A financial data sharing security authentication method and system

Abstract

The present invention relates to the field of data sharing technology, and in particular to a financial data sharing security authentication method and system, comprising the following steps: storing the financial data of several enterprises in a shared data pool, and encrypting the shared data; encrypting the data in the shared data pool by a symmetric encryption algorithm; when user A needs to access resources in the shared data pool, he must register his identifier ID and corresponding password PW with server S; when user A needs to access resources of server S, the user needs to insert a USB Token into his terminal and enter the corresponding password PW, and then perform the authentication process; after successful authentication, log in to the shared data pool to view the shared data. In the present invention, users need to authenticate their identities through USB Token and password to access the shared data pool. This dual authentication mechanism enhances the user's identity authentication and authorization, and reduces the risk of unauthorized access and the risk of illegal access and data leakage.

Description

Technical Field

[0001] The present invention relates to the technical field of data sharing, and in particular to a financial data sharing security authentication method and system. Background Art

[0002] The development of the Internet of Things has spawned a series of information concepts. Due to the openness of the network, various mobile terminal devices frequently carry out financial data communication, information interaction and financial data sharing. Data security sharing is the bridge and link for interoperability between terminal devices in the Internet of Things environment, and data sharing is the most effective means to improve data utilization efficiency and mine data value. With the increasing use of information interaction and data communication, various security issues are also increasing. In the process of interaction of financial data resources, the privacy information of Internet of Things terminal devices, the security and confidentiality of financial data resources, and the effective management and access of financial data resources are greatly threatened. Therefore, how to ensure the security of shared data and secure, flexible and efficient access control to shared resources in the Internet of Things environment is the challenge facing current financial data sharing.

[0003] Although the financial data sharing certification system can provide a certain degree of data protection and security, there is still a risk that the data may be accessed, leaked, and abused by unauthorized persons. In addition, multiple parties involved in financial data may use different data integration and formats, which may affect the accuracy and completeness of the data process. Users of shared data have limited control and transparency over their data. They may not understand how their data is shared and cannot effectively supervise and manage the use of the data. Summary of the invention

[0004] The present invention aims at the technical problems existing in the prior art and provides a financial data sharing security authentication method and system.

[0005] The technical solution of the present invention to solve the above technical problem is as follows: a financial data sharing security authentication method, specifically comprising the following steps:

[0006] S101. The financial data of several enterprises are uniformly stored in a shared data pool, and the shared data is encrypted;

[0007] S102, encrypting the data in the shared data pool by using a symmetric encryption algorithm;

[0008] S103, when user A needs to access resources in the shared data pool, he must register his identifier ID and corresponding password PW with server S;

[0009] S104, when user A needs to access the resources of server S, the user needs to insert the USB Token into his terminal and enter the corresponding password PW, and then perform the authentication process;

[0010] S105. After successful authentication, log in to the shared data pool to view the shared data.

[0011] In a preferred embodiment, in S101, when the enterprise transmits financial data, the data imported into the data pool daily is monitored by data monitoring to obtain the daily data import amount, obtain the data import amount within ten natural days along the time axis and perform variance analysis to obtain the standard deviation of the group of data import amounts, and when the increase in the standard deviation exceeds a preset increase threshold as the current data import amount is added, an early warning message is issued to the enterprise. Through data monitoring, the data imported by the enterprise can be monitored and warned. Once the imported data is abnormal, whether it is a sudden increase or a sudden decrease, the enterprise can be informed in time and the data imported into the shared data pool can be uniformly encrypted.

[0012] In a preferred embodiment, the shared data in the data pool is encrypted by a symmetric encryption algorithm in S102, and the data in the shared data pool is traversed to encrypt the data. The specific calculation formula for encryption is as follows:

[0013] M=E(Key,P)

[0014] Among them, M represents ciphertext, Key represents key, P represents plaintext, and E() represents encryption function.

