140: The code scanning device scans the QR code and transmits the read QR code data to the second application system.
[0035] The code scanning device passes the read QR code data to the second application system to which it belongs.
[0036] S150. The second application system transmits the QR code data to the server decryption machine.
[0037] The second application system uniformly delivers the two-dimensional code data to a dedicated server decryption machine deployed in its isolated network.
[0038] S160. The server decryptor decrypts the QR code data to obtain sensitive identity information and related business information.
[0039] The server decryptor decrypts the QR code data to obtain sensitive identity information and other relevant business information.
[0040] The decryption service provided by the server decryptor in the isolated network is online. One server decryptor can support the decryption requests of thousands of code scanning devices. It only needs the second application system to establish a network access relationship with the server decryptor, and the code scanning device does not need to be modified in terms of software and hardware. From the perspective of the entire network, the server decryptor is in an offline working state, and it is disconnected from the code generation system when running the decryption function. There are strict network isolation facilities between the first application system for code generation and the second application system for code scanning.
[0041] Even if there is strict network isolation, the first application system and the second application system must ensure the synchronization of encryption and decryption keys. The server encryption machine can regularly generate new encryption keys, protect them with digital envelopes, and submit them to the server decryption machine in the form of files through the network gate, thereby achieving synchronous update and replacement of keys.
[0042] Furthermore, the method also includes: the server encryption machine configures a setting number for the key file, and distributes the setting number to the server decryption machine; the server decryption machine retains the key file with the setting number, and when the server decryption machine receives the QR code, the setting number is used to instruct the server decryption machine to select and use the corresponding key file; when the server encryption machine determines that the switching time of the key file has been reached according to the setting number, it switches to the key file corresponding to the setting number. It should be noted that the setting number may include a switching date, or a specific switching time. When the switching date or the specific switching time is reached, the server encryption machine switches the key file, and one or more key files may be stored in the server decryption machine. When the server decryption machine receives the ciphertext, it can first read the key number in the ciphertext, and then determine the key file with the same setting number according to the key number, and use the key file for decryption. In principle, the server encryption machine and the server decryption machine only need to store two sets of keys, one for the keys currently in use, and one for the keys to be enabled. In reality, there is enough space in the server encryption machine and the server decryption machine to store dozens or even hundreds of key groups, so that multiple key groups can be selected for encryption and decryption.
[0043] Furthermore, the method further includes: the server encryption machine sets the plain text or plain text transformation value of the setting number in the sensitive identity information ciphertext; the server decryption machine reads the plain text or plain text transformation value of the setting number according to the sensitive identity information ciphertext; the server decryption machine determines the corresponding key file according to the plain text or plain text transformation value of the setting number, and decrypts the sensitive identity information ciphertext according to the corresponding key file. In this way, the setting number can be carried in the sensitive identity information ciphertext, realizing the synchronous switching of the keys of the server encryption machine and the server decryption machine.
[0044] See also Figure 1 In the implementation system of cross-network application of common sensitive identity information provided by the present application, the server encryption machine is used to request sensitive identity information from the identity library system, and transmit the sensitive identity information to the first application system after encryption; the first application system is used to generate a QR code according to the encrypted sensitive identity information; the user terminal is used to obtain the QR code from the Internet terminal and display the QR code to the scanning device; the scanning device is used to scan the QR code and transmit the read QR code data to the second application system; the second application system is used to transmit the QR code data to the server decryption machine; the server decryption machine is used to decrypt the QR code data to obtain sensitive identity information and related business information.
[0045] Furthermore, a network access relationship is established between the server decryption machine and the second application system, the isolation network gate is arranged between the Internet end and the security isolation network end, and the Internet end and the security isolation network end are respectively provided with a file switch.
[0046] Furthermore, the server encryption machine is also used to periodically generate key files and submit them to the server decryption machine through the isolation network gate to achieve synchronous update and replacement of keys, wherein the key files are protected by digital envelopes.
[0047] Furthermore, the server encryption machine is also used to configure a setting number for the key file and distribute the setting number to the server decryption machine; the server decryption machine is also used to retain the key file with the setting number, and when the server decryption machine receives the QR code, the setting number is used to instruct the server decryption machine to select and use the corresponding key file; the server encryption machine is also used to switch to the key file corresponding to the setting number when it is determined according to the setting number that the switching timing of the key file has arrived.
[0048] Furthermore, the server encryption machine is used to set the plaintext or plaintext transformation value of the set number in the sensitive identity information ciphertext; the server decryption machine is used to read the plaintext or plaintext transformation value of the set number according to the sensitive identity information ciphertext; the server decryption machine is used to determine the corresponding key file according to the plaintext or plaintext transformation value of the set number, and decrypt the sensitive identity information ciphertext according to the corresponding key file.
[0049] The implementation method and system of the cross-network application of sensitive identity information provided by this application can transform the distributed scanning device-side decryption of sensitive identity information into a centralized server decryption machine for unified decryption; through customized encryption machines and decryption machines, dedicated machines are used for dedicated purposes to ensure operational efficiency, reliability and security. Specifically, it has the following advantages:
[0050] 1. Compared with the method of introducing security chips on the scanning device side, this solution does not require the original scanning devices to be modified one by one. It only needs to add a server decryption machine in an isolated network to support all scanning devices in the network to realize the function of decrypting sensitive identity information;
[0051] 2. Both the server encryption machine and the server decryption machine are custom-developed, with the model certificate of the National Cryptography Bureau and the inspection and testing report of the Ministry of Public Security. They are information security hardware-level products with high security and reliability;
[0052] 3. From managing and maintaining hundreds or thousands of distributed scanning device terminals, it becomes necessary to manage and maintain only one server placed in a fixed location, making key synchronization and other operation and maintenance work simple.
