A data authority management method and system supporting ciphertext data exchange

Abstract

The application relates to a data authority management method and system supporting ciphertext data exchange, which comprises the following steps: generating a data authority token, wherein the data authority token comprises a first key pair, a second key pair and a third key pair; generating a request message, encrypting the request message to generate an encrypted request message; and matching an adaptive key pair based on the adaptive relationship between the data authority token and the request message recorded in an authority-message relationship table, and decrypting the encrypted request message through the public key of the adaptive key pair to obtain a decrypted service message body. The method and system provide an encrypted data authority management process, can manage the data authority of different department users through the use of web technology, and realize the flexible use of data by each department according to requirements and authority. The method and system can ensure that the rights and responsibilities of all shared data are clear, and the information security is reliable.

Description

Technical Field

[0001] This invention relates to the field of data exchange technology, and in particular to a data access control method and system that supports encrypted data exchange. Background Technology

[0002] In the digital age, traditional government services are beginning to transform into "Internet+" digital government services. Accelerating the transformation of government functions, improving government service levels, proactively adapting to the people's new expectations and requirements for more high-quality public services, further enhancing the efficiency of government services, fully releasing the benefits of the "streamlining administration, delegating power, and improving services" reform, and increasing the people's satisfaction and sense of happiness have become the goals and directions for governments at all levels to deepen government service reform.

[0003] In the current development of data sharing among various government departments, the increasing volume of business information necessitates the transmission and exchange of vast amounts of data. However, much of this data is currently transmitted without authorization or proper procedures by various personnel, making information leaks a significant risk and posing a challenge to the secure and reliable flow of data. Existing cross-departmental data sharing mechanisms are lacking, inter-departmental collaboration is limited, and horizontal coordination is difficult. Data is easily copied during sharing and circulation. Without data encryption, ownership verification, and clear identification of data producers, users, managers, and beneficiaries, accurate data authorization cannot be effectively achieved, posing serious information security risks and hindering secure data sharing. Therefore, ensuring the reliable transmission of data in an untrusted internet environment is a pressing issue that needs to be addressed. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention proposes a data access control method and system that supports encrypted data exchange. Utilizing web technology, it enables authorization management of data permissions for users in different departments, allowing each department to flexibly use data according to its needs and permissions. This ensures clear responsibilities and reliable information security for all shared data.

[0005] To achieve the above objectives, the technical solution adopted by the present invention includes:

[0006] A data access control method supporting encrypted data exchange, characterized in that it includes:

[0007] Generate a data access token, the data access token comprising: a first key pair, a second key pair, and a third key pair;

[0008] The process of generating a request message and encrypting the request message to generate an encrypted request message includes: generating a business message header, the business message header including several business message header fields; the second department encrypting the business message header fields using the public key of the third key pair to obtain a data permission token message header field; the first department signing the message header fields using the public key of the second key pair to obtain a signed message header field; and generating a business message body, the third department encrypting the business message body using the public key of the first key pair to obtain an encrypted business message body.

[0009] The third department matches the data permission tokens and request messages based on the matching relationship recorded in the permission and message relationship table to obtain the matching key pair. The encrypted request message is then decrypted using the public key of the matching key pair to obtain the decrypted business message body.

[0010] Furthermore, the first department generates a first key pair and a third key pair, wherein the private key of the first key pair is held by the first department and the public key of the first key pair is held by the third department; the private key of the third key pair is held by the first department and the public key of the third key pair is held by the second department.

[0011] The second department generates a second key pair, the private key of which is held by the second department, and the public key of the first key pair is held by the first department.

[0012] Furthermore, the request message includes a business message header and a business message body, wherein the business message body includes a public field and a request body field.

[0013] Furthermore, the encrypted request message includes: a data permission token header field, a signed header field, and an encrypted business message body.

[0014] Furthermore, the decrypted business message body includes: a response description field, a call status field, a return type field, a return success field, a result description field, and a response code field.

