Space-time encryption device for internet personal information secrecy and implementation method

Abstract

The invention provides a spatio-temporal information encryption device for Internet personal controllable protection and an implementation method. The invention provides an internet personal information secrecy scheme based on a space-time encryption device, and provides a corresponding implementation means. According to the device, the completely autonomous access authority control capability is given to the user, so that the individual user can flexibly set a specific access time period according to own requirements, and only authorized visitors are allowed to access personal information data of the visitors within a specified time period. Once the set time period is exceeded, the data can be automatically encrypted, and the access authority can be immediately invalid. Besides, personalized processing schemes are provided for different visitors, and the user can distribute different access keys for the visitors according to different roles of the visitors, so that data contents which can be viewed by the different visitors can be accurately controlled; in this way, fine management of the data is achieved, and the security of personal privacy is protected more effectively.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet personal information confidentiality, and in particular to a time-space encryption device and an implementation method for Internet personal information confidentiality. Background Art

[0002] As my country's economy and society enter a high-speed development track, the level of informatization continues to rise. As the Internet becomes more and more developed, the accessibility and high-speed transmission of the Internet make the dissemination of personal information faster and more convenient, and the dissemination and sharing of information is often just a matter of seconds. The low threshold for the dissemination of personal information has brought severe challenges to the confidentiality of personal information. Personal information is at risk of being illegally used during the overly convenient transmission process. The protection of Internet personal information urgently needs a set of effective methods. Protect the rapidly disseminated personal information to prevent unauthorized persons from obtaining personal information that should be kept confidential; at the same time, on the premise of protecting personal privacy rights, ensure that users with corresponding permissions can smoothly access the required information.

[0003] At present, Internet personal information confidentiality technology mainly relies on data encryption, access control, data desensitization and other means. By encrypting personal information data during transmission and storage, such as using the Advanced Encryption Standard (AES) and RSA algorithms, it can ensure that the data cannot be interpreted when it is subject to unauthorized access.

[0004] In addition, by setting access rights to control which users or systems have the right to access personal information, user authentication and authorization management strategies are used. Common authentication methods include username and password, two-factor authentication, etc., to ensure the security of personal information. When it comes to situations where data needs to be made public or shared, sensitive information will be desensitized, such as by using technical means such as anonymization and pseudo-anonymization to reduce the risk of information leakage. However, although these existing technologies have played a role in protecting personal information to a certain extent, they have not been able to effectively supervise the access rights of internal managers to information, and there is still a potential threat of privacy leakage.

[0005] Take the Chinese patent with publication number CN113918972A as an example. Although it successfully uses the DES algorithm to encrypt patient information and protect information security by generating secret keys, personal privacy issues still exist because hospital managers still have access rights. In addition, this method is not universal and does not encrypt the data itself, but only restricts access rights, which means that if managers can access the patient's encrypted information, they can still obtain the patient's personal information through other means. Therefore, this method cannot fully protect the patient's privacy.

[0006] Although current technologies have solved the problem of confidentiality of personal information to a certain extent, there are still many limitations and areas for improvement. First, although current technologies manage access permissions for external parties and reject requests from users without access permissions, data is often stored and processed in an unencrypted form within the platform. As a result, administrators or authorized staff within the platform can still access personal information, which poses a risk of data leakage.

[0007] Secondly, most of the existing access control mechanisms are based on roles or preset permissions, lacking the flexibility of dynamic adjustment, and it is difficult to make temporary access permission adjustments according to actual conditions, which further increases the complexity of access permission management. Furthermore, the current technology mainly focuses on static data protection, and the timeliness of data access is still insufficient. There is a lack of effective mechanisms to control data access rights within a specific time period, and it is impossible to limit the number of data accesses, nor to regulate the space of data access, and it is impossible to meet users' urgent needs for data access timeliness.

[0008] In view of the above problems, in order to cope with the increasingly complex and changing Internet environment and the ever-increasing privacy protection needs, there is an urgent need for a more efficient, secure and easy-to-implement space-time encryption solution to comprehensively improve the confidentiality of personal information on the Internet. Summary of the invention

[0009] In order to solve the problem of personal information confidentiality in the current Internet environment, the purpose of the present invention is to propose a space-time encryption device for Internet personal information confidentiality, in the field of hospital services, in order to protect each patient's right to control their own personal data.