[0015] In a preferred embodiment, in S103, user A freely selects his ID and PW, generates two random numbers r and , the specific calculation method is:

[0016] ;

[0017] User A calculates And its ID and It is sent to the server S through a secure channel to initiate a registration application. After receiving the client's registration application, the server S calculates = and B= , here Only used in anonymous authentication process, the server S will use ID and Stored in an identity table, where PW represents the password corresponding to the ID, x represents the long key of the server S, h() represents a one-way hash function, and g represents a primitive root of the Galois field. Represents an anonymous identifier, and the formula is: , the server S will ID Write a USB Token and issue it to user C through a secure channel. After obtaining the USB Token, user C will use r and Write to USB Token. At the same time, the internal mechanism of USB Token should ensure that B and can only be changed by authorized applications, where p is a large prime number.

[0018] In a preferred embodiment, in S104, user A generates a random number r and calculates ME_r= , ME_r is sent to the server S to initiate a login request. After receiving the login request, the server S calculates B= = = , where x represents a long key known only to the server S. The server S then generates a random number R and calculates R= and h(B'), the server S will h(B') and R is sent to user A. After receiving the message sent by server S, user A first calculates B'= and h(B'), where R= And B= , so we can get B'= = = , then, user A verifies the legitimacy of the server S by comparing the received h(B') to the calculated h(B'). If h(B') is not equal to h(B'), the server is rejected. Otherwise, user A continues to calculate C=h( R||B'), client A sends its ID and C to server S, and server S calculates C'=h( R||B'), and then check whether C and C' are equal. If they are equal, S accepts the login request. Otherwise, S rejects the login request because it means that user A does not have USB Token or has entered an incorrect password. The server S sends a yes / no to client A to notify whether the login is successful.

[0019] In a preferred embodiment, in S105, each data requester can view the corresponding ciphertext data in the shared data pool after password authentication, and the resource requester can also view the access policy of the data sharer, and the shared data pool will send the corresponding link of the ciphertext data to the data requester.

[0020] In a preferred embodiment, a financial data sharing security authentication system includes: a data integration module, a data encryption module, a user registration module, an identity authentication module, and a data sharing module;

[0021] Data integration module: stores the financial data of several enterprises in a shared data pool and encrypts the shared data;

[0022] Data encryption module: encrypts data in the shared data pool through a symmetric encryption algorithm;

[0023] User registration module: When user A needs to access resources in the shared data pool, he must register his identifier ID and corresponding password PW with server S;

[0024] Identity authentication module: When user A needs to access the resources of server S, the user needs to insert the USB Token into his terminal and enter the corresponding password PW, and then perform the authentication process;

[0025] Data sharing module: After successful authentication, log in to the shared data pool to view shared data.

[0026] The beneficial effects of the present invention are as follows: the present invention uses a symmetric encryption algorithm to encrypt shared data, which can ensure that even if the data is obtained, its content cannot be interpreted during the data transmission, storage and processing process. The encrypted data improves the confidentiality and security of the data. Users need to authenticate their identities through USB Token and password to access the shared data pool. This dual authentication mechanism enhances the user's identity authentication and authorization, reduces the risk of unauthorized access and the risk of illegal access and data leakage, and reduces the complexity of data integration and conversion by establishing a unified data access platform. Users can easily view shared data, thereby improving the efficiency and availability of data sharing. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 A financial data sharing security authentication method and system flow chart;

[0028] Figure 2 The present invention is a structural block diagram of a financial data sharing security authentication method and system. DETAILED DESCRIPTION

[0029] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0030] In the description of this application, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this application, "plurality" means two or more, unless otherwise clearly and specifically defined.

[0031] In the description of the present application, the term "for example" is used to mean "used as an example, illustration or description". Any embodiment described as "for example" in the present application is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is given to enable any technician in the field to implement and use the present invention. In the following description, details are listed for the purpose of explanation. It should be understood that a person of ordinary skill in the art can recognize that the present invention can be implemented without using these specific details. In other examples, well-known structures and processes will not be elaborated in detail to avoid unnecessary details to obscure the description of the present invention. Therefore, the present invention is not intended to be limited to the embodiments shown, but is consistent with the widest scope consistent with the principles and features disclosed in the present application. Example 1

[0032] like Figure 1 This embodiment provides a financial data sharing security authentication method, which specifically includes the following steps:

[0033] S101. The financial data of several enterprises are uniformly stored in a shared data pool, and the shared data is encrypted;

[0034] Furthermore, when the enterprise transmits financial data, the data monitoring system monitors the data imported into the data pool every day, obtains the daily data import volume, obtains the data import volume within ten natural days along the time axis and performs variance analysis, and obtains the standard deviation of the group of data import volumes. When the increase in the standard deviation exceeds the preset increase threshold as the current data import volume is added, an early warning message is issued to the enterprise. Through data monitoring, the data imported into the enterprise can be monitored and warned. Once the imported data is abnormal, whether it is a sudden increase or a sudden decrease, the enterprise can be informed in time and the data imported into the shared data pool can be uniformly encrypted.