[0015] Furthermore, the permission and message relationship table includes: data permission token number, business message header of the request message, business message body, and the adaptation relationship between the data permission token and the request message.

[0016] This invention also relates to a data access control system that supports encrypted data exchange, characterized in that it includes:

[0017] A data permission token generation module is used to generate a data permission token, which includes: a first key pair, a second key pair, and a third key pair;

[0018] The request message generation and encryption module is used to generate a request message, encrypt the request message, and generate an encrypted request message. The module includes: generating a business message header, which includes several business message header fields; encrypting the business message header fields using the public key of a third key pair to obtain a data access token message header field; signing the message header fields using the public key of a second key pair to obtain a signed message header field; and generating a business message body, whereby a third department encrypts the business message body using the public key of a first key pair to obtain an encrypted business message body.

[0019] The decryption module, based on the matching relationship between the data permission token and the request message recorded in the permission and message relationship table, the third department matches and obtains the matching key pair. The encrypted request message is decrypted using the public key of the matching key pair to obtain the decrypted business message body.

[0020] The present invention also relates to a computer-readable storage medium, characterized in that the storage medium stores a computer program, which, when executed by a processor, implements the above-described data access control method for supporting encrypted data exchange.

[0021] The present invention also relates to an electronic device, characterized in that it includes a processor and a memory;

[0022] The memory is used to store data access tokens;

[0023] The processor is used to execute the aforementioned data permission management method that supports encrypted data exchange by invoking a data permission token.

[0024] The present invention also relates to a computer program product, including a computer program and / or instructions, characterized in that, when the computer program and / or instructions are executed by a processor, they implement the steps of the above-described data access control method for supporting encrypted data exchange.

[0025] The beneficial effects of this invention are as follows:

[0026] This invention provides a data access control method and system that supports encrypted data exchange, offering an encrypted data access control process. By utilizing web technology, it enables authorization management of user data permissions across different departments, allowing each department to flexibly use data according to its needs and permissions. This invention ensures clear responsibilities and reliable information security for all shared data. Because token matching is applied to both data providers and users, each participating department needs authorization to share data. Changes to government data, such as modifications made by units connected to the platform, are promptly transmitted to all participants in the system, thus breaking down departmental barriers and enabling real-time data sharing across multiple departments. Attached Figure Description

[0027] Figure 1 This is a schematic diagram of a data access control method that supports encrypted data exchange according to the present invention.

[0028] Figure 2 This is a schematic diagram of the structure of a data access control system that supports encrypted data exchange according to the present invention. Detailed Implementation

[0029] To better understand the content of this invention, a detailed description will be provided in conjunction with the accompanying drawings and embodiments.

[0030] The data provider catalogs government data resources, and after administrator approval, publishes and generates a data catalog, while simultaneously aggregating database table data and file data to the center. Data requesters, after searching the data catalog, submit data requests, which are then reviewed by the data provider and administrator. Once approved, the requester can obtain the data.

[0031] Public key encryption, private key decryption:

[0032] The message is sent from one of the public key holders to the private key holder.

[0033] Encryption and decryption are used to prevent third parties from accessing the message content during communication.

[0034] Private key signing, public key verification:

[0035] The message is sent from the private key holder to one of the public key holders.

[0036] The signature is to prove that the sender of the message is legitimate, that is, "I" myself and not someone else impersonating me to send the message.

[0037] The private key and public key are a pair; anyone can encrypt and decrypt them. However, who encrypts and who decrypts depends on the context.

[0038] The first scenario is signing, which uses a private key for encryption and a public key for decryption. This is used to allow all public key owners to verify the identity of the private key owner and to prevent the content published by the private key owner from being tampered with. However, it is not used to ensure that the content is not obtained by others.

[0039] The second scenario involves encryption, using a public key to encrypt and a private key to decrypt. This information is then used to publish information to the owner of the public key. This information may be tampered with by others, but it cannot be obtained by them.