[0010] Another object of the present invention is to provide a method for implementing the above-mentioned space-time encryption device for Internet personal information confidentiality; a personalized processing scheme is provided for different visitors, and users can assign different access keys to visitors according to their different roles, thereby accurately controlling the data content that different visitors can view. In this way, refined management of data is achieved, and personal privacy is more effectively protected.

[0011] The technical solution of the space-time encryption device of the present invention mainly includes the following aspects:

[0012] A time-space information encryption device for personal controllable protection on the Internet, the device comprising a data supervisor, a data authorizer and a database;

[0013] The data regulator is used to verify access rights, the data authorizer is used to set and verify access permissions, and the database is used to store and manage access requests;

[0014] The application on the user terminal allows the user to freely set access permissions, including specifying which visitors are allowed to access the data and the time period during which they are allowed to access the data; when the server receives an access request, it will confirm through identity authentication and time verification whether only authenticated visitors within the permitted time period can access the viewable data set by the user;

[0015] Access permission settings: Users can set access permissions through the application on their terminal devices, specifying visitors and the time period during which access is allowed;

[0016] Identity authentication and time verification: When the server receives an access request, it performs identity authentication and time verification to ensure that only authenticated visitors within the permitted time period can access the viewable data set by the user;

[0017] The encryption algorithm of the automatic encryption mechanism: ensures that the data remains encrypted during the non-permitted period;

[0018] Automatic encryption trigger: Once the access permission time period set by the user is exceeded, the system automatically triggers the data encryption mechanism to ensure data security.

[0019] Furthermore, the space-time information encryption device for Internet personal controllable protection includes: an information supervisor, which is used to process information access operations, detect visitor permissions, and receive return data; the visitor information must match the information contained in the key before the next step of transmission can be carried out, otherwise the access will be denied;

[0020] Information authorization library: The information authorization library is used to query key information, send data encryption keys, and set data encryption rules. Information holders can use this part to independently write access rules and obtain the key representing the access operation. This part will obtain the corresponding data confidentiality method by verifying the key and pass it down. If the key verification fails, access will be denied.

[0021] The information repository is used to obtain information data, decrypt the information by verifying the data encryption method, and return the information data to the information supervisor.

[0022] Further, the space-time information encryption device for controllable protection of Internet individuals, the information supervisor comprises: an identity authentication device, the identity authentication device is used to verify the identity information obtained in the key, compare whether the identity information is consistent with the identity information of the visitor, and return the result;

[0023] The time-space verifier is used to verify the time information, space information and number information contained in the key, compare whether the access environment is the same as the environment described by the key, and return the result;

[0024] Information returner, which is used to send information requests, receive information and return information;

[0025] After the information returner obtains the results from the authenticator and the space-time verifier, if both parts return without exception, it will pass the key downward and wait for the information to be returned, otherwise it will return an exception.

[0026] Further, the spatiotemporal information encryption device for controllable protection of the Internet personally, the functional block diagram of the information authorizer, the structure includes: a verification key library, the verification key library is used to verify the key information and transmit the verification result, compare the obtained key information with the key library result, if they match, throw the correct information to the information key library, otherwise return an error;

[0027] Information key library, which is used to obtain information keys, obtain data encryption methods through data information and pass them to the decryptor;

[0028] Decryptor,The decryptor is used to decrypt the information encryption method,decrypt the information encryption method obtained and pass it to the information database.

[0029] In addition, the present invention also discloses a method for implementing a time-space information encryption device for Internet personal controllable protection, comprising the following steps:

[0030] 1) Information authorization: the information holder sends the access information scope, time-space relationship, and identity relationship to the information authorizer, where the information scope includes the information itself, information classification, and information composition;

[0031] 2) The spatiotemporal relationship includes time, space and number of visits; the identity relationship is the visitor's personal identity or the visitor group identity or both. The data will be passed to the verification key library, which will generate a key and return it; at the same time, the verification key library will pass the information body down to the information key library, which will generate an encryption method according to the set rules and encrypt the data, and pass the encrypted information down to the information library;

[0032] 3) Information storage: Information storage includes information entity storage and information key storage. The stored information key corresponds to the information entity.

