Privacy data inspection system and method based on signature verification

Abstract

This invention relates to a privacy data verification system and method based on signature verification. The system includes a verification system server, an access terminal, and a topic information database. The verification system server acquires encrypted document data, a symmetric key index, and a digital signature sent by the access terminal. It decrypts the encrypted document data using the symmetric key corresponding to the symmetric key index to obtain a public key. It then verifies the signature using the digital signature and the public key to obtain a first encrypted document digest. Finally, it performs a second encrypted document digest on the encrypted document data. The signature is verified based on the first and second encrypted document digests. If the verification passes, it retrieves scenario index information and verification data from the topic information database based on scenario information in the business data. Finally, it searches the topic database using the verification data topic digest information obtained after decrypting the verification data to obtain the verification data result. This method can improve data security and integrity, and provide more refined data access authorization.

Description

Technical Field

[0001] This invention relates to the field of privacy data verification technology, and in particular to a privacy data verification system and method based on signature verification. Background Technology

[0002] In today's information age, with the rapid development of computer technology and the internet, the protection of privacy data has become increasingly important. Privacy data protection is now widely used in fields such as public security, finance, e-commerce, social management, public services, and security protection. If this data is illegally obtained or misused, it will have a serious impact on personal lives and business operations, and may even threaten social stability and national security.

[0003] Traditional methods of protecting privacy data primarily rely on encryption technology. Encryption algorithms convert private data into ciphertext for storage and transmission, ensuring that the data cannot be easily decrypted and accessed without authorization. However, traditional methods still have many problems:

[0004] (1) Data integrity issues: During transmission or storage, data may be damaged or tampered with, which may compromise data integrity.

[0005] (2) Data authenticity issues: Malicious parties may provide forged data to deceive data users, thereby compromising the authenticity of the data.

[0006] (3) Data access authorization issues: Unauthorized access may lead to the leakage or tampering of sensitive data.

[0007] (4) Data security storage issues: In traditional data storage methods, a unified identifier is used to associate various attributes of personnel. Although this storage method improves the efficiency and convenience of data management to a certain extent, it also brings challenges to data security and privacy protection.

[0008] (5) Data security compliance issues: Some industry regulations require data users to protect sensitive data and take necessary security measures to protect data security.

[0009] Therefore, how to solve the above problems and protect the security and integrity of sensitive data has become an urgent issue to be addressed. Summary of the Invention

[0010] Therefore, it is necessary to provide a privacy data verification system and method based on signature verification to address the aforementioned technical issues.

[0011] A privacy data verification system based on signature verification, the system comprising:

[0012] The system verifies a system server, an access terminal, and a thematic information database; the verification system server includes a data verification module, a cryptographic service module, and a key management module; the cryptographic service module is connected to both the data verification module and the key management module; the data verification module is connected to both the thematic information database and the access terminal.

[0013] The data verification module is used to obtain the encrypted document data, symmetric key index, and digital signature sent by the access terminal; the encrypted document data includes business data and public key;

[0014] The cryptographic service module is used to send the symmetric key index to the key management module, decrypt the document ciphertext data using the symmetric key returned by the key management module to obtain the public key, verify the signature and decryption based on the digital signature and the public key to obtain the first document ciphertext digest, digest the document ciphertext data to obtain the second document ciphertext digest, verify the signature based on the first document ciphertext digest and the second document ciphertext digest, and return the signature verification result to the data verification module.

[0015] When the signature verification result is successful, the data verification module is used to obtain the scenario index information and the verification data of the business data from the topic information database based on the scenario information in the business data, and send them to the cryptographic service module.

[0016] The cryptographic service module is used to send the scene index information to the key management module, use the scene information key returned by the key management module to decrypt the verification data, obtain the verification data topic summary information, and send it to the data verification module.

[0017] The data verification module is used to search the topic database based on the topic summary information of the verification data, obtain the verification data results, and return them to the access terminal.

[0018] A method for verifying privacy-preserving data based on signature verification, the method comprising:

[0019] Obtain the encrypted document data, symmetric key index, and digital signature sent by the access terminal; the encrypted document data includes business data and a public key;

[0020] The symmetric key is obtained from the symmetric key index. The symmetric key is used to decrypt the encrypted document data to obtain the public key. The digital signature is verified and decrypted using the public key to obtain the first encrypted document digest. The encrypted document data is digested to obtain the second encrypted document digest. The signature is verified based on the first encrypted document digest and the second encrypted document digest to obtain the signature verification result.