[0053] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.
[0054] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.
[0055] In the embodiments provided in this application, it should be understood that the disclosed methods can be implemented in other ways without exceeding the spirit and scope of this application. The current embodiment is only an illustrative example and should not be used as a limitation. The specific content given should not limit the purpose of this application. For example, some features can be ignored or not executed.
[0056] The technical means disclosed in the present application are not limited to the technical means disclosed in the above-mentioned implementation methods, but also include technical solutions composed of any combination of the above technical features. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of this application, and these improvements and modifications are also regarded as the protection scope of this application.
[0057] The above is a detailed introduction to the implementation method and system for cross-network application of sensitive identity information provided by the embodiments of the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for those of ordinary skill in the art, according to the idea of the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application. Although the present application has been described in detail with reference to the aforementioned embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein; and these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.
Claims
1. A method for implementing cross-network application of sensitive identity information, characterized in that: The method is applied to a system for implementing cross-network application of sensitive identity information, the system for implementing cross-network application of sensitive identity information includes an Internet terminal, a user terminal, an isolation network gate and a security isolation network terminal, the Internet terminal includes a first application system and a server encryption machine, the security isolation network includes a code scanning device, a second application system and a server decryption machine, and the method includes: The server encryption machine requests sensitive identity information from the identity database system, and encrypts the sensitive identity information and transmits it to the first application system; The first application system generates a QR code based on the encrypted sensitive identity information; The user terminal obtains the QR code from the Internet terminal and displays the QR code to the code scanning device; The code scanning device scans the QR code and transmits the read QR code data to the second application system; The second application system transmits the two-dimensional code data to the server decryption machine; The server decryption machine decrypts the QR code data to obtain sensitive identity information and related business information; The server decryption machine has established a network access relationship with the second application system, the isolation network gate is arranged between the Internet end and the security isolation network end, and the Internet end and the security isolation network end are respectively provided with a file switch; The server encryption machine periodically generates a key file and submits it to the server decryption machine through the isolation network gate to achieve synchronous key update and replacement, wherein the key file is protected by a digital envelope; The server encryption machine configures a setting number for the key file and distributes the setting number to the server decryption machine; When the server decryption machine determines that the switching time of the key file has arrived according to the setting number, the server decryption machine switches to the key file corresponding to the setting number; When the server encryption machine determines that the time to switch the key file has arrived based on the setting number, it switches to the key file corresponding to the setting number.
2. The method for implementing cross-network application of sensitive identity information according to claim 1, characterized in that: The method further comprises: The server encryption machine sets the plain text or plain text transformation value of the set number in the sensitive identity information ciphertext; The server decryption machine reads the plain text or plain text transformation value of the set number according to the sensitive identity information ciphertext; The server decryption machine determines the corresponding key file according to the plaintext or plaintext transformation value of the set number, and decrypts the sensitive identity information ciphertext according to the corresponding key file.
3. A system for implementing cross-network application of sensitive identity information, characterized in that: The implementation system of the cross-network application of sensitive identity information includes an Internet terminal, a user terminal, an isolation network gate and a security isolation network terminal. The Internet terminal includes a first application system and a server encryption machine. The security isolation network includes a code scanning device, a second application system, and a server decryption machine. The server encryption machine is used to request sensitive identity information from the identity database system, and encrypt the sensitive identity information and transmit it to the first application system; The first application system is used to generate a QR code based on the encrypted sensitive identity information; The user terminal is used to obtain the QR code from the Internet terminal and display the QR code to the code scanning device; The code scanning device is used to scan the two-dimensional code and transmit the read two-dimensional code data to the second application system; The second application system is used to transmit the two-dimensional code data to the server decryption machine; The server decryption machine is used to decrypt the QR code data to obtain sensitive identity information and related business information; The server decryption machine has established a network access relationship with the second application system, the isolation network gate is arranged between the Internet end and the security isolation network end, and the Internet end and the security isolation network end are respectively provided with a file switch; The server encryption machine is also used to regularly generate key files and submit them to the server decryption machine through the isolation network gate to achieve key synchronization update and replacement, wherein the key files are protected by digital envelopes; The server encryption machine is also used to configure a setting number for the key file and distribute the setting number to the server decryption machine; The server decryption machine is further configured to switch to the key file corresponding to the setting number when it is determined according to the setting number that the switching timing of the key file has arrived; The server encryption machine is further used to switch to the key file corresponding to the setting number when it is determined according to the setting number that the switching timing of the key file has arrived.
4. The system for realizing cross-network application of sensitive identity information according to claim 3, characterized in that: The server encryption machine is used to set the plain text or plain text transformation value of the set number in the sensitive identity information ciphertext; The server decryption machine is used to read the plain text or plain text transformation value of the set number according to the sensitive identity information ciphertext; The server decryption machine is used to determine the corresponding key file according to the plain text or plain text transformation value of the set number, and decrypt the sensitive identity information ciphertext according to the corresponding key file.