Private data checking system and method based on signature verification

Abstract

The invention relates to a private data checking system and method based on signature verification. The system comprises a checking system server, an access end and a thematic information base, the checking system server obtains the document ciphertext data, the symmetric key index and the digital signature sent by the access end; and decrypting the document ciphertext data by using a symmetric key corresponding to the symmetric key index to obtain a public key, performing signature verification decryption according to the digital signature and the public key to obtain a first document ciphertext abstract, abstracting the document ciphertext data to obtain a second document ciphertext abstract, performing signature verification according to the first document ciphertext abstract and the second document ciphertext abstract, and performing signature verification according to the first document ciphertext abstract and the second document ciphertext abstract. And when the signature verification is passed, scene index information and check data of the business data are obtained from the thematic information base according to scene information in the business data, and a check data result is obtained through retrieval in the thematic database according to check data thematic summary information obtained after the check data is decrypted. By adopting the method, the security and integrity of the data can be improved, and the data access authorization is refined.

Description

Technical Field

[0001] The present invention relates to the technical field of privacy data verification, and in particular to a privacy data verification system and method based on signature verification. Background Art

[0002] In today's information age, with the rapid development of computer technology and the Internet, the protection of privacy data has become increasingly important. Privacy data protection has been widely used in public security, finance, e-commerce, social management, public services, security protection and other fields. Once these data are illegally obtained or abused, they will have a serious impact on personal life and business operations, and even threaten social stability and national security.

[0003] Traditional privacy data protection methods mainly rely on encryption technology, which converts privacy data into ciphertext for storage and transmission through encryption algorithms to ensure that the data cannot be easily decrypted and accessed without authorization. However, traditional methods still have many problems:

[0004] (1) Data integrity issues: During transmission or storage, data may be damaged or tampered with, resulting in the destruction of data integrity.

[0005] (2) Data authenticity issue: Malicious parties may provide forged data to deceive data users, thereby compromising the authenticity of the data.

[0006] (3) Data access authorization issues: Unauthorized access may lead to leakage or tampering of sensitive data.

[0007] (4) Data security storage issues: In traditional data storage methods, a unified identifier is used to associate various attributes of personnel. Although this storage method improves the efficiency and convenience of data management to a certain extent, it also brings challenges to data security and privacy protection.

[0008] (5) Data security compliance issues: Some industry regulations require data users to protect sensitive data and take necessary security measures to ensure data security.

[0009] Therefore, how to solve the above problems to protect the security and integrity of sensitive data has become an urgent issue to be solved. Summary of the invention

[0010] Based on this, it is necessary to provide a privacy data verification system and method based on signature verification to address the above technical problems.

[0011] A privacy data verification system based on signature verification, the system comprising:

[0012] Verify the system server, access terminal and subject information library; the verification system server includes a data verification module, a password service module and a key management module; the password service module is connected to the data verification module and the key management module respectively; the data verification module is connected to the subject information library and the access terminal respectively;

[0013] The data verification module is used to obtain the document ciphertext data, symmetric key index and digital signature sent by the access terminal; the document ciphertext data includes business data and public key;

[0014] The cryptographic service module is used to send the symmetric key index to the key management module, use the symmetric key returned by the key management module to decrypt the document ciphertext data to obtain the public key, perform signature verification and decryption based on the digital signature and the public key to obtain the first document ciphertext summary, perform summary on the document ciphertext data to obtain the second document ciphertext summary, perform signature verification based on the first document ciphertext summary and the second document ciphertext summary, and return the signature verification result to the data verification module;

[0015] When the signature verification result is passed, the data verification module is used to obtain the scene index information and verification data of the business data from the subject information library according to the scene information in the business data, and send it to the password service module;

[0016] The cryptographic service module is used to send the scene index information to the key management module, use the scene information key returned by the key management module to decrypt the inspection data, obtain the inspection data subject summary information, and send it to the data inspection module;

[0017] The data checking module is used to search in the subject database according to the subject summary information of the checked data, obtain the check data result, and return it to the access terminal.

[0018] A method for checking private data based on signature verification, the method comprising:

[0019] Obtaining document ciphertext data, symmetric key index and digital signature sent by the access end; the document ciphertext data includes business data and public key;

[0020] Obtain a symmetric key according to the symmetric key index, use the symmetric key to decrypt the document ciphertext data to obtain a public key, perform signature verification and decryption according to the digital signature and the public key to obtain a first document ciphertext summary, perform a summary on the document ciphertext data to obtain a second document ciphertext summary, perform signature verification according to the first document ciphertext summary and the second document ciphertext summary to obtain a signature verification result;

[0021] When the signature verification result is passed, scene index information and verification data of the business data are obtained from the subject information library according to the scene information in the business data;

[0022] The scene information key is obtained according to the scene index information, and the inspection data is decrypted using the scene information key to obtain the inspection data subject summary information;

[0023] According to the subject summary information of the inspection data, a search is performed in the subject database to obtain the inspection data result and return it to the access terminal.

[0024] The above-mentioned privacy data verification system and method based on signature verification obtains the document ciphertext data, symmetric key index and digital signature sent by the access terminal through the data verification module, decrypts the document ciphertext data by using the symmetric key returned by the key management module through the cryptographic service module to obtain the public key, verifies and decrypts the digital signature and the public key to obtain the first document ciphertext summary, summarizes the document ciphertext data to obtain the second document ciphertext summary, and performs signature verification based on the first document ciphertext summary and the second document ciphertext summary, thereby ensuring the integrity and authenticity of the data. When the signature verification result is that the verification is passed, the scene index information and the verification data of the business data are obtained from the subject information library according to the scene information in the business data through the data verification module, and the verification data is decrypted by using the scene information key returned by the key management module through the cryptographic service module to obtain the subject summary information of the verification data, and the subject database is searched according to the subject summary information of the verification data to obtain the verification data result, so that only authorized users can access sensitive data, and the access rights can be controlled to specific data items, realizing refined data access authorization. The embodiments of the present invention can improve the security and integrity of data, implement refined data access authorization, and effectively protect sensitive data. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 It is a structural block diagram of a privacy data checking system based on signature verification in one embodiment;

[0026] Figure 2 A schematic diagram of the access party's signature encryption process in one embodiment;

[0027] Figure 3 A schematic diagram of the decryption and signature verification process of a receiver in one embodiment;

[0028] Figure 4 It is a structural block diagram of a privacy data verification system based on signature verification in a specific embodiment;

[0029] Figure 5 The figure is a flowchart of a privacy data verification method based on signature verification in one embodiment. DETAILED DESCRIPTION

[0030] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0031] In one embodiment, Figure 1 As shown, a privacy data verification system based on signature verification is provided, comprising:

[0032] Verify the system server, access terminal and subject information library; the verification system server includes a data verification module, a password service module and a key management module; the password service module is connected to the data verification module and the key management module respectively; the data verification module is connected to the subject information library and the access terminal respectively;

[0033] The data verification module is used to obtain the document ciphertext data, symmetric key index and digital signature sent by the access terminal; the document ciphertext data includes business data and public key;

[0034] The cryptographic service module is used to send the symmetric key index to the key management module, use the symmetric key returned by the key management module to decrypt the document ciphertext data, obtain the public key, perform signature verification and decryption according to the digital signature and the public key, obtain the first document ciphertext summary, summarize the document ciphertext data, obtain the second document ciphertext summary, perform signature verification according to the first document ciphertext summary and the second document ciphertext summary, and return the signature verification result to the data verification module;

[0035] When the signature verification result is passed, the data verification module is used to obtain the scene index information and verification data of the business data from the subject information library according to the scene information in the business data, and send it to the password service module;

[0036] The cryptographic service module is used to send the scene index information to the key management module, use the scene information key returned by the key management module to decrypt the inspection data, obtain the inspection data subject summary information, and send it to the data inspection module;

[0037] The data checking module is used to search in the subject database according to the subject summary information of the checked data, obtain the check data result, and return it to the access terminal.