[0021] When the signature verification result is successful, the scenario index information and the verification data of the business data are obtained from the topic information database based on the scenario information in the business data.

[0022] The scene information key is obtained from the scene index information. The scene information key is then used to decrypt the verification data to obtain the thematic summary information of the verification data.

[0023] The verification data is retrieved from the thematic database based on the thematic summary information and returned to the access point.

[0024] The aforementioned privacy data verification system and method based on signature verification obtains the encrypted document data, symmetric key index, and digital signature sent by the access terminal through a data verification module. The cryptographic service module decrypts the encrypted document data using the symmetric key returned by the key management module to obtain a public key. The digital signature and public key are then used for verification and decryption to obtain a first encrypted document digest. A second encrypted document digest is obtained by digesting the encrypted document data. Signature verification is then performed based on the first and second encrypted document digests, thus ensuring data integrity and authenticity. When the signature verification result is successful, the data verification module retrieves scenario index information and verification data from a thematic information database based on scenario information in the business data. The cryptographic service module decrypts the verification data using the scenario information key returned by the key management module to obtain the thematic summary information of the verification data. The thematic database is then searched based on the thematic summary information to obtain the verification data result. This ensures that only authorized users can access sensitive data, and access permissions can be controlled down to specific data items, achieving fine-grained data access authorization. The embodiments of the present invention can improve data security and integrity, achieve refined data access authorization, and effectively protect sensitive data. Attached Figure Description

[0025] Figure 1 This is a structural block diagram of a signature-based privacy data verification system in one embodiment;

[0026] Figure 2 This is a schematic diagram of the access party's signature encryption process in one embodiment;

[0027] Figure 3 This is a schematic diagram of the receiver's decryption and signature verification process in one embodiment;

[0028] Figure 4 This is a structural block diagram of a privacy data verification system based on signature verification in a specific embodiment;

[0029] Figure 5 This is a flowchart illustrating a privacy data verification method based on signature verification in one embodiment. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0031] In one embodiment, such as Figure 1 As shown, a privacy data verification system based on signature verification is provided, including:

[0032] The system verifies a system server, an access terminal, and a thematic information database; the verification system server includes a data verification module, a cryptographic service module, and a key management module; the cryptographic service module is connected to both the data verification module and the key management module; the data verification module is connected to both the thematic information database and the access terminal.

[0033] The data verification module is used to obtain the encrypted document data, symmetric key index, and digital signature sent by the access terminal; the encrypted document data includes business data and public key;

[0034] The cryptographic service module is used to send the symmetric key index to the key management module, decrypt the document ciphertext data using the symmetric key returned by the key management module to obtain the public key, verify the signature and decryption based on the digital signature and the public key to obtain the first document ciphertext digest, digest the document ciphertext data to obtain the second document ciphertext digest, verify the signature based on the first document ciphertext digest and the second document ciphertext digest, and return the signature verification result to the data verification module.

[0035] When the signature verification result is successful, the data verification module is used to obtain the scenario index information and the verification data of the business data from the topic information database based on the scenario information in the business data, and send them to the cryptographic service module.

[0036] The cryptographic service module is used to send the scene index information to the key management module, use the scene information key returned by the key management module to decrypt the verification data, obtain the verification data topic summary information, and send it to the data verification module.

[0037] The data verification module is used to search the topic database based on the topic summary information of the verification data, obtain the verification data results, and return them to the access terminal.

[0038] In the aforementioned signature-based privacy data verification method, the data verification module obtains the encrypted document data, symmetric key index, and digital signature sent by the access terminal. The cryptographic service module decrypts the encrypted document data using the symmetric key returned by the key management module to obtain the public key. The digital signature and public key are then used for verification and decryption to obtain a first encrypted document digest. A second encrypted document digest is obtained by digesting the encrypted document data. Signature verification is then performed based on the first and second encrypted document digests, thus ensuring the integrity and authenticity of the data. When the signature verification result is successful, the data verification module retrieves the scenario index information and verification data of the business data from the topic information database based on the scenario information in the business data. The cryptographic service module decrypts the verification data using the scenario information key returned by the key management module to obtain the verification data topic digest information. The topic database is then searched based on the verification data topic digest information to obtain the verification data result. This ensures that only authorized users can access sensitive data, and access permissions can be controlled down to specific data items, achieving fine-grained data access authorization. The embodiments of the present invention can improve data security and integrity, achieve refined data access authorization, and effectively protect sensitive data.