[0033] Furthermore, the implementation method of the above-mentioned spatiotemporal information encryption device for controllable protection of Internet individuals, the process includes information supervision, the information visitor inputs spatiotemporal data, identity data and key, the information supervision process will analyze the input data, wherein the spatiotemporal verifier will verify the spatiotemporal data, the identity verification device will verify the identity data, the verification result will be combined with the key to form data integration, and the data integration will judge if the conditions are not met and throw an error return;

[0034] If the conditions are met, the information authorization step will be entered, the verification key library will accept the key, and the verification key library will retrieve and verify the key;

[0035] If the keys do not match, an error is thrown. If they match, the conditions are sent to the data key library, the data key library will obtain the data key, and the key will be passed to the information library to decrypt the information and return it.

[0036] Furthermore, the implementation method of the above-mentioned spatiotemporal information encryption device for controllable protection of Internet individuals includes a data supervisor, a data authorization library, and a database; it is used for encrypting various types of information on the Internet. In this embodiment, the data accessor and the data holder are both individuals, and the data accessor and the data holder can also be a group unit;

[0037] The time-space encryption device is used in the information acquisition link of Internet access. When a data visitor wants to view data, he needs to provide the device with a key, time-space information and identity information. The device compares the key with the data openness of the data holder to determine the access rights of the data visitor and then decides whether to provide the data to ensure data security and the basic rights and interests of the data holder.

[0038] The spatiotemporal encryption device includes a data supervisor, a data authorizer, and a database; the data holder will access the data authorizer, and the data accessor will access the data supervisor; the data supervisor is composed of an identity verification device, a spatiotemporal verifier, and a data returner;

[0039] The data supervisor will receive three types of information, namely the identity information of the data accessor, the spatiotemporal information of the data accessor, and the data access key. The authenticator will verify the data access key and the identity information of the data accessor. The spatiotemporal verifier will verify the data access key and the spatiotemporal information of the data accessor. If the access rights are not met, access will be directly denied. If the access rights are met, the data access key will be passed to the next level, to the data authorizer, and wait for the data to be returned.

[0040] Furthermore, in the implementation method of the above-mentioned spatiotemporal information encryption device for personal controllable protection on the Internet, the data authorizer is composed of a verification key library, a data key library, and a decryptor; the data holder can access the data authorizer and write access rules for his or her own data, and the data authorizer returns the key to the data holder;

[0041] When the data authorizer obtains the key from the data supervisor, the verification key library will perform a key comparison. If the key matches, the data encryption key is searched in the data key library according to the key, and the data encryption key is passed to the decryptor to decrypt the data and send the authorization information to the specified database;

[0042] The database will receive the authorization information sent by the data authorizer and send the corresponding data to the corresponding data supervisor.

[0043] Through the time-space encryption device and implementation scheme of the present invention, the present invention can achieve the following effects:

[0044] 1) Enhance personal privacy protection:

[0045] Self-control of data access: Users can set access rights and time periods independently, which enhances control over personal information data, reduces the risk of data abuse, and enhances personal privacy protection;

[0046] Automatic encryption mechanism: By controlling the data access time period and visitor permissions, it effectively prevents unauthorized access, ensures that personal data is accessed only within the authorized time, and improves data confidentiality;

[0047] 2) Improve data security:

[0048] Advanced encryption algorithm: time-space encryption algorithm ensures that data remains encrypted during unauthorized time periods to prevent data leakage;

[0049] 3) Optimize hospital data management:

[0050] Refined authority management: Through the present invention, hospitals can refine the access authority management of patient data, reduce unnecessary data sharing, and improve data management level;

[0051] Improve patient trust: Patients’ independent control over their data can increase their trust in hospital services and enhance patient satisfaction;

[0052] 4) Economic and social benefits:

[0053] Reduce the risk of data leakage: Through effective access control and encryption mechanisms, reduce data leakage incidents and reduce the resulting economic losses and legal risks;

[0054] Improve data management efficiency: Optimized data management solutions can improve the hospital's operational efficiency, save management costs, and improve overall service quality.

[0055] The space-time encryption device and implementation scheme of the present invention are not only applicable to the field of medical services, but can also be widely used in other fields, such as e-commerce, financial services, online education, social media and enterprise data management.