[0040] For example, in encryption scenarios:

[0041] If A wants to send secure and confidential data to B, then A and B should each have a private key. A should first encrypt the data using B's public key, and then encrypt the encrypted data using A's own private key. Finally, A should send the encrypted data to B. This ensures that the content cannot be read or tampered with.

[0042] In asymmetric encryption technology, there are two types of keys: a private key and a public key. The private key is held by the key pair owner and cannot be published, while the public key is published by the key pair owner to others.

[0043] The public key is used to encrypt data, and data encrypted with the public key can only be decrypted using the private key; it is used to decrypt data encrypted with the public key.

[0044] For the text to be transmitted, a hash calculation is performed, usually using SHA1 or SHA2, to obtain a digest of the text to be transmitted using a private key. The resulting ciphertext is called the signature of this transmission process.

[0045] The receiving end receives the transmitted text but needs to verify that the text is indeed the content sent and has not been tampered with during transmission. Therefore, it uses its own public key to decrypt the signature (data encrypted with one key in a key pair can always be decrypted with the other key), obtaining a text digest. Then, it calculates the digest value using the same hash algorithm as the sender and compares it with the decrypted digest. If the two are identical, it means the text has not been tampered with.

[0046] Encrypting data prevents unauthorized users from accessing the correct information, even if they obtain the encrypted data. Therefore, data encryption protects data and prevents eavesdropping attacks. Its key focus is data security.

[0047] The first aspect of this invention relates to a data access control method supporting encrypted data exchange, the steps of which are as follows: Figure 1 The method shown includes:

[0048] Data permission token

[0049] To ensure that data acquisition and push are explicitly authorized, the business department implements data access control for data acquisition and data push services, based on the data access token sent by the accessing party when accessing the interface.

[0050] Data access tokens are issued by the business department to the accessing party, representing the scope of data that the accessing party can obtain and push. Encrypted transmission is required when sending tokens to the interface.

[0051] Because token matching is used for both data providers and users, each participating department needs authorization to share data. Even after data sharing, data use and modification still require authorization from the original data management department; unauthorized use and modification are prohibited. Changes to government data made by units connected to the platform are promptly transmitted to all system participants, thus breaking down departmental barriers and enabling real-time data sharing across multiple departments.

[0052] Key Usage Instructions

[0053] Generate a data access token, the data access token comprising: a first key pair, a second key pair, and a third key pair;

[0054] To ensure the security of data exchange, three sets of keys are required for connecting to the data exchange interface. The purpose and usage of the keys are shown in the table below:

[0055]

[0056] That is, the first department generates a first key pair and a third key pair, the private key of the first key pair is held by the first department, and the public key of the first key pair is held by the third department; the private key of the third key pair is held by the first department, and the public key of the third key pair is held by the second department.

[0057] The second department generates a second key pair, the private key of which is held by the second department, and the public key of the first key pair is held by the first department.

[0058] Key exchange mechanism

[0059] All key pair holders must exchange key pairs via secure email.

[0060] Key validity period

[0061] For security reasons, the key pair is valid for one year. Preparations for replacement should be made 30 calendar days before the expiration date. The key pair generator needs to generate a new key pair. After generation, the key pair will be exchanged through the key exchange mechanism, and the two parties will agree on a time for unified replacement.

[0062] Secure exchange:

[0063] To ensure secure data exchange, encryption and signing are required at the application layer. Building upon the above, this section provides an overview of how request messages are generated and response messages are parsed within the context of security requirements.

[0064] Request message generation:

[0065] The request message includes: a business message header and a business message body;

[0066] The business message body includes: the public domain and the request body domain.

[0067] The process of generating a request message and encrypting the request message to generate an encrypted request message includes: generating a business message header, the business message header including several business message header fields; the second department encrypting the business message header fields using the public key of a third key pair to obtain a data permission token message header field; the second department signing the message header fields using the private key of a second key pair to obtain a signed message header field; and generating a business message body, the second department encrypting the business message body using the public key of a first key pair to obtain an encrypted business message body.