[0035] S102, encrypting the data in the shared data pool by using a symmetric encryption algorithm;

[0036] Furthermore, the shared data in the data pool is encrypted by a symmetric encryption algorithm, and the data in the shared data pool is traversed to encrypt the data. The specific calculation formula for encryption is as follows:

[0037] M=E(Key,P)

[0038] Among them, M represents ciphertext, Key represents key, P represents plaintext, and E() represents encryption function.

[0039] S103, when user A needs to access resources in the shared data pool, he must register his identifier ID and corresponding password PW with server S;

[0040] Furthermore, user A freely chooses his ID and PW, generates two random numbers r and , the specific calculation method is:

[0041] ;

[0042] User A calculates And its ID and It is sent to the server S through a secure channel to initiate a registration application. After receiving the client's registration application, the server S calculates = and B= , here Only used in anonymous authentication process, the server S will use ID and Stored in an identity table, where PW represents the password corresponding to the ID, x represents the long key of the server S, h() represents a one-way hash function, and g represents a primitive root of the Galois field. Represents an anonymous identifier, and the formula is: , the server S will ID Write a USB Token and issue it to user C through a secure channel. After obtaining the USB Token, user C will use r and Write to USB Token. At the same time, the internal mechanism of USB Token should ensure that B and can only be changed by authorized applications, where p is a large prime number.

[0043] S104, when user A needs to access the resources of server S, the user needs to insert the USB Token into his terminal and enter the corresponding password PW, and then perform the authentication process;

[0044] Furthermore, user A generates a random number r and calculates ME_r= , ME_r is sent to the server S to initiate a login request. After receiving the login request, the server S calculates B= = = , where x represents a long key known only to the server S. The server S then generates a random number R and calculates R= and h(B'), the server S will h(B') and R is sent to user A. After receiving the message sent by server S, user A first calculates B'= and h(B'), where R= And B= , so we can get B'= = = , then, user A verifies the legitimacy of the server S by comparing the received h(B') to the calculated h(B'). If h(B') is not equal to h(B'), the server is rejected. Otherwise, user A continues to calculate C=h( R||B'), client A sends its ID and C to server S, and server S calculates C'=h( R||B'), and then check whether C and C' are equal. If they are equal, S accepts the login request, otherwise S rejects the login request, because this means that user A does not have a USB Token or enters an incorrect password. The server S sends a yes / no to client A to notify whether the login is successful.

[0045] S105. After successful authentication, log in to the shared data pool to view the shared data;

[0046] Furthermore, each data requester can view the corresponding ciphertext data in the shared data pool after password authentication, and the resource requester can also view the access policy of the data sharer, and the shared data pool will send the corresponding link of the ciphertext data to the data requester.

[0047] It should be noted that during the authentication process, client A and server S independently generate two random numbers r and R and use them as and The encrypted form is sent to the other party, so both parties can independently calculate a final session key SK=( ) = =( ) , thereby achieving the purpose of key negotiation.

[0048] Example 2

[0049] like Figure 2,This embodiment provides a financial data sharing security authentication system, including: a data integration module, a data encryption module, a user registration module, an identity authentication module, and a data sharing module;

[0050] Data integration module: stores the financial data of several enterprises in a shared data pool and encrypts the shared data;

[0051] Data encryption module: encrypts data in the shared data pool through a symmetric encryption algorithm;

[0052] User registration module: When user A needs to access resources in the shared data pool, he must register his identifier ID and corresponding password PW with server S;

[0053] Identity authentication module: When user A needs to access the resources of server S, the user needs to insert the USB Token into his terminal and enter the corresponding password PW, and then perform the authentication process;

[0054] Data sharing module: After successful authentication, log in to the shared data pool to view shared data.

[0055] It should be noted that in the above embodiments, the description of each embodiment has its own emphasis, and for parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0056] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0057] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded computer, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0058] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0059] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0060] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0061] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A financial data sharing security authentication method, characterized in that: The following steps are involved: S101. The financial data of several enterprises are uniformly stored in a shared data pool, and the shared data is encrypted; S102, encrypting the data in the shared data pool by using a symmetric encryption algorithm; S103, when user A needs to access resources in the shared data pool, he must register his identifier ID and corresponding password PW with server S; S104, when user A needs to access the resources of server S, the user needs to insert the USB Token into his terminal and enter the corresponding password PW, and then perform the authentication process; S105. After successful authentication, log in to the shared data pool to view the shared data; Among them, user A freely chooses his ID and PW, generates two random numbers r and , the specific calculation method is: ; User A calculates And its ID and It is sent to the server S through a secure channel to initiate a registration application. After receiving the client's registration application, the server S calculates = and B= , here Only used in anonymous authentication process, the server S will use ID and Stored in an identity table, where PW represents the password corresponding to the ID, x represents the long key of the server S, h() represents a one-way hash function, and g represents a primitive root of the Galois field. Represents an anonymous identifier, and the formula is: , the server S will ID Write a USB Token and issue it to user C through a secure channel. After obtaining the USB Token, user C will use r and Write to USB Token. At the same time, the internal mechanism of USB Token should ensure that B and can only be changed by authorized applications, where p is a large prime number; Among them, user A generates a random number r and calculates ME_r= , ME_r is sent to the server S to initiate a login request. After receiving the login request, the server S calculates B= = = , where x represents a long key known only to the server S. The server S then generates a random number R and calculates R= and h(B'), the server S will h(B') and R is sent to user A. After receiving the message sent by server S, user A first calculates B'= and h(B'), where R= And B= , so we can get B'= = = , then, user A verifies the legitimacy of the server S by comparing the received h(B') to the calculated h(B'). If h(B') is not equal to h(B'), the server is rejected. Otherwise, user A continues to calculate C=h( R||B'), client A sends its ID and C to server S, and server S calculates C'=h( R||B'), and then check whether C and C' are equal. If they are equal, S accepts the login request, otherwise S rejects the login request, where P represents plain text.

2. A financial data sharing security authentication method according to claim 1, characterized in that: In the S101, when the enterprise transmits financial data, the data imported into the data pool every day is monitored by the data monitoring, the daily data import amount is obtained, the data import amount within ten natural days is obtained along the time axis and variance analysis is performed, and the standard deviation of the group of data import amounts is obtained. When the increase in the standard deviation exceeds the preset increase threshold with the addition of the current data import amount, an early warning message is issued to the enterprise. Through data monitoring, the data imported by the enterprise can be monitored and warned, and the data imported into the shared data pool can be uniformly encrypted.

3. A financial data sharing security authentication method according to claim 1, characterized in that: In S102, the shared data in the data pool is encrypted by a symmetric encryption algorithm, and the data in the shared data pool is traversed to encrypt the data. The specific calculation formula for encryption is as follows: M=E(Key,P) Among them, M represents ciphertext, Key represents key, P represents plaintext, and E() represents encryption function.

4. A financial data sharing security authentication method according to claim 1, characterized in that: In S105, each data requester can view the corresponding ciphertext data in the shared data pool after password authentication, and the resource requester can also view the access policy of the data sharer, and the shared data pool will send the corresponding link of the ciphertext data to the data requester.

5. A financial data sharing security authentication system, applied to a financial data sharing security authentication method as described in any one of claims 1 to 4, characterized in that: include: Data integration module: stores the financial data of several enterprises in a shared data pool and encrypts the shared data; Data encryption module: encrypts data in the shared data pool through a symmetric encryption algorithm; User registration module: When user A needs to access resources in the shared data pool, he must register his identifier ID and corresponding password PW with server S; Identity authentication module: When user A needs to access the resources of server S, the user needs to insert the USB Token into his terminal and enter the corresponding password PW, and then perform the authentication process; Data sharing module: After successful authentication, log in to the shared data pool to view shared data.

Images