[0056] By expanding the application field, we firmly believe that this innovative achievement can play a powerful role in various Internet services, effectively protect personal privacy and data security, provide a flexible access control mechanism, and enhance users' trust and satisfaction with Internet services. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 It is a flow chart of adding data authority based on time-space encryption provided by an embodiment of the invention;

[0058] Figure 2 It is a flow chart of data authority access based on time-space encryption provided by an embodiment of the invention;

[0059] Figure 3 It is a schematic diagram of a space-time encryption device for Internet personal information confidentiality of the present invention;

[0060] Figure 4 yes Figure 1 The functional block diagram of the information supervisor is shown;

[0061] Figure 5 yes Figure 1 Functional block diagram of the information authorization library shown;

[0062] Figure 6 It is the information access flow chart of the space-time encryption device of the information holder;

[0063] Figure 7 It is the information access flow chart of the space-time encryption device of the information accessor. DETAILED DESCRIPTION

[0064] The present invention is further described in detail below through specific preferred embodiments combined with efficacy test examples, but the present invention is not limited to the following embodiments.

[0065] The space-time encryption device technology of the present invention emphasizes the dynamic time sequence of data and differentiated processing for different visitors, while emphasizing personal ownership of information access rights, which makes up for the shortcomings of existing technologies in data encryption and authority control, thereby more effectively protecting personal privacy.

[0066] This device gives users complete autonomy in access control capabilities, allowing individual users to flexibly set specific access periods based on their own needs, allowing only authorized visitors to access their personal information data within the specified time period; once the set time period is exceeded, the data will be automatically encrypted and the access rights will immediately become invalid.

[0067] The basic technical solution of the present invention mainly includes the following aspects:

[0068] 1. Space-time encryption device:

[0069] Hardware composition: including data regulator, data authorizer and database. Data regulator is used to verify access rights, data authorizer is used to set and verify access permissions, and database is used to store and manage access requests.

[0070] Software implementation: The application on the user terminal allows the user to freely set access permissions, including specifying which visitors and the time period during which they are allowed to access the data. When the server receives an access request, it will verify through identity authentication and time verification whether only authenticated visitors within the permitted time period can access the viewable data set by the user.

[0071] 2. Access permission control:

[0072] Access permission settings: Users can set access permissions through the application on their terminal devices, specify visitors and the time period during which access is allowed.

[0073] Identity authentication and time verification: When the server receives an access request, it performs identity authentication and time verification to ensure that only authenticated visitors within the permitted time period can access the viewable data set by the user.

[0074] 3. Automatic encryption mechanism:

[0075] Encryption algorithm: Ensures that data remains encrypted during non-permitted periods of time.

[0076] Automatic encryption trigger: Once the access permission time period set by the user is exceeded, the system automatically triggers the data encryption mechanism to ensure data security.

[0077] The present invention is a spatiotemporal information encryption device for personal controllable protection on the Internet. When a data authorizer obtains a key from a data supervisor, a key comparison is performed on the verification key library. If the key matches, the data encryption key is searched in the data key library according to the key, and the data encryption key is passed to a decryptor to release the data encryption, and the authorization information is sent to a designated database.

[0078] The database will receive the authorization information sent by the data authorizer and send the corresponding data to the corresponding data supervisor.

[0079] In addition, the implementation method of the above-mentioned space-time information encryption device for Internet personal controllable protection of the present invention includes the following steps:

[0080] 1) The time-space encryption device is used in the information acquisition process of Internet access. When a data accessor wants to view data, he needs to provide the device with a key, time-space information, and identity information. The device compares the key with the data openness of the data holder to determine the access rights of the data accessor and then decides whether to provide the data to ensure data security and the basic rights of the data holder;

[0081] The data authorizer consists of a verification key library, a data key library, and a decryptor. The data holder can access the data authorizer and write access rules for their own data. The data authorizer returns the key to the data holder.

[0082] When the data authorizer obtains the key from the data supervisor, the verification key library will perform a key comparison. If the key matches, the data encryption key is searched in the data key library according to the key, and the data encryption key is passed to the decryptor to decrypt the data and send the authorization information to the specified database;

[0083] The database will receive the authorization information sent by the data authorizer and send the corresponding data to the corresponding data supervisor.