[0068] The encrypted request message includes: a data permission token header field, a signed header field, and an encrypted business message body.

[0069] Response message parsing:

[0070] The third department matches the data permission tokens and request messages based on the matching relationship recorded in the permission and message relationship table to obtain the matching key pair. The encrypted request message is then decrypted using the public key of the matching key pair to obtain the decrypted business message body.

[0071] The decrypted business message body includes: response description field, call status field, return type field, return success field, result description field, and response code field.

[0072] The permission and message relationship table includes: data permission token number, business message header of the request message, business message body, and the adaptation relationship between the data permission token and the request message.

[0073] Another aspect of the present invention relates to a data access control system that supports encrypted data exchange, the structure of which is as follows: Figure 2 As shown, it includes:

[0074] A data permission token generation module is used to generate a data permission token, which includes: a first key pair, a second key pair, and a third key pair;

[0075] The request message generation and encryption module is used to generate a request message, encrypt the request message, and generate an encrypted request message. The module includes: generating a business message header, which includes several business message header fields; encrypting the business message header fields using the public key of a third key pair to obtain a data access token message header field; signing the message header fields using the public key of a second key pair to obtain a signed message header field; and generating a business message body, whereby a third department encrypts the business message body using the public key of a first key pair to obtain an encrypted business message body.

[0076] The decryption module, based on the matching relationship between the data permission token and the request message recorded in the permission and message relationship table, the third department matches and obtains the matching key pair. The encrypted request message is decrypted using the public key of the matching key pair to obtain the decrypted business message body.

[0077] By using this system, the aforementioned computational processing methods can be executed and the corresponding technical effects can be achieved.

[0078] This invention discloses a data access control method and system that supports encrypted data exchange. It provides an encrypted data access control process, utilizes web technology, and offers a visual user interface. This allows for the authorization and management of data permissions for users in different departments, enabling each department to flexibly use data according to its needs and permissions. It ensures clear responsibilities and reliable information security for all shared data.

[0079] Embodiments of the present invention also provide a computer-readable storage medium capable of implementing all the steps of the methods in the above embodiments, wherein the computer-readable storage medium stores a computer program that, when executed by a processor, implements all the steps of the methods in the above embodiments.

[0080] Embodiments of the present invention also provide an electronic device for performing the above-described method. As an implementation device for the method, the electronic device has at least a processor and a memory. In particular, the memory stores data and related computer programs required for performing the method, such as data access tokens, and executes all steps of the method by having the processor call the data and programs in the memory to achieve the corresponding technical effects.

[0081] Preferably, the electronic device may include a bus architecture, which may include any number of interconnected buses and bridges. The bus will include various circuits linked together by one or more processors and memories. The bus may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. The bus interface provides an interface between the bus and the receiver and transmitter. The receiver and transmitter may be the same element, i.e., a transceiver, providing a unit for communicating with various other systems over a transmission medium. The processor is responsible for managing the bus and general processing, while the memory may be used to store data used by the processor during operation.

[0082] Additionally, the electronic device may further include a communication module, an input unit, an audio processor, a display, a power supply, and other components. The processor (or controller, operating control) used may include a microprocessor or other processor device and / or logic device, which receives input and controls the operation of various components of the electronic device. The memory may be one or more of a buffer, flash memory, hard drive, removable media, volatile memory, non-volatile memory, or other suitable devices, which can store the aforementioned data information. It may also store programs for executing the relevant information, and the processor can execute the program stored in the memory to achieve information storage or processing. The input unit provides input to the processor, for example, it may be a button or touch input device. The power supply provides power to the electronic device. The display displays images and text, for example, it may be an LCD display. The communication module is a transmitter / receiver that transmits and receives signals via an antenna. The communication module (transmitter / receiver) is coupled to the processor to provide input signals and receive output signals, which can be the same as in a conventional mobile communication terminal. Based on different communication technologies, multiple communication modules can be incorporated into the same electronic device, such as cellular network modules, Bluetooth modules, and / or wireless LAN modules. The communication module (transmitter / receiver) is also coupled to a speaker and microphone via an audio processor to provide audio output through the speaker and receive audio input from the microphone, thereby enabling typical telecommunications functions. The audio processor can include any suitable buffer, decoder, amplifier, etc. Furthermore, the audio processor is coupled to a central processing unit, enabling on-device recording via the microphone and on-device playback of stored sound via the speaker.

