A privacy protection authorization method and system, electronic equipment, storage medium

Abstract

The application provides a privacy protection authorization method and system, an electronic device and a storage medium, and the method comprises the following steps: a first system sends customer information requiring authorization to a second system; the second system authorizes the request of the first system related to the customer information successfully; if the customer corresponding to the customer information is an authorized customer, the second system authorizes the request of the first system related to the customer information successfully; if the customer corresponding to the customer information is not an authorized customer, the second system fails to authorize the request of the first system related to the customer information; thereby, privacy protection is implemented in the authentication process, privacy protection in different stages is implemented, the exposure of customer information caused by direct transmission of customer information is avoided, no additional user operation is required, the user experience is improved, and the security of the authentication and authorization process is effectively improved.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of data transmission, and more particularly, relates to a privacy protection authorization method and system, an electronic device, and a storage medium. BACKGROUND

[0002] The prior art evaluates the privacy control capability of a SaaS service through a series of indexes, protects user data security, and actually controls the authorization system, but cannot protect privacy at different stages. SUMMARY

[0003] Therefore, the present application aims to provide a privacy protection authorization method and system, an electronic device, and a storage medium, which are used to implement privacy protection in an authentication process and achieve privacy protection at different stages.

[0004] The first aspect of the present application discloses a privacy protection authorization method, comprising:

[0005] The first system sends customer information that needs to obtain authorization to the second system;

[0006] The second system authorizes the related request of the customer information in the first system;

[0007] If the customer corresponding to the customer information is an authorized customer, the second system authorizes the related request of the customer information in the first system successfully;

[0008] If the customer corresponding to the customer information is not an authorized customer, the second system authorizes the related request of the customer information in the first system unsuccessfully.

[0009] Optionally, in the above privacy protection authorization method, the first system sends customer information that needs to obtain authorization to the second system, comprising:

[0010] The first system obtains customer identity information that needs to be authorized;

[0011] The first system generates the customer information according to the customer identity information;

[0012] The first system sends the customer information to the second system.

[0013] Optionally, in the above privacy protection authorization method, the customer identity information comprises a name, a gender, and an ID number;

[0014] The first system generates the customer information according to the customer identity information, comprising:

[0015] A customer information string is generated based on the customer's name, gender, and ID number; a hash calculation is performed on the customer information string to obtain the hash value of the customer ID; the first 32 bits of the hash value of the customer ID are extracted as the customer information; wherein, the total number of bits in the hash value of the customer ID is 64 bits.

[0016] Optionally, in the above privacy protection authorization method, the second system authorizes requests related to customer information in the first system, including:

[0017] The second system performs matching based on the first 32 bits of the hash value to obtain multiple matching results; sets a random number for each matching result; combines the last 32 bits of each matching result with the random number to form a new number string; performs a 64-bit hash calculation on the number string to obtain a first hash string; and sends the first hash string and the random number to the first system.

[0018] The first system performs a hash calculation based on the random number in the matching information and the last 32 bits of the hash value of the customer ID obtained by the first system to obtain a second hash string;

[0019] The first system matches the second hash string with the first hash string;

[0020] If the match is successful, the customer corresponding to the customer information is an authorized customer;

[0021] If the match fails, the customer information corresponding to the customer is not an authorized customer.

[0022] Optionally, in the above privacy protection authorization method, the successful authorization of the second system for the relevant request for customer information in the first system includes:

[0023] The first system sends the customer's digital signature to the second system;

[0024] The second system completes the authorization of the customer.

[0025] The second aspect of this application discloses a privacy-protected authorization system, comprising:

[0026] The sending module is used by the first system to send customer information that requires authorization to the second system;

[0027] The authorization module is used by the second system to authorize requests related to customer information in the first system; if the customer corresponding to the customer information is an authorized customer, the second system successfully authorizes the requests related to customer information in the first system; if the customer corresponding to the customer information is not an authorized customer, the second system fails to authorize the requests related to customer information in the first system.

[0028] Optionally, in the above-mentioned privacy protection authorization system, when the sending module is used by the first system to send customer information requiring authorization to the second system, it is specifically used for:

[0029] The first system obtains the identity information of the customer who needs authorization;

[0030] The first system generates the customer information based on the customer identity information;

[0031] The first system sends the customer information to the second system.