[0038] In the above-mentioned privacy data verification method based on signature verification, the document ciphertext data, symmetric key index and digital signature sent by the access terminal are obtained through the data verification module, and the document ciphertext data is decrypted by the cryptographic service module using the symmetric key returned by the key management module to obtain the public key, and the signature verification and decryption are performed according to the digital signature and the public key to obtain the first document ciphertext summary, and the document ciphertext data is summarized to obtain the second document ciphertext summary, and the signature verification is performed according to the first document ciphertext summary and the second document ciphertext summary, thereby ensuring the integrity and authenticity of the data. When the signature verification result is the verification passed, the scene index information and the verification data of the business data are obtained from the subject information library according to the scene information in the business data through the data verification module, and the verification data is decrypted by the cryptographic service module using the scene information key returned by the key management module to obtain the subject summary information of the verification data, and the subject database is searched according to the subject summary information of the verification data to obtain the verification data result, so that only authorized users can access sensitive data, and the access rights can be controlled to specific data items, realizing refined data access authorization. The embodiments of the present invention can improve the security and integrity of data, implement refined data access authorization, and effectively protect sensitive data.

[0039] Each module in the above-mentioned privacy data verification system based on signature verification can be implemented in whole or in part through software, hardware and their combination. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the corresponding operations of each of the above modules.

[0040] In one embodiment, Figure 2 As shown, a schematic diagram of the access party signature encryption process is provided, wherein the access end includes a data verification module and a cryptographic operation module; the identity authorization information of the access end includes a symmetric key and a symmetric key index; the cryptographic operation module is used to generate a public key and a private key using an asymmetric cryptographic algorithm, and encrypt the business data and the public key according to the symmetric key to obtain document ciphertext data; the cryptographic operation module is also used to perform a message digest on the document ciphertext data using a message digest algorithm to obtain a document ciphertext digest, and use the private key to encrypt the document ciphertext digest to generate a digital signature.

[0041] In this embodiment, a symmetric key index and a symmetric key are allocated to each access party as encryption factors for business data processing, and a scenario is provided for each access party as part of the business data for transmission. The access party prepares the document data by creating business data. The access party cryptographic operation module generates a public key and a private key based on an asymmetric cryptographic algorithm (SM2), and encrypts the business data and the public key as the final document data using the allocated symmetric key of the access party; the access party cryptographic operation module performs a digest algorithm on the final document encrypted data, and encrypts the digested result using the private key generated by the asymmetric cryptographic algorithm (SM2) to generate a digital signature. The present invention uses a digital signature to verify the integrity of the data, which can ensure that no data is tampered with or damaged during transmission or storage, and can prevent hackers from affecting business decisions or creating confusion by tampering with data.

[0042] Specifically, the access party's identity authorization information includes a symmetric key and a symmetric key index. The access party uses the SM2 algorithm to generate a one-time key pair: a public key and a private key. The access party prepares the data document to be signed. The document contains: business data and a public key. The access party encrypts the document using a symmetric key to generate a document ciphertext. The access party continues to use the SM3 digest algorithm to generate document ciphertext summary information for the document ciphertext, and digitally signs the document ciphertext summary using the generated key pair and private key to generate digital signature information. The access party passes the symmetric key index, digital signature information, and document ciphertext content to the recipient.

[0043] In one embodiment, the data verification module includes a data verification interface, a subject library index acquisition interface, and a subject library information acquisition interface; the cryptographic service module includes a data ciphertext decryption interface, a signature verification and decryption interface, a signature verification interface, and a scene information summary processing interface; the key management module includes a key management interface; the cryptographic management module is used to provide lifecycle management of symmetric cryptographic algorithm keys and asymmetric cryptographic algorithm keys.

[0044] In this embodiment, the data verification module: provides a "data verification interface" for the access party and returns verification data information; provides a "thematic library index acquisition interface" for thematic library data query to obtain thematic scene index information, providing conditions for generating verification data summary information; provides a "thematic library information acquisition interface" for thematic library data query to obtain the data content of the verification information.

[0045] Key management module: provides lifecycle management of symmetric cryptographic algorithm keys and asymmetric cryptographic algorithm keys, including creating keys, disabling keys, deleting keys, archiving keys, approving and restoring keys, modifying key notes, importing keys, key rotation, searching for specified keys, etc. The key management module connects to the cryptographic service module through the "key management interface". The key management module provides symmetric cryptographic algorithm keys based on key indexes. The key management module manages data encryption and decryption permissions by controlling key distribution.

[0046] Password service module: including password card or password machine, connects to data inspection module through "data ciphertext decryption interface", "signature verification and decryption interface", "signature verification interface" and "scenario information summary processing interface", and provides operation services of symmetric cryptographic algorithm, asymmetric cryptographic algorithm and summary algorithm. The password service module uses the public key of the access party to decrypt the digital signature of the access party; uses the symmetric cryptographic algorithm to decrypt the ciphertext data of the document; uses the summary algorithm to verify the signature of the document ciphertext and ciphertext summary information; uses the summary algorithm to generate thematic summary information for querying thematic database information.

[0047] In one embodiment, Figure 3 As shown, a schematic diagram of the decryption and signature verification process of the receiving party is provided, wherein the symmetric key index is sent to the key management module, the symmetric key returned by the key management module is used to decrypt the document ciphertext data to obtain the public key, and the signature verification and decryption are performed according to the digital signature and the public key to obtain the first document ciphertext summary, including: obtaining the document ciphertext data, the symmetric key index and the digital signature sent by the access terminal through the data verification interface, and sending the document ciphertext data and the symmetric key index to the data ciphertext decryption interface; submitting the symmetric key index to the key management interface through the data ciphertext decryption interface, obtaining the symmetric key returned by the key management interface, and decrypting the document ciphertext data using the symmetric key to obtain the public key, and sending the public key to the data verification interface; sending the digital signature and the public key to the signature verification and decryption interface through the data verification interface for signature verification and decryption to obtain the first document ciphertext summary;

[0048] In this embodiment, the information obtained by the receiving party includes a symmetric key index, a document ciphertext and a digital signature information. The receiving party decrypts the document ciphertext information through the symmetric key index and the document ciphertext, and passes the document ciphertext and the ciphertext index to the decrypting party. The decrypting party obtains the symmetric key through the index to complete the decryption of the document ciphertext information, and obtains the document data and public key information. The receiving party uses the public key information to decrypt the digital signature information to obtain the first document ciphertext summary information.

[0049] In one embodiment, summarizing the document ciphertext data to obtain a second document ciphertext summary, performing signature verification based on the first document ciphertext summary and the second document ciphertext summary, and returning the signature verification result to the data verification module includes: sending the document ciphertext data and the first document ciphertext summary to the signature verification interface through the data verification interface; summarizing the document ciphertext data using a message digest algorithm through the signature verification interface to obtain a second document ciphertext summary, performing signature verification based on the first document ciphertext summary and the second document ciphertext summary, and returning the signature verification result to the data verification interface.

[0050] In this embodiment, if Figure 3 As shown, the receiver uses the document ciphertext to perform the SM3 digest algorithm to generate the second document ciphertext digest information, and the receiver compares the first document ciphertext digest information with the second document ciphertext digest information. When the digest information is consistent, the signature verification is passed, otherwise it fails. The present invention verifies the authenticity of data by using digital signature technology to ensure that only data signed by the data owner is authentic, which can prevent malicious parties from providing forged data to deceive data users, and uses digital signature technology to authorize access to ensure that only authorized users can access sensitive data, which can prevent unauthorized access parties from accessing sensitive data and causing data leakage or tampering.

[0051] In one embodiment, the subject information library stores data in the form of scene themes, and the data between each theme is isolated. The subject information library returns the required subject library information content according to the search request of the verification server. In this embodiment, the present invention adopts a special scene data storage method using a subject library data storage method. There are no associated fields between different subject libraries. The main identifier of the row data in the subject library is represented by the data after summary, which can provide anti-collision, immutability, calculation effectiveness, and anti-collision in the stored data.

[0052] This system creates corresponding thematic information bases according to different scenarios. The thematic information bases include verification thematic bases and query thematic bases. For the verification thematic bases, the verification fields are determined through the mutual processing of the digest algorithm and the salt value to complete the data storage, and the verification operation is completed by comparing the data.

[0053] For example:

[0054] ID card, name, position verification database:

[0055] Basic fields: ID card, name, position.

[0056] Field storage method: sm3 (sm3 (ID card + name + position) + salt value).

[0057] Table Design:

[0058] Field ID Field Name Field Type Description tb_id verification topic id varchar (64) field final storage content

[0059] For the query subject database, the processing and storage are performed according to the user scenario identifier and the query subject field, and the subject information is obtained according to the user scenario identifier field during the query.

[0060] For example:

[0061] Treatment and reimbursement ratio query database:

[0062] Query index: user scenario identifier.

[0063] Storage fields: benefits, reimbursement ratio.

[0064] User scenario identification field design: sm3 (sm3 (ID card + name) + salt value).

[0065] Table Design:

[0066]

[0067] In one embodiment, scene index information and verification data of the business data are obtained from a subject information library according to scene information in the business data, and sent to a cryptographic service module, including: obtaining scene information in the business data from the subject information library through the subject library index acquisition interface, and returning the corresponding scene index information to the subject information library; and sending the scene index information and verification data of the business data to a scene information summary processing interface through the subject library index acquisition interface.

[0068] In one embodiment, the scene index information is sent to the key management module, the scene information key returned by the key management module is used to decrypt the verification data, the verification data subject summary information is obtained, and the verification data subject summary information is sent to the data verification module, including: submitting the scene index information to the key management interface through the scene information summary processing interface, decrypting the verification data using the scene information key returned by the key management module, obtaining the verification data subject summary information, and sending it to the subject library information acquisition interface.

[0069] In one embodiment, searching in the subject database according to the subject summary information of the verification data to obtain the verification data result and returning it to the access end includes: submitting the subject summary information of the verification data to the subject information library through the subject library information acquisition interface to obtain the verification data result, and sending the verification data result to the data verification interface, and the data verification interface returns the verification data result to the access end.

[0070] In a specific embodiment, Figure 4 As shown, a structural block diagram of a privacy data verification system based on signature verification is provided, and the specific workflow is as follows:

[0071] 1. The access party calls the "data verification interface" to submit the ciphertext data, key index and digital signature information of the document (business data and public key) to the data verification module.

[0072] 2. The data verification module of the verification system server calls the "data ciphertext decryption interface" and submits the document ciphertext data and key index to the cryptographic service module.

[0073] 3. The cryptographic service module submits the key index to the key management module through the "key management interface".

[0074] 4. The key management module returns the user's symmetric key to the cryptographic service module.

[0075] 5. The cryptographic service module performs the decryption operation of the symmetric key algorithm and returns the document data to the data verification module.

[0076] 6. The data verification module submits the digital signature data and public key to the cryptographic service module by calling the "signature verification and decryption interface".

[0077] 7. The cryptographic service module decrypts the digital signature data using an asymmetric decryption algorithm and returns the document ciphertext summary information to the data verification module.

[0078] 8. The data verification module submits the document ciphertext and document ciphertext summary information to the cryptographic service module by calling the "Signature Verification Interface".

[0079] 9. The cryptographic service module uses a digest algorithm to summarize the document ciphertext, then compares the summary information and returns the verification result of the signature to the data verification module.

[0080] 10. The data verification module submits the verification scenario information in the business data to the subject information library by calling the "subject library index acquisition interface".

[0081] 11. The subject information library obtains the subject library index through scene information and returns it to the data verification module.

[0082] 12. The data verification module submits the verification data of scene index information and business data to the cryptographic service module by calling the "scene information summary processing interface".

[0083] 13. The cryptographic service module calls the "key management interface" and submits the scene index information to the key management module.

[0084] 14. The key management module queries the key through the scene index information and returns it to the cryptographic service module.

[0085] 15. The cryptographic service module uses the key to encrypt the business data summary and returns it to the data verification module.

[0086] 16. The data verification module submits the verification data topic summary information to the topic information database by calling the "topic database information acquisition interface".

[0087] 17. The subject information database returns the queried data results to the data verification module.

[0088] 18. The data verification module returns the verification data results to the access party.

[0089] In order to make the technical means, objectives and effects achieved by the present invention easier to understand, the present invention is further described below with reference to examples.

[0090] The design process is explained by taking the data verification process as an example. The data structure and interface design are described in Java.

[0091] (1) The access party calls the verification system data verification interface data preparation

[0092] 1. Ciphertext information: Encrypt the verification data and public key information using a symmetric key.

[0093] 2. Key index: The access party needs to pass the key index for the receiving party to use for decryption.

[0094] 3. Digital signature: After the ciphertext information is summarized by SM3, it is signed using the private key generated by SM2.

[0095] (2) The access party calls the data query interface of the inspection system

[0096] 1. The access party calls the query interface of the "data verification interface".

[0097] 2. The inspection module returns the data to the access party.

[0098] The interface data structure is as follows:

[0099]

[0100] @ApiModelProperty("Ciphertext information")

[0101]

[0102] The data verification interface query interface is designed as follows:

[0103]

[0104] (3) The access party calls the verification system data verification interface 1. The access party calls the verification interface of the "data verification interface". 2. The verification module returns the verification structure to the access party.

[0105] The interface data structure is as follows:

[0106]

[0107]

[0108] The data verification interface is designed as follows:

[0109]

[0110] (4) Data signature verification and symmetric cryptographic algorithm processing

[0111] 1. The data verification module of the verification system server calls the "data ciphertext decryption interface" and submits the document ciphertext data and key index to the cryptographic service module.

[0112] 2. The cryptographic service module submits the key index to the key management module through the "key management interface".

[0113] 3. The key management module returns the user's symmetric key to the cryptographic service module.

[0114] 4. The cryptographic service module performs the decryption operation of the symmetric key algorithm and returns the document data to the data verification module.

[0115] 5. The data verification module submits the digital signature data and public key to the cryptographic service module by calling the "signature verification and decryption interface".

[0116] 6. The cryptographic service module decrypts the digital signature data using an asymmetric decryption algorithm and returns the document ciphertext summary information to the data verification module.

[0117] 7. The data verification module submits the document ciphertext and document ciphertext summary information to the cryptographic service module by calling the "Signature Verification Interface".

[0118] 8. The cryptographic service module uses a digest algorithm to summarize the document ciphertext, compares the summary information, and returns the verification result of the signature to the data verification module.

[0119] The data ciphertext decryption interface is designed as follows:

[0120]

[0121]

[0122] The signature verification and decryption interface is designed as follows:

[0123]

[0124] The signature verification interface is designed as follows:

[0125]

[0126] The key management interface is designed as follows:

[0127]

[0128]

[0129] (5) Special information check

[0130] 1. The data verification module submits the verification scenario information in the business data to the subject information library by calling the "subject library index acquisition interface".

[0131] 2. The subject information library obtains the subject library index through scene information and returns it to the data verification module.

[0132] 3. The data verification module submits the verification data of scene index information and business data to the cryptographic service module by calling the "scene information summary processing interface".

[0133] 4. The cryptographic service module calls the "key management interface" and submits the scene index information to the key management module.

[0134] 5. The key management module queries the key through the scene index information and returns it to the cryptographic service module.

[0135] 6. The cryptographic service module uses the key to encrypt the business data summary and returns it to the data verification module.

[0136] 7. The data verification module submits the verification data topic summary information to the topic information database by calling the "topic database information acquisition interface".

[0137] 8. The subject information database returns the queried data results to the data verification module.

[0138] The interface design for obtaining thematic database index is as follows:

[0139]

[0140] The summary information summary processing interface is designed as follows:

[0141]

[0142]

[0143] The design of the information query interface of the subject database is as follows:

[0144]

[0145] The interface design of the subject database information verification is as follows:

[0146]

[0147] In one embodiment, Figure 5 As shown, a privacy data verification method based on signature verification is provided, comprising the following steps:

[0148] Step 502: Obtain the document ciphertext data, symmetric key index and digital signature sent by the access end.

[0149] The document ciphertext data includes business data and public key.

[0150] Step 504, obtain the symmetric key according to the symmetric key index, use the symmetric key to decrypt the document ciphertext data to obtain the public key, perform signature verification and decryption according to the digital signature and the public key to obtain the first document ciphertext summary, summarize the document ciphertext data to obtain the second document ciphertext summary, perform signature verification according to the first document ciphertext summary and the second document ciphertext summary to obtain the signature verification result.

[0151] Step 506: When the signature verification result is passed, the scene index information and the verification data of the business data are obtained from the subject information library according to the scene information in the business data.

[0152] Step 508, obtain the scene information key according to the scene index information, use the scene information key to decrypt the inspection data, and obtain the inspection data subject summary information.

[0153] Step 510, search the subject database according to the subject summary information of the inspection data, obtain the inspection data result, and return it to the access terminal.

[0154] It should be understood that although Figure 1 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 1 At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0155] For the specific limitations on the privacy data verification method based on signature verification, please refer to the limitations on the privacy data verification system based on signature verification above, which will not be repeated here.

[0156] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0157] The above-mentioned embodiments only express several implementation modes of the present invention, and the description thereof is relatively specific and detailed, but it cannot be understood as limiting the scope of the invention. It should be pointed out that, for a person of ordinary skill in the art, several modifications and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the attached claims.

Claims

1. A privacy data verification system based on signature verification, characterized in that: The system includes a verification system server, an access terminal and a subject information library; the verification system server includes a data verification module, a password service module and a key management module; the password service module is connected to the data verification module and the key management module respectively; the data verification module is connected to the subject information library and the access terminal respectively; The data verification module is used to obtain the document ciphertext data, symmetric key index and digital signature sent by the access terminal; the document ciphertext data includes business data and public key; The cryptographic service module is used to send the symmetric key index to the key management module, use the symmetric key returned by the key management module to decrypt the document ciphertext data, obtain the public key, perform signature verification and decryption according to the digital signature and the public key, obtain the first document ciphertext summary, summarize the document ciphertext data, obtain the second document ciphertext summary, perform signature verification according to the first document ciphertext summary and the second document ciphertext summary, and return the signature verification result to the data verification module; When the signature verification result is passed, the data verification module is used to obtain the scene index information and verification data of the business data from the subject information library according to the scene information in the business data, and send it to the password service module; The cryptographic service module is used to send the scene index information to the key management module, use the scene information key returned by the key management module to decrypt the inspection data, obtain the inspection data subject summary information, and send it to the data inspection module; The data checking module is used to search in the subject database according to the subject summary information of the checked data, obtain the check data result, and return it to the access terminal.

2. The system according to claim 1, characterized in that The data checking module includes a data checking interface, a subject library index acquisition interface, and a subject library information acquisition interface; The cryptographic service module includes a data ciphertext decryption interface, a signature verification and decryption interface, a signature verification interface, and a scene information summary processing interface; The key management module includes a key management interface.

3. The system according to claim 2, characterized in that The symmetric key index is sent to the key management module, the symmetric key returned by the key management module is used to decrypt the document ciphertext data to obtain the public key, and the signature is verified and decrypted according to the digital signature and the public key to obtain the first document ciphertext summary, including: Obtain the document ciphertext data, symmetric key index and digital signature sent by the access end through the data inspection interface, and send the document ciphertext data and symmetric key index to the data ciphertext decryption interface; Submit the symmetric key index to the key management interface through the data ciphertext decryption interface, obtain the symmetric key returned by the key management interface, and use the symmetric key to decrypt the document ciphertext data to obtain the public key, and send the public key to the data verification interface; The digital signature and the public key are sent to the signature verification and decryption interface through the data verification interface for signature verification and decryption to obtain the ciphertext summary of the first document.

4. The system according to claim 2, characterized in that Summarizing the document ciphertext data to obtain a second document ciphertext digest, performing signature verification according to the first document ciphertext digest and the second document ciphertext digest, and returning the signature verification result to the data verification module includes: Sending the document ciphertext data and the first document ciphertext digest to the signature verification interface through the data verification interface; The document ciphertext data is summarized by a message digest algorithm through the signature verification interface to obtain a second document ciphertext digest, and signature verification is performed based on the first document ciphertext digest and the second document ciphertext digest, and the signature verification result is returned to the data verification interface.

5. The system according to claim 2, characterized in that Acquiring scene index information and verification data of the business data from a subject information library according to the scene information in the business data, and sending the information to the cryptographic service module includes: Acquire the scene information in the business data from the subject information library through the subject library index acquisition interface, and return the corresponding scene index information to the subject information library; The scene index information and the verification data of the business data are sent to the scene information summary processing interface through the subject library index acquisition interface.

6. The system according to claim 2, characterized in that Send the scene index information to the key management module, use the scene information key returned by the key management module to decrypt the inspection data, obtain the inspection data subject summary information, and send it to the data inspection module, including: The scene index information is submitted to the key management interface through the scene information summary processing interface, and the scene information key returned by the key management module is used to decrypt the inspection data to obtain the inspection data subject summary information, and send it to the subject library information acquisition interface.

7. The system according to claim 2, characterized in that According to the subject summary information of the inspection data, the inspection data results are retrieved in the subject database and returned to the access end, including: The subject summary information of the inspection data is submitted to the subject information library through the subject library information acquisition interface to obtain the inspection data result, and the inspection data result is sent to the data inspection interface, and the data inspection interface returns the inspection data result to the access end.

8. The system according to claim 1, characterized in that The access terminal includes a data verification module and a cryptographic operation module; the identity authorization information of the access terminal includes a symmetric key and a symmetric key index; The cryptographic operation module is used to generate a public key and a private key using an asymmetric cryptographic algorithm, and encrypt the business data and the public key according to the symmetric key to obtain the document ciphertext data; The cryptographic operation module is also used to perform message digest on the document ciphertext data using a message digest algorithm to obtain a document ciphertext digest, encrypt the document ciphertext digest using the private key, and generate a digital signature.

9. The system according to claim 1, characterized in that The password management module is used to provide life cycle management of symmetric cryptographic algorithm keys and asymmetric cryptographic algorithm keys.

10. A method for checking private data based on signature verification implemented in the system as claimed in claim 1, wherein the method is implemented in a checking system server, characterized in that: The method comprises: Obtaining document ciphertext data, symmetric key index and digital signature sent by the access end; the document ciphertext data includes business data and public key; Obtain a symmetric key according to the symmetric key index, use the symmetric key to decrypt the document ciphertext data to obtain a public key, perform signature verification and decryption according to the digital signature and the public key to obtain a first document ciphertext summary, perform a summary on the document ciphertext data to obtain a second document ciphertext summary, perform signature verification according to the first document ciphertext summary and the second document ciphertext summary to obtain a signature verification result; When the signature verification result is passed, scene index information and verification data of the business data are obtained from the subject information library according to the scene information in the business data; The scene information key is obtained according to the scene index information, and the inspection data is decrypted using the scene information key to obtain the inspection data subject summary information; According to the subject summary information of the inspection data, a search is performed in the subject database to obtain the inspection data result and return it to the access terminal.

Images