[0083] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0084] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A system that specifies functions in one or more boxes.

[0085] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including an instruction set implemented in a process. Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0086] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the functions specified in one or more boxes. Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the invention.

[0087] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A data access control method supporting encrypted data exchange, characterized in that, include: A data access token is generated, comprising: a first key pair, a second key pair, and a third key pair; a first department generates the first key pair and the third key pair, wherein the private key of the first key pair is held by the first department, and the public key of the first key pair is held by the third department; the private key of the third key pair is held by the first department, and the public key of the third key pair is held by the second department. The second department generates a second key pair, the private key of which is held by the second department, and the public key of which is held by the first department. The process of generating a request message and encrypting the request message to generate an encrypted request message includes: generating a business message header, the business message header including several business message header fields; the second department encrypting the business message header fields using the public key of a third key pair to obtain a data permission token message header field; the second department signing the message header fields using the private key of a second key pair to obtain a signed message header field; and generating a business message body, the second department encrypting the business message body using the public key of a first key pair to obtain an encrypted business message body. The third department matches the data permission tokens and request messages based on the matching relationship recorded in the permission and message relationship table to obtain the matching key pair. The encrypted request message is then decrypted using the private key of the matching key pair to obtain the decrypted business message body. The permission and message relationship table includes: data permission token number, business message header of the request message, business message body, and the adaptation relationship between the data permission token and the request message.

2. The method as described in claim 1, characterized in that, The request message includes a business message header and a business message body, wherein the business message body includes a public field and a request body field.

3. The method as described in claim 1, characterized in that, The encrypted request message includes: a data permission token header field, a signed header field, and an encrypted business message body.

4. The method as described in claim 1, characterized in that, The decrypted business message body includes: response description field, call status field, return type field, return success field, result description field, and response code field.

5. A data access control system supporting encrypted data exchange, characterized in that, include: A data permission token generation module is used to generate a data permission token, which includes: a first key pair, a second key pair, and a third key pair; a first department generates the first key pair and the third key pair, the private key of the first key pair is held by the first department, and the public key of the first key pair is held by the third department; the private key of the third key pair is held by the first department, and the public key of the third key pair is held by the second department. The second department generates a second key pair, the private key of which is held by the second department, and the public key of which is held by the first department. The request message generation and encryption module is used to generate a request message, encrypt the request message, and generate an encrypted request message, including: generating a business message header, the business message header including several business message header fields; the second department encrypting the business message header fields using the public key of the third key pair to obtain a data permission token message header field; the second department signing the message header fields using the private key of the second key pair to obtain a signed message header field; and generating a business message body, the second department encrypting the business message body using the public key of the first key pair to obtain an encrypted business message body. The decryption module, based on the matching relationship between the data permission token and the request message recorded in the permission and message relationship table, the third department matches and obtains the matching key pair, and decrypts the encrypted request message using the private key of the matching key pair to obtain the decrypted business message body; The permission and message relationship table includes: data permission token number, business message header of the request message, business message body, and the adaptation relationship between the data permission token and the request message.

6. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the data access control method for supporting encrypted data exchange as described in any one of claims 1 to 4.

7. An electronic device, characterized in that, Including processor and memory; The memory is used to store data access tokens; The processor is configured to execute the data access control method supporting encrypted data exchange as described in any one of claims 1 to 4 by invoking a data access token.

8. A computer program product, comprising a computer program and / or instructions, characterized in that, When the computer program and / or instructions are executed by a processor, they implement the steps of the data access control method for supporting encrypted data exchange as described in any one of claims 1 to 4.

Images