[0032] Optionally, in the aforementioned privacy protection authorization system, the customer identity information includes: name, gender, and ID card number;

[0033] The sending module is used when the first system generates the customer information based on the customer identity information, specifically for:

[0034] A customer information string is generated based on the customer's name, gender, and ID number; a hash calculation is performed on the customer information string to obtain the hash value of the customer ID; the first 32 bits of the hash value of the customer ID are extracted and sent to the second system; wherein, the total number of bits of the hash value of the customer ID is 64 bits.

[0035] A third aspect of this application discloses an electronic device, comprising:

[0036] One or more processors;

[0037] A storage device on which one or more programs are stored;

[0038] When one or more programs are executed by one or more processors, the one or more processors implement the privacy protection authorization method as described in any one of the first aspects of this application.

[0039] The fourth aspect of this application discloses a storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the privacy protection authorization method as described in any one of the first aspects of this application.

[0040] As can be seen from the above technical solution, the privacy protection authorization method provided by the present invention includes: a first system sending customer information that needs to be authorized to a second system; the second system successfully authorizing the relevant request for customer information in the first system; if the customer information corresponds to an authorized customer, the second system successfully authorizes the relevant request for customer information in the first system; if the customer information corresponds to an authorized customer, the second system fails to authorize the relevant request for customer information in the first system; thereby realizing privacy protection during the authentication process and achieving privacy protection at different stages; avoiding the problem of customer information exposure caused by directly transmitting customer information, and requiring no additional user operation, thus improving the user experience while effectively enhancing the security of the authentication and authorization process. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0042] Figure 1 This is a flowchart of a privacy protection authorization method provided in an embodiment of the present invention;

[0043] Figure 2 This is a flowchart of another privacy protection authorization method provided in an embodiment of the present invention;

[0044] Figure 3 This is a flowchart of another privacy protection authorization method provided in an embodiment of the present invention;

[0045] Figure 4 This is a flowchart of another privacy protection authorization method provided in an embodiment of the present invention;

[0046] Figure 5 This is a flowchart of another privacy protection authorization method provided in an embodiment of the present invention;

[0047] Figure 6 This is a schematic diagram illustrating the transmission of hash values ​​between two systems in a privacy protection authorization method provided in an embodiment of the present invention;

[0048] Figure 7 This is a schematic diagram of a privacy protection authorization system provided in an embodiment of the present invention;

[0049] Figure 8 This is a schematic diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0051] In this application, the terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0052] The first aspect of this application discloses a privacy-protected authorization method to address the problem that existing technologies evaluate the privacy control capabilities of SaaS services through a series of indicators to protect user data security, which is essentially a control of the authorization system but cannot protect privacy at different stages.

[0053] See Figure 1 The privacy protection authorization method includes:

[0054] S101, The first system sends customer information that requires authorization to the second system.

[0055] It should be noted that if the first system needs to obtain the customer's authorization, it can send the customer's information to the second system.

[0056] This customer information can uniquely identify a customer; specifically, this customer information may include information such as ID card number, which can be the ID card number directly, or it can be a string calculated from the ID card number.

[0057] S102. The second system authorizes relevant requests for customer information from the first system.

[0058] In other words, the first system needs to obtain the customer's authorization, therefore, the second system can authorize the customer information requests sent by the first system.

[0059] It should be noted that the authorization process may fail or succeed. Generally, if the customer is an authorized customer in the second system, the authorization will succeed; if the customer is not an authorized customer in the second system, the authorization will fail.

[0060] In other words, if the customer information corresponds to an authorized customer, then step S103 is executed; if the customer information corresponds to an unauthorized customer, then step S104 is executed.

[0061] S103. The second system successfully authorized the relevant requests for customer information from the first system.

[0062] In other words, once the first system obtains authorization for a request related to customer information, it can perform corresponding actions based on that authorization, thus possessing certain permissions.

[0063] S104, The second system failed to authorize the relevant request for customer information in the first system.

[0064] In other words, the first system did not obtain authorization for the relevant requests for customer information, and therefore could not perform the corresponding actions and did not have the corresponding permissions.

[0065] In this embodiment, the first system sends customer information requiring authorization to the second system; the second system successfully authorizes the relevant request for customer information in the first system; if the customer information corresponds to an authorized customer, the second system successfully authorizes the relevant request for customer information in the first system; if the customer information corresponds to an unauthorized customer, the second system fails to authorize the relevant request for customer information in the first system. This achieves privacy protection during the authentication process, enabling privacy protection at different stages; avoids the problem of customer information exposure caused by directly transmitting customer information, and requires no additional user operation, thus improving both user experience and the security of the authentication and authorization process.