[0039] The modules in the aforementioned signature-based privacy data verification system can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can invoke and execute the corresponding operations of each module.

[0040] In one embodiment, such as Figure 2 As shown, a schematic diagram of an access party signature encryption process is provided. The access party includes a data verification module and a cryptographic operation module. The access party's identity authorization information includes a symmetric key and a symmetric key index. The cryptographic operation module is used to generate a public key and a private key using an asymmetric cryptographic algorithm, and encrypts the business data with the public key using the symmetric key to obtain document ciphertext data. The cryptographic operation module is also used to perform message digest on the document ciphertext data using a message digest algorithm to obtain a document ciphertext digest, and encrypts the document ciphertext digest using the private key to generate a digital signature.

[0041] In this embodiment, a symmetric key index and a symmetric key are assigned to each access party as encryption factors for business data processing. A scenario is provided to each access party as part of the business data for transmission. The access party prepares document data by creating business data. The access party's cryptographic operation module generates a public key and a private key based on the asymmetric cryptography algorithm (SM2). It then encrypts the business data and the public key as the final document data using the assigned access party's symmetric key. The access party's cryptographic operation module performs a digest algorithm on the final encrypted document data and encrypts the digest using the private key generated by the asymmetric cryptography algorithm (SM2) to generate a digital signature. This invention uses digital signatures to verify data integrity, ensuring that no data is tampered with or damaged during transmission or storage. This prevents hackers from influencing business decisions or creating chaos by tampering with data.

[0042] Specifically, the access party's identity authorization information includes a symmetric key and a symmetric key index. The access party uses the SM2 algorithm to generate a one-time key pair: a public key and a private key. The access party prepares a data document to be signed. The document contains business data and the public key. The access party encrypts the document using the symmetric key to generate ciphertext. The access party then uses the SM3 digest algorithm to generate a ciphertext digest and digitally signs the ciphertext digest using the generated private key pair, generating a digital signature. The access party then transmits the symmetric key index, the digital signature, and the ciphertext content to the recipient.

[0043] In one embodiment, the data verification module includes a data verification interface, a topic database index acquisition interface, and a topic database information acquisition interface; the cryptographic service module includes a data ciphertext decryption interface, a signature decryption interface, a signature verification interface, and a scenario information digest processing interface; the key management module includes a key management interface; the key management module is used to provide lifecycle management of symmetric cryptographic algorithm keys and asymmetric cryptographic algorithm keys.

[0044] In this embodiment, the data verification module provides the following: a "data verification interface" for the access party, returning verification data information; a "topic library index acquisition interface" for querying topic library data, used to obtain topic scene index information, providing conditions for generating verification data summary information; and a "topic library information acquisition interface" for querying topic library data, used to obtain the data content of verification information.

[0045] The Key Management module provides lifecycle management for both symmetric and asymmetric cryptographic algorithm keys, including functions such as key creation, disabling, deletion, archiving, approving key recovery, modifying key remarks, importing keys, key rotation, and searching for specified keys. The Key Management module interfaces with the cryptographic service module through a "Key Management Interface." Based on the key index, the Key Management module provides symmetric cryptographic algorithm keys. It also manages data encryption / decryption permissions by controlling key allocation.

[0046] The cryptographic service module, including cryptographic cards or machines, connects to the data verification module through interfaces such as "Data Encryption Decryption Interface," "Signature Verification Interface," "Signature Verification Interface," and "Scenario Information Digest Processing Interface." It provides computational services for symmetric cryptographic algorithms, asymmetric cryptographic algorithms, and digest algorithms. The cryptographic service module uses the access party's public key to decrypt the access party's digital signature; uses symmetric cryptographic algorithms to decrypt the document's encrypted data; uses digest algorithms to verify the document's encrypted data and its digest information; and uses digest algorithms to generate topic digest information for querying topic databases.