[0084] Furthermore, in the implementation method of the above-mentioned spatiotemporal information encryption device for controllable protection of Internet individuals, the data supervisor will receive three types of information, namely, the identity information of the data accessor, the spatiotemporal information of the data accessor, and the data access key, and the identity verification device will verify the data access key and the identity information of the data accessor;

[0085] The spatiotemporal validator will verify the data access key and the spatiotemporal information of the data accessor. If the access rights are not met, access will be directly denied.

[0086] If the access rights are met, the data access key will be passed to the next level, to the data authorizer, and wait for the data to be returned.

[0087] Example 1

[0088] The present invention provides a method for implementing time-space encryption for Internet personal information confidentiality as a preferred example of the present invention.

[0089] Figure 1 A flowchart of adding data permissions based on time-space encryption is provided in an embodiment of the present invention, wherein the method described is as follows:

[0090] S110, construct an information integration including basic medical record information, time information, space information, frequency information and identity information.

[0091] In this step, the medical record holder will submit the medical record information, as well as the information on the accessibility of the medical record, the number of times the medical record can be accessed, and the location where the medical record can be accessed. Among the above five data, the medical record information and identity information must exist, and at least two of the time information, frequency information, and space information must exist to ensure access security. The five pieces of information will be stored in isolation in the information supervisor to form information integration and transmitted to the information authorizer.

[0092] S120, generating a key and a data encryption method based on information integration.

[0093] In this step, the information authorizer will generate a unique key based on the medical record information, time information, space information, frequency information and identity information in the information integration. The key will contain implicit time information, space information, identity information and frequency information. For example, in the preferred example, the information integration contains information (cold, September 1, 3 times, Dr. Li, Zhujiang Hospital), and the generated key will be xxx-abc-yyy-efg-zzz, where several verification information will be implicitly written in the key sequence. The information authorizer will randomly generate an information encryption method KKA only for the information based on the information and the generated key.

[0094] S130, encrypting the basic medical record information in the information collection.

[0095] In this step, the information authorizer will encrypt the information according to the information encryption method. For example, the medical record information "cold" in this preferred example is encrypted as "KKA cold" after using the unique encryption method KKA.

[0096] S140, storing the key, data encryption method, and encrypted data separately.

[0097] In this step, for the generated key, information encryption method and encrypted information, the generated key will be stored in the information authorizer and returned to the information supervisor in the process; the information encryption method will be stored in the information authorizer and associated with the key, and the encrypted information will be stored in the information library.

[0098] A method for implementing spatiotemporal encryption for Internet personal information confidentiality includes a data supervisor 110, a data authorization library 120, and a database 130. The implementation method of the present invention is used for encrypting various types of Internet information. In this embodiment, data accessors and data holders are individuals, and data accessors and data holders can also be group units.

[0099] Figure 2 A flowchart of data permission access based on time-space encryption is provided in an embodiment of the present invention, wherein the method described is as follows:

[0100] S111, providing the key and the time, space, and identity information of access to form temporary information integration.

[0101] In this step, the visitor (doctor) needs to provide a key (provided by the patient), visit time (consultation time), and visit space (consultation location). The above information will form a temporary data integration together with the doctor's identity information, that is, the preferred example (Dr. Li, key, consultation time, consultation hospital). The information supervisor will parse the key to verify the other information in the temporary data integration. If it does not match, access will be directly denied. If it matches, the temporary information integration will be passed to the information authorizer.

[0102] S121, perform preliminary verification of information integration.

[0103] In this step, the information authorizer will perform key comparison and number verification on the temporary information integration. If there is no access number (that is, the access number exceeds the set number), access will be denied.

[0104] S131, compare the keys and find the corresponding data encryption method to decrypt the data.

[0105] In this step, the information authorizer will retrieve the corresponding data encryption method based on the key comparison, and send the data encryption method to the information library for decryption. In this preferred example, the key xxx-abc-yyy-efg-zzz corresponds to the data encryption method KKA, and the corresponding encrypted information is "KKA cold", which is "cold" after decryption.

[0106] S141, returns the decrypted data.

[0107] In this step, the information authorizer will return the decrypted data.

[0108] The space-time encryption device is used in the information acquisition link of Internet access. When a data visitor wants to view data, he needs to provide the device 10 with a key, space-time information and identity information. The device 10 compares the key with the data openness of the data holder to determine the access rights of the data visitor and then decides whether to provide the data to ensure data security and the basic rights of the data holder.

[0109] The spatiotemporal encryption device 100 includes a data supervisor 110, a data authorizer 120, and a database 130. In this embodiment, the data holder will access the data authorizer, and the data accessor will access the data supervisor.

[0110] The data supervisor 110 is composed of an identity verification device 111, a spatiotemporal verification device 112, and a data return device 113. The data supervisor will receive three types of information, namely, the identity information of the data accessor, the spatiotemporal information of the data accessor, and the data access key. The identity verification device will verify the data access key and the identity information of the data accessor, and the spatiotemporal verification device will verify the data access key and the spatiotemporal information of the data accessor. If the access rights are not met, access will be directly denied. If the access rights are met, the data access key will be passed to the next level, passed to the data authorizer, and wait for data to be returned.

[0111] The data authorizer 120 is composed of a verification key library 121, a data key library 122, and a decryptor 123. The data holder can access the data authorizer and write access rules for his or her data. The data authorizer returns the key to the data holder. When the data authorizer obtains the key from the data supervisor, the verification key library will perform a key comparison. If the key matches, the data encryption key will be searched in the data key library according to the key, and the data encryption key will be passed to the decryptor to decrypt the data and send the authorization information to the specified database.

[0112] The database 130 receives the authorization information sent by the data authorizer and sends the corresponding data to the corresponding data supervisor.

[0113] Figure 3 It is a schematic diagram of the space-time encryption device for Internet personal information confidentiality of the present invention. The structure includes: an information regulator 110, which is used to process information access operations, detect visitor permissions, and receive return data. The visitor information must match the information contained in the key before the next step can be passed, otherwise access will be denied. If the patient needs to see a doctor, the medical record information can be passed into the information regulator, and the time of seeing a doctor is provided as time information, the place of seeing a doctor is provided as space information, and the registered doctor is provided as identity information. The information regulator will return the data storage key to the patient, and the patient can send the key to the doctor. As a doctor, he can only access at the appropriate time and place with his own identity. If any information does not match, access will be denied; an information authorization library 120, which is used to query key information, send data encryption keys, and set data encryption rules. The information holder can use this part to independently write access rules and obtain the key representing the access operation. This part will obtain the corresponding data confidentiality method by verifying the key and pass it downward. If the key verification fails, access will be denied. In the preferred example, the information authorization library obtains a series of information, stores the medical record information and generates a medical record information decryption method and key, stores the medical record information decryption method, and sends the encrypted medical record information to the information repository, and returns the generated key value to the information supervisor to the patient. For the doctor's query, if the key information does not match, access will be denied. If it matches, the corresponding decryption method will be passed to the information repository, waiting for the information to be decrypted; information repository 130, the information repository is used to obtain information data, decrypt the information by verifying the data encryption method, and return the information data to the information supervisor.

[0114] Figure 4The functional block diagram of the information supervisor includes: an identity authentication device 111, which is used to verify the identity information obtained in the key, compare whether the identity information is consistent with the identity information of the visitor, and return the result. In the preferred example, as a doctor, the identity authentication device will verify whether the doctor's identity is consistent with the identity information contained in the key, and return the result; a time-space authentication device 112, which is used to verify the time information, space information and number information contained in the key, compare whether the visit environment is the same as the environment described in the key, and return the result. In the preferred example, as a doctor, the time-space authentication device will verify whether the time and place of the doctor's visit are consistent with the time-space information contained in the key, and return the result; an information returner 113, which is used to send information requests, receive information and return information.

[0115] After the information returner obtains the results from the authenticator and the space-time verifier, if both parts return without exception, it will pass the key downward and wait for the information to be returned, otherwise it will return an exception.

[0116] Figure 5 It is a functional block diagram of an information authorizer, and the structure includes: a verification key library 121, which is used to verify key information and transmit verification results. The obtained key information is compared with the key library result. If they match, the correct information is thrown to the information key library, otherwise an error is returned. In a preferred example, as a patient, the verification key library will obtain information from the information supervisor and generate a key, encrypt the medical record information and transmit the decryption method to the information key library. As a doctor, the verification key library will verify whether the key matches the key in the library. If they match, the information encryption method is retrieved from the information key library; the information key library 122, the information key library is used to obtain information keys, obtain data encryption methods through data information and transmit them to the decryptor. In a preferred example, as a doctor, the information key library will retrieve the decryption method and transmit the decryption method to the decryptor; the decryptor 123, the decryptor is used to decrypt the information encryption method, decrypt the obtained information encryption method, and transmit it to the information library.

[0117] Figure 6 The information access flow chart of the space-time encryption device of the information holder, for the preferred example, the process includes:

[0118] 1) Information authorization: the patient sends the access information scope, time-space relationship, and identity relationship to the information authorizer, where the information scope includes medical record information, information classification, and information composition;

[0119] 2) The spatiotemporal relationship includes time, space and number of visits; the identity relationship is the visitor's personal identity or the visitor group identity or both. The data will be passed to the verification key library, which will generate a key and return it; at the same time, the verification key library will pass the information body down to the information key library, which will generate an encryption method according to the set rules and encrypt the data, and pass the encrypted information down to the information library.

[0120] 3) Information storage: Information storage includes information entity storage and information key storage. The stored information key corresponds to the information entity.

[0121] Figure 7 The flow chart of information access of the space-time encryption device for information visitors includes information supervision. The information visitor inputs space-time data, identity data and keys. The information supervision process will analyze the input data, wherein the space-time verifier will verify the space-time data, the identity verifier will verify the identity data, and the verification result will be combined with the key to form data integration. The data integration will make a judgment and throw an error return if the conditions are not met. If the conditions are met, the information authorization step will be entered. The verification key library will accept the key, and the verification key library will retrieve and verify the key. If the key does not match, an error will be thrown. If it matches, the conditions will be sent to the data key library, the data key library will obtain the data key, and the key will be passed to the information library to decrypt the information and return the information.

[0122] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Therefore, any simple modification, equivalent change and modification made to the above embodiment according to the technical essence of the present invention without departing from the technical solution of the present invention still fall within the scope of the technical solution of the present invention.

Claims

1. A space-time information encryption device for personal controllable protection on the Internet, characterized in that: The device includes a data supervisor, a data authorizer and a database; The data regulator is used to verify access rights, the data authorizer is used to set and verify access permissions, and the database is used to store and manage access requests; The application on the user terminal allows the user to freely set access permissions, including specifying which visitors are allowed to access the data and during what period of time; When receiving an access request, the server will verify the identity and time to confirm that only authenticated visitors within the permitted time period can access the viewable data set by the user; Access permission settings: Users can set access permissions through the application on their terminal devices, specifying visitors and the time period during which access is allowed; Identity authentication and time verification: When the server receives an access request, it performs identity authentication and time verification to ensure that only authenticated visitors within the permitted time period can access the viewable data set by the user; The encryption algorithm of the automatic encryption mechanism: ensures that the data remains encrypted during the non-permitted period; Automatic encryption trigger: Once the access permission time period set by the user is exceeded, the system automatically triggers the data encryption mechanism to ensure data security.

2. The time-space information encryption device for Internet personal controllable protection as claimed in claim 1, characterized in that: The structure includes: an information supervisor, which is used to process information access operations, detect visitor permissions, and receive return data; the visitor information must match the information contained in the key before the next step can be passed, otherwise the access will be denied; Information authorization library: The information authorization library is used to query key information, send data encryption keys, and set data encryption rules. Information holders can use this part to independently write access rules and obtain the key representing the access operation. This part will obtain the corresponding data confidentiality method by verifying the key and pass it down. If the key verification fails, access will be denied. The information repository is used to obtain information data, decrypt the information by verifying the data encryption method, and return the information data to the information supervisor.

3. The time-space information encryption device for Internet personal controllable protection as claimed in claim 2, characterized in that: The information supervisor includes: an identity verification device, which is used to verify the identity information in the key, compare whether the identity information is consistent with the identity information of the visitor, and return the result; The time-space verifier is used to verify the time information, space information and number information contained in the key, compare whether the access environment is the same as the environment described by the key, and return the result; Information returner, which is used to send information requests, receive information and return information; After the information returner obtains the results from the authenticator and the space-time verifier, if both parts return without exception, it will pass the key downward and wait for the information to be returned, otherwise it will return an exception.

4. The time-space information encryption device for Internet personal controllable protection as claimed in claim 2, characterized in that: The functional block diagram of the information authorizer, the structure includes: a verification key library, the verification key library is used to verify the key information and transmit the verification result, compare the obtained key information with the key library result, if they match, throw the correct information to the information key library, otherwise return an error; Information key library, which is used to obtain information keys, obtain data encryption methods through data information and pass them to the decryptor; Decryptor,The decryptor is used to decrypt the information encryption method,decrypt the information encryption method obtained and pass it to the information database.

5. The method for implementing the time-space information encryption device for Internet personal controllable protection according to any one of claims 1 to 4, characterized in that: The following steps are involved: 1) Information authorization: the information holder sends the access information scope, time-space relationship, and identity relationship to the information authorizer, where the information scope includes the information itself, information classification, and information composition; 2) The spatiotemporal relationship includes time, space and number of visits; the identity relationship is the visitor's personal identity or the visitor group identity or both. The data will be passed to the verification key library, which will generate a key and return it; at the same time, the verification key library will pass the information body down to the information key library, which will generate an encryption method according to the set rules and encrypt the data, and pass the encrypted information down to the information library; 3) Information storage: Information storage includes information entity storage and information key storage. The stored information key corresponds to the information entity.

6. The method for implementing the time-space information encryption device for Internet personal controllable protection as claimed in claim 5, characterized in that: The process includes information supervision. Information accessors input spatiotemporal data, identity data and keys. The information supervision process will analyze the input data, in which the spatiotemporal verifier will verify the spatiotemporal data, and the identity verifier will verify the identity data. The verification results will be combined with the keys to form data integration. Data integration will make judgments and throw an error return if the conditions are not met. If the conditions are met, the information authorization step will be entered, the verification key library will accept the key, and the verification key library will retrieve and verify the key; If the keys do not match, an error is thrown. If they match, the conditions are sent to the data key library, the data key library will obtain the data key, and the key will be passed to the information library to decrypt the information and return it.

7. The method for implementing the time-space information encryption device for Internet personal controllable protection as claimed in claim 5, characterized in that: The implementation method includes a data supervisor, a data authorization library, and a database; it is used to encrypt various types of information on the Internet. In this embodiment, the data accessor and the data holder are both individuals, and the data accessor and the data holder can also be a group unit; The time-space encryption device is used in the information acquisition link of Internet access. When a data visitor wants to view data, he needs to provide the device with a key, time-space information and identity information. The device compares the key with the data openness of the data holder to determine the access rights of the data visitor and then decides whether to provide the data to ensure data security and the basic rights and interests of the data holder. The spatiotemporal encryption device includes a data supervisor, a data authorizer, and a database; the data holder will access the data authorizer, and the data accessor will access the data supervisor; the data supervisor is composed of an identity verification device, a spatiotemporal verifier, and a data returner; The data supervisor will receive three types of information, namely the identity information of the data accessor, the spatiotemporal information of the data accessor, and the data access key. The authenticator will verify the data access key and the identity information of the data accessor. The spatiotemporal verifier will verify the data access key and the spatiotemporal information of the data accessor. If the access rights are not met, access will be directly denied. If the access rights are met, the data access key will be passed to the next level, to the data authorizer, and wait for the data to be returned.

8. The method for implementing the time-space information encryption device for Internet personal controllable protection as claimed in claim 7, characterized in that: The data authorizer consists of a verification key library, a data key library, and a decryptor. The data holder can access the data authorizer and write access rules for their own data. The data authorizer returns the key to the data holder. When the data authorizer obtains the key from the data supervisor, the verification key library will perform a key comparison. If the key matches, the data encryption key is searched in the data key library according to the key, and the data encryption key is passed to the decryptor to decrypt the data and send the authorization information to the specified database; The database will receive the authorization information sent by the data authorizer and send the corresponding data to the corresponding data supervisor.

Images