[0066] In practical applications, see Figure 2 Step S101: The first system sends the customer information that needs to obtain authorization to the second system, including:

[0067] S201. The first system obtains the identity information of the customer who needs authorization.

[0068] In practical applications, customer identity information includes: name, gender, and ID card number.

[0069] Of course, the customer identity information may include other information, which will not be elaborated here, depending on the actual situation, and all are within the scope of protection of this application.

[0070] S202. The first system generates customer information based on the customer's identity information.

[0071] In other words, the specific process of generating customer information based on customer identity information can be to convert the customer identity information into a hash value and then use that hash value as the customer information.

[0072] In practical applications, see Figure 3 Step S202: The first system generates customer information based on the customer's identity information, including:

[0073] S301. Generate a customer information string based on the customer's name, gender, and ID number.

[0074] S302. Perform a hash calculation on the customer information string to obtain the hash value of the customer ID.

[0075] The Sh256 algorithm can be used for hash calculation, and other algorithms can also be used. These will not be elaborated here, but can be determined according to the actual situation. All of them are within the protection scope of this application.

[0076] S303. Extract the first 32 bits of the hash value of the customer ID as the customer information.

[0077] The hash value of the customer ID has a total of 64 bits.

[0078] In other words, a customer information string is generated based on the customer's name, gender, and ID number, as detailed in Table 1. A hash calculation is then performed on the customer information string using the Sh256 algorithm. This results in a 256-bit binary string, which is then converted into a 64-bit hexadecimal string to obtain the hash value of the customer ID.

[0079] Table 1: Customer Information Description

[0080]

[0081] The hash value of the customer ID is truncated, specifically the first 32 bits of the hash value, which effectively avoids customer information leakage due to hash collisions.

[0082] S203, The first system sends customer information to the second system.

[0083] In other words, the first 32 bits of the hash value of the customer ID are sent to the second system.

[0084] Specifically, the first system and the second system can exchange hash values ​​via an API interface.

[0085] In practical applications, see Figure 4 Step S102: The second system authorizes relevant requests for customer information from the first system, including:

[0086] S401, the second system performs matching based on the first 32 bits of the hash value to obtain multiple matching results; sets a random number for each matching result; combines the last 32 bits of each matching result with the random number to form a new number string; performs a 64-bit hash calculation on the number string to obtain the first hash string; and sends the first hash string and the random number to the first system.

[0087] The second system matches the 32-bit hash value sent by the first system. Of course, the second system needs to calculate the hash value of the customer information according to the customer information calculation scheme adopted by the first system.

[0088] Since the first system only sends a 32-bit hash value, the second system may find multiple matching results. The specific matching process can be to match the first 32 bits of the hash value against the customer ID hash database, checking if any hash value matches the first 32 bits sent by the first system. If so, that hash value is considered a matching result.

[0089] Of course, other matching processes can also be used, which will not be elaborated here. They can be determined according to the actual situation and are all within the scope of protection of this application.

[0090] A random number is set for each matching result. The random number set for different matching results is different. The specific setting method will not be described in detail here. It can be determined according to the actual situation. All of them are within the protection scope of this application.

[0091] The last 32 bits of each matching result are combined with a random array to form a new number. Specifically, the new number can be the last 32 bits first, followed by the random number, and then a 64-bit hash calculation is performed on the new number.

[0092] The first hash string after hash calculation and its random number are sent to the first system.

[0093] S402. The first system performs a hash calculation based on the random number in the matching information and the last 32 bits of the hash value of the customer ID obtained by the first system to obtain a second hash string.

[0094] The first system combines the last 32 bits of the hash value of the customer ID it calculates with each random number sent by the second system to obtain a new number, and then performs a 64-bit hash calculation on the number to obtain the second hash string.

[0095] S403, The first system matches the second hash string with the first hash string.

[0096] Specifically, it can be determined whether the first hash string and the second hash string are consistent. If any first hash string is consistent with any second hash string, then the second hash string and the first hash string are successfully matched; if none of the first hash strings are consistent with any of the second hash strings, then the second hash string and the first hash string are not matched.

[0097] If a match is successful, the customer information corresponding to that customer is an authorized customer.

[0098] If a match fails, the customer information corresponding to that customer is not an authorized customer.

[0099] In practical applications, the second system successfully authorizes relevant requests for customer information from the first system, including:

[0100] The first system sends the customer's digital signature to the second system.

[0101] The second system completes the authorization for the customer.

[0102] If the match is successful, it means that the customer required for authorization by the first system is in the second system. The first system sends the customer's digital signature to the second system, and the second system completes the authorization of the customer required for authorization by the first system. If the match fails, it means that the customer required for authorization by the first system is not in the second system, and the authorization process ends.

[0103] See Figure 5 The following describes one application scenario of the privacy protection authorization method:

[0104] 1. Perform hash calculation on customer information.

[0105] A customer information string is generated based on the customer's name, gender, and ID number, as detailed in Table 1. A hash calculation is then performed on the customer information string using the Sh256 algorithm. This results in a 256-bit binary string, which is then converted into a 64-bit hexadecimal string to obtain the customer ID's hash value.

[0106] Table 1 Customer Information Description

[0107]

[0108] 2. Extract the hash value of the customer ID.

[0109] Extracting the first 32 bits of the hash value effectively prevents customer information leakage due to hash collisions.

[0110] 3. Passing hash values.

[0111] Send the hash value from system A to system B via the API interface.

[0112] 4. Hash value matching.

[0113] In system B, the 32-bit hash value sent by system A is matched. Of course, system B needs to calculate the customer information hash value according to the customer information calculation scheme of system A mentioned in step 1.

[0114] 5. Obtain the matching hash value.

[0115] Since system A only sends a 32-bit hash value, multiple matching results may be obtained.

[0116] 6. Configure random numbers.

[0117] System B configures a random number for each matched hash value in step 5. Setting a random number can enhance confidentiality.

[0118] 7. The hash value after matching is then calculated.

[0119] The last 32 bits of each matching hash value are combined with a random array to form a new number (last 32 bits first, random number second), and then a 64-bit hash is calculated together.

[0120] Specifically, it uses a 32-bit hash plus a random number. (See reference...) Figure 6 It shows the process of combining the last 32 bits with a random array to form a new number and then calculating the hash value.

[0121] 8. Feedback on matching information.

[0122] Send the random number corresponding to the set of hash values ​​calculated in step 7 to system A.

[0123] 9. Processing the last 32 bits of the customer information hash value.

[0124] System A combines the last 32 bits of the customer ID's hash value with each random number sent by System B in step 8 to form a new number, and then performs a 64-bit hash calculation.

[0125] 10. Verify and confirm.

[0126] The 64-bit hash value calculated in step 9 is matched with the hash value sent in step 8. If the match is successful, it means that the customer is in system B. System A sends the customer's digital signature to system B, and system B completes the authorization of the customer. If the match fails, it means that the customer is not in system B, and the authorization process ends.

[0127] System A is the first system, system B is the second system, and Hash is the hash function.

[0128] It should be noted that existing technologies also provide authentication methods using authorization codes as a medium, while this embodiment uses hash and random number calculations to confirm that authentication can be performed on customers. The hash and random number method offers stronger confidentiality.

[0129] Another embodiment of this application provides a privacy-protected authorization system.

[0130] See Figure 7 The privacy protection authorization system includes:

[0131] The sending module 101 is used by the first system to send customer information that requires authorization to the second system.

[0132] The authorization module 102 is used by the second system to authorize relevant requests for customer information in the first system; if the customer corresponding to the customer information is an authorized customer, the second system successfully authorizes the relevant requests for customer information in the first system; if the customer corresponding to the customer information is not an authorized customer, the second system fails to authorize the relevant requests for customer information in the first system.

[0133] For details on the specific working process and principles of each of the above modules, please refer to the privacy protection authorization method provided in the above embodiments. They will not be repeated here, and can be determined according to the actual situation, all of which are within the protection scope of this application.

[0134] In this embodiment, the sending module 101 is used by the first system to send customer information requiring authorization to the second system; the authorization module 102 is used by the second system to authorize the relevant requests for customer information in the first system; if the customer corresponding to the customer information is an authorized customer, the second system successfully authorizes the relevant requests for customer information in the first system; if the customer corresponding to the customer information is not an authorized customer, the second system fails to authorize the relevant requests for customer information in the first system; thereby realizing privacy protection during the authentication process and achieving privacy protection at different stages; avoiding the problem of customer information exposure caused by directly transmitting customer information, and requiring no additional user operation, thus improving the user experience while effectively enhancing the security of the authentication and authorization process.

[0135] In practical applications, the sending module 101 is used when the first system sends customer information requiring authorization to the second system, specifically for:

[0136] The first system obtains the identity information of customers who require authorization.

[0137] The first system generates customer information based on the customer's identity information.

[0138] The first system sends customer information to the second system.

[0139] In practical applications, customer identity information includes: name, gender, and ID card number;

[0140] The sending module 101 is used when the first system generates customer information based on customer identity information, specifically for:

[0141] Generate a customer information string based on the customer's name, gender, and ID number; perform a hash calculation on the customer information string to obtain the hash value of the customer ID; extract the first 32 bits of the hash value of the customer ID and send it to the second system; the total number of bits in the hash value of the customer ID is 64.

[0142] For details on the specific working process and principle of the sending module 101, please refer to the privacy protection authorization method provided in the above embodiments. It will not be repeated here. It can be determined according to the actual situation, and all of them are within the protection scope of this application.

[0143] Another embodiment of this application provides a storage medium on which a computer program is stored, wherein when the computer program is executed by a processor, it implements a privacy protection authorization method as described in any of the above embodiments.

[0144] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable media can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0145] It should be noted that the computer-readable medium described in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in connection with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0146] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0147] Another embodiment of the present invention provides an electronic device, such as... Figure 8 As shown, it includes:

[0148] One or more processors 201.

[0149] Storage device 202, on which one or more programs are stored.

[0150] When one or more programs are executed by one or more processors 201, the one or more processors 201 implement the privacy protection authorization method as described in any of the above embodiments.

[0151] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts.

[0152] Although the subject matter has been described using language specific to structural features and / or methodological logic, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely illustrative examples of implementing the claims.

[0153] While several specific implementation details are included in the foregoing discussion, these should not be construed as limiting the scope of this disclosure. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

[0154] The above description is merely a preferred embodiment of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features disclosed in this disclosure that have similar functions.

[0155] It should be noted that the privacy protection authorization method and system, electronic device, and storage medium provided by this invention can be used in the fields of artificial intelligence, blockchain, distributed systems, cloud computing, big data, the Internet of Things, mobile internet, network security, chips, virtual reality, augmented reality, holography, quantum computing, quantum communication, quantum measurement, digital twins, or finance. The above are merely examples and do not limit the application areas of the privacy protection authorization method and system, electronic device, and storage medium provided by this invention.

[0156] The features described in the various embodiments of this specification can be substituted for or combined with each other. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, for system or system embodiments, since they are basically similar to method embodiments, the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments. The systems and system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0157] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0158] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A privacy protection authorization method, characterized by, The method comprises the following steps: The first system sends customer information requiring authorization to the second system, comprising: the first system obtaining customer identity information requiring authorization; the first system generating a customer information string according to the customer identity information; performing hash calculation on the customer information string to obtain a hash value of a customer ID; and cutting the first preset number of bits of the hash value of the customer ID as customer information; the first system sending the customer information to the second system; the total number of bits of the hash value is greater than the preset number of bits; The second system authorizes the request related to the customer information in the first system; If the customer corresponding to the customer information is an authorized customer, the second system authorizes the request related to the customer information in the first system successfully; wherein, after the authorization is successful, the first system has the permission to perform corresponding actions according to the authorization; If the customer corresponding to the customer information is not an authorized customer, the second system authorizes the request related to the customer information in the first system unsuccessfully; The second system authorizes the request related to the customer information in the first system, comprising: The second system matches the first preset number of bits of the hash value of the customer ID to obtain a plurality of matching results; sets a random number for each matching result; forms a new digital string by combining the remaining bits of each matching result with the random number; performs hash calculation on the digital string to obtain a first hash string; and sends the first hash string and the corresponding random number to the first system as matching information; The first system performs hash calculation on the random number in the matching information and the remaining bits of the hash value of the customer ID obtained by the first system to obtain a second hash string; The first system matches the second hash string with the first hash string; If the matching is successful, the customer corresponding to the customer information is an authorized customer; If the matching is unsuccessful, the customer corresponding to the customer information is not an authorized customer.

2. The privacy protection authorization method of claim 1, wherein, The customer identity information comprises: name, gender and ID number.

3. The privacy protection authorization method of claim 1, wherein, The first preset number of bits of the hash value of the customer ID is cut as customer information, comprising: The first 32 bits of the hash value of the customer ID are cut as customer information; wherein, the total number of bits of the hash value of the customer ID is 64 bits.

4. The privacy protection authorization method of claim 3, wherein, The first hash string is a calculation result obtained by performing 64-bit hash calculation on the digital string.

5. The privacy protection authorization method of claim 1, wherein, The second system authorizes the request related to the customer information in the first system successfully, comprising: The first system sends a customer digital signature to the second system; The second system completes the authorization of the customer.

6. A privacy protection authorization system, characterized by, The method comprises the following steps: The sending module is configured to send customer information requiring authorization from the first system to the second system; The customer information is a value corresponding to a preset number of bits of a hash value calculated based on customer identity information; the total number of bits of the hash value is greater than the preset number of bits; The authorization module is configured to authorize the request related to the customer information in the first system by the second system; If the customer corresponding to the customer information is an authorized customer, the second system authorizes the request related to the customer information in the first system successfully; wherein, after the authorization is successful, the first system has the permission to perform corresponding actions according to the authorization; If the customer corresponding to the customer information is not an authorized customer, the second system authorizes the request related to the customer information in the first system unsuccessfully; The second system authorizes the request related to the customer information in the first system, comprising: The second system matches the first preset number of bits of the hash value of the customer ID to obtain a plurality of matching results; sets a random number for each matching result; forms a new digital string by combining the remaining bits of each matching result with the random number; performs hash calculation on the digital string to obtain a first hash string; and sends the first hash string and the corresponding random number to the first system as matching information; The first system performs hash calculation on the random number in the matching information and the remaining bits of the hash value of the customer ID obtained by the first system to obtain a second hash string; The first system matches the second hash string with the first hash string; If the matching is successful, the customer corresponding to the customer information is an authorized customer; If the matching is unsuccessful, the customer corresponding to the customer information is not an authorized customer. The customer identity information comprises: name, gender and ID number. The first preset number of bits of the hash value of the customer ID is cut as customer information, comprising: The first 32 bits of the hash value of the customer ID are cut as customer information; wherein, the total number of bits of the hash value of the customer ID is 64 bits. The first hash string is a calculation result obtained by performing 64-bit hash calculation on the digital string. The second system authorizes the request related to the customer information in the first system successfully, comprising: The first system sends a customer digital signature to the second system; The second system completes the authorization of the customer. The method comprises the following steps: If the client corresponding to the client information is an authorized client, the second system authorizes the request for the client information in the first system successfully; If the client corresponding to the client information is not an authorized client, the second system authorizes the request for the client information in the first system unsuccessfully; wherein the first system has the permission to perform corresponding actions according to the authorization after the authorization is successful; The second system authorizes the request for the client information in the first system, comprising: The second system matches the hash value of the first preset number of bits of the client ID to obtain a plurality of matching results; sets a random number for each matching result; forms a new digital string by combining the remaining bits of each matching result with the random number; performs hash calculation on the digital string to obtain a first hash string; and sends the first hash string and the corresponding random number to the first system as matching information; The first system performs hash calculation on the random number in the matching information and the remaining bits of the hash value of the client ID obtained by the first system to obtain a second hash string; The first system matches the second hash string with the first hash string; If the matching is successful, the client corresponding to the client information is an authorized client; If the matching fails, the client corresponding to the client information is not an authorized client; The sending module is configured to be used for sending the client information that needs to be authorized from the first system to the second system, and specifically configured to: The first system obtains the client identity information that needs to be authorized; The first system generates a client information string according to the client identity information; performs hash calculation on the client information string to obtain a hash value of the client ID; and takes the first preset number of bits of the hash value of the client ID as the client information; The first system sends the client information to the second system.

7. The privacy protection authorization system of claim 6, wherein, The client identity information includes name, gender, and ID number.

8. The privacy protection authorization system of claim 6, wherein, Taking the first preset number of bits of the hash value of the client ID as the client information includes: taking the first 32 bits of the hash value of the client ID and sending it to the second system; wherein the total number of bits of the hash value of the client ID is 64 bits.

9. An electronic device, comprising: comprising: one or more processors; a storage device having one or more programs stored thereon; when the one or more programs are executed by the one or more processors, the one or more processors implement the privacy protection authorization method according to any one of claims 1-5.

10. A storage medium, characterized by a computer program is stored thereon, wherein the computer program is executed by the processor to implement the privacy protection authorization method according to any one of claims 1-5.

Images