[0047] In one embodiment, such as Figure 3 As shown, a schematic diagram of a receiver's decryption and signature verification process is provided. The step of sending the symmetric key index to the key management module, using the symmetric key returned by the key management module to decrypt the encrypted document data to obtain the public key, and then verifying and decrypting the signature based on the digital signature and the public key to obtain the first encrypted document digest includes: obtaining the encrypted document data, symmetric key index, and digital signature sent by the access terminal through the data verification interface; sending the encrypted document data and symmetric key index to the encrypted document decryption interface; submitting the symmetric key index to the key management interface through the encrypted document decryption interface, obtaining the symmetric key returned by the key management interface, and using the symmetric key to decrypt the encrypted document data to obtain the public key, and sending the public key to the data verification interface; and sending the digital signature and public key to the signature verification and decryption interface through the data verification interface to obtain the first encrypted document digest.

[0048] In this embodiment, the information obtained by the receiver includes a symmetric key index, document ciphertext, and digital signature information. The receiver decrypts the document ciphertext information using the symmetric key index and the document ciphertext. The document ciphertext and the ciphertext index are then passed to the decryptor. The decryptor obtains the symmetric key through the index to complete the decryption of the document ciphertext information, resulting in document data and public key information. The receiver uses the public key information to decrypt the digital signature information to obtain the first document ciphertext digest information.

[0049] In one embodiment, digesting the encrypted document data to obtain a second encrypted document digest, performing signature verification based on the first encrypted document digest and the second encrypted document digest, and returning the signature verification result to the data verification module includes: sending the encrypted document data and the first encrypted document digest to the signature verification interface through the data verification interface; digesting the encrypted document data using a message digest algorithm through the signature verification interface to obtain a second encrypted document digest; performing signature verification based on the first encrypted document digest and the second encrypted document digest; and returning the signature verification result to the data verification interface.

[0050] In this embodiment, as Figure 3 As shown, the receiver uses the SM3 digest algorithm to generate a second encrypted document digest using the encrypted document. The receiver compares the first and second encrypted document digests; if they match, the signature verification passes; otherwise, it fails. This invention verifies data authenticity by employing digital signature technology, ensuring that only data signed by the data owner is genuine. This prevents malicious parties from providing forged data to deceive data users. Furthermore, using digital signature technology to authorize access ensures that only authorized users can access sensitive data, preventing unauthorized access and potential data leakage or tampering.

[0051] In one embodiment, the thematic information database stores data in the form of scenario-based themes, with data isolation between different themes. Based on the retrieval request from the verification server, the thematic information database returns the required thematic database information content. In this embodiment, the present invention employs a dedicated scenario data storage method using thematic databases. There are no associated fields between different thematic databases, and the main identifier of row data in each thematic database is represented by a summarized data, which can provide collision resistance, immutability, computational validity, and anti-collusion properties in the stored data.

[0052] This system creates corresponding thematic information databases based on different scenarios. These databases include a verification database and a query database. For the verification database, the verification fields are determined and data is stored through the interaction of a digest algorithm and a salt value. Verification operations are performed by comparing the data.

[0053] For example:

[0054] A database for verifying ID cards, names, and job titles:

[0055] Basic fields: ID card number, name, job title.

[0056] Field storage method: sm3(sm3(ID card + name + job title) + salt value).

[0057] Table design:

[0058]

[0059] For querying the topic database, the data is processed and stored based on the user scenario identifier and the query topic field. When querying, the topic information is obtained based on the user scenario identifier field.

[0060] For example:

[0061] Salary and Reimbursement Ratio Inquiry Database:

[0062] Query index: User scenario identifier.

[0063] Storage fields: benefits, reimbursement ratio.

[0064] User scenario identification field design: sm3(sm3(ID card + name) + salt value).

[0065] Table design:

[0066]

[0067] In one embodiment, obtaining scenario index information and verification data of business data from a topic information database based on scenario information in the business data, and sending them to the cryptographic service module includes: obtaining scenario information from the topic information database through the topic database index retrieval interface, and returning the corresponding scenario index information to the topic information database; and sending the scenario index information and verification data of business data to the scenario information summary processing interface through the topic database index retrieval interface.

[0068] In one embodiment, sending the scene index information to the key management module, decrypting the verification data using the scene information key returned by the key management module to obtain the verification data topic summary information, and sending it to the data verification module includes: submitting the scene index information to the key management interface through the scene information summary processing interface, decrypting the verification data using the scene information key returned by the key management module to obtain the verification data topic summary information, and sending it to the topic library information acquisition interface.

[0069] In one embodiment, retrieving the verification data from the topic database based on the topic summary information of the verification data, obtaining the verification data result, and returning it to the access end includes: submitting the verification data topic summary information to the topic information database through the topic database information acquisition interface, obtaining the verification data result, sending the verification data result to the data verification interface, and having the data verification interface return the verification data result to the access end.

[0070] In one specific embodiment, such as Figure 4 The diagram shows a structural block diagram of a privacy data verification system based on signature verification. The specific workflow is as follows:

[0071] 1. The access party submits the encrypted data of the document (business data and public key), key index, and digital signature information to the data verification module by calling the "data verification interface".

[0072] 2. The verification system server data verification module calls the "data ciphertext decryption interface" to submit the document ciphertext data and key index to the cryptographic service module.

[0073] 3. The cryptographic service module submits the key index to the key management module through the "key management interface".

[0074] 4. The key management module returns the user's symmetric key to the cryptographic service module.

[0075] 5. The cryptographic service module performs the decryption operation of the symmetric key algorithm and returns the document data to the data verification module.

[0076] 6. The data verification module submits the digital signature data and public key to the cryptographic service module by calling the "signature verification and decryption interface".

[0077] 7. The cryptographic service module decrypts the digital signature data using an asymmetric decryption algorithm and returns the encrypted digest information of the document to the data verification module.

[0078] 8. The data verification module submits the encrypted document and its digest information to the password service module by calling the "signature verification interface".

[0079] 9. The cryptographic service module digests the encrypted document using a digest algorithm, compares the digest information, and returns the verification result to the data verification module.

[0080] 10. The data verification module submits the verification scenario information in the business data to the topic information database by calling the "topic database index acquisition interface".

[0081] 11. The thematic information database obtains the thematic database index through scenario information and returns it to the data verification module.

[0082] 12. The data verification module submits the verification data of the scene index information and business data to the cryptographic service module by calling the "Scene Information Summary Processing Interface".

[0083] 13. The cryptographic service module calls the "key management interface" to submit the scenario index information to the key management module.

[0084] 14. The key management module queries the key through the scenario index information and returns it to the cryptographic service module.

[0085] 15. The cryptographic service module uses a key to encrypt and digest business data, and returns the result to the data verification module.

[0086] 16. The data verification module submits the verification data topic summary information to the topic information database by calling the "Topic Database Information Acquisition Interface".

[0087] 17. The thematic information database returns the retrieved data results to the data verification module.

[0088] 18. The data verification module returns the verification results to the access party.

[0089] To make the technical means, objectives, and effects of this invention easier to understand, the invention will be further illustrated below with examples.

[0090] The design process is illustrated using the data verification process as an example. The data structure and interface design are described using Java.

[0091] (1) The access party calls the data verification interface of the verification system to prepare data.

[0092] 1. Encrypted Information: The verification data and public key information are encrypted using a symmetric key.

[0093] 2. Key Index: The access party needs to transmit the key index for the receiving party to use for decryption.

[0094] 3. Digital signature: After digesting the ciphertext information with SM3, it is signed using a private key generated with SM2.

[0095] (2) The access party calls the data query interface of the verification system.

[0096] 1. The access party calls the query interface of the "Data Verification Interface".

[0097] 2. The verification module returns the data to the access party.

[0098] The interface data structure is as follows:

[0099] public class CheckData {

[0100] @ApiModelProperty("encrypted information")

[0101] private String cipherText;

[0102] @ApiModelProperty("key index")

[0103] private String keyIndex;

[0104] @ApiModelProperty("digital signature")

[0105] private String digitalSignature;

[0106] }

[0107] The data verification interface query interface is designed as follows:

[0108] ;

[0109] 3) The access party calls the data verification interface of the verification system.

[0110] 1. The access party calls the verification interface of the "Data Verification Interface".

[0111] 2. The verification module returns the verification results to the access party.

[0112] The interface data structure is as follows:

[0113] public class CheckData {

[0114] @ApiModelProperty("encrypted information")

[0115] private String cipherText;

[0116] @ApiModelProperty("key index")

[0117] private String keyIndex;

[0118] @ApiModelProperty("digital signature")

[0119] private String digitalSignature;

[0120] }

[0121] The data verification interface is designed as follows:

[0122] ;

[0123] (4) Data verification and symmetric cryptography algorithm processing

[0124] 1. The verification system server data verification module calls the "data ciphertext decryption interface" to submit the document ciphertext data and key index to the cryptographic service module.

[0125] 2. The cryptographic service module submits the key index to the key management module through the "key management interface".

[0126] 3. The key management module returns the user's symmetric key to the cryptographic service module.

[0127] 4. The cryptographic service module performs the decryption operation of the symmetric key algorithm and returns the document data to the data verification module.

[0128] 5. The data verification module submits the digital signature data and public key to the cryptographic service module by calling the "signature verification and decryption interface".

[0129] 6. The cryptographic service module decrypts the digital signature data using an asymmetric decryption algorithm and returns the encrypted digest information of the document to the data verification module.

[0130] 7. The data verification module submits the encrypted document and its digest information to the cryptographic service module by calling the "signature verification interface".

[0131] 8. The cryptographic service module digests the encrypted document using a digest algorithm, compares the digest information, and returns the verification result to the data verification module.

[0132] The data encryption / decryption interface design is as follows:

[0133] ;

[0134] The signature verification and decryption interface design is as follows:

[0135] ;

[0136] The signature verification interface is designed as follows:

[0137] ;

[0138] The key management interface is designed as follows:

[0139] ;

[0140] (5) Special topic information verification

[0141] 1. The data verification module submits the verification scenario information in the business data to the topic information database by calling the "topic database index acquisition interface".

[0142] 2. The thematic information database obtains the thematic database index through scenario information and returns it to the data verification module.

[0143] 3. The data verification module submits the verification data of the scene index information and business data to the cryptographic service module by calling the "Scene Information Summary Processing Interface".

[0144] 4. The cryptographic service module calls the "key management interface" to submit the scenario index information to the key management module.

[0145] 5. The key management module queries the key through the scenario index information and returns it to the cryptographic service module.

[0146] 6. The cryptographic service module uses a key to encrypt and digest business data, and returns the result to the data verification module.

[0147] 7. The data verification module submits the verification data topic summary information to the topic information database by calling the "Topic Database Information Acquisition Interface".

[0148] 8. The thematic information database returns the retrieved data results to the data verification module.

[0149] The interface design for retrieving the topic database index is as follows:

[0150] ;

[0151] The summary information summary processing interface is designed as follows:

[0152] ;

[0153] The interface design for querying information in the thematic database is as follows:

[0154] ;

[0155] The interface design for verifying information in the thematic database is as follows:

[0156] ;

[0157] In one embodiment, such as Figure 5 As shown, a privacy data verification method based on signature verification is provided, including the following steps:

[0158] Step 502: Obtain the encrypted document data, symmetric key index, and digital signature sent by the access terminal.

[0159] The encrypted data in the document includes business data and public keys.

[0160] Step 504: Obtain the symmetric key based on the symmetric key index, decrypt the document ciphertext data using the symmetric key to obtain the public key, verify the signature and decrypt it based on the digital signature and the public key to obtain the first document ciphertext digest, digest the document ciphertext data to obtain the second document ciphertext digest, and verify the signature based on the first document ciphertext digest and the second document ciphertext digest to obtain the signature verification result.

[0161] Step 506: When the signature verification result is successful, retrieve the scenario index information and the verification data of the business data from the topic information database based on the scenario information in the business data.

[0162] Step 508: Obtain the scene information key based on the scene index information, and use the scene information key to decrypt the verification data to obtain the thematic summary information of the verification data.

[0163] Step 510: Search the topic database based on the topic summary information of the verification data to obtain the verification data results, and return them to the access terminal.

[0164] It should be understood that, although Figure 1 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order in which these steps are executed, and they can be performed in other orders. Furthermore, Figure 1 At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0165] For specific limitations on signature-based privacy data verification methods, please refer to the limitations on signature-based privacy data verification systems mentioned above, which will not be repeated here.

[0166] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0167] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these all fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the appended claims.

Claims

1. A privacy data verification system based on signature verification, characterized in that, The system includes a verification system server, an access terminal, and a thematic information database; the verification system server includes a data verification module, a cryptographic service module, and a key management module; the cryptographic service module is connected to both the data verification module and the key management module; the data verification module is connected to both the thematic information database and the access terminal. The access terminal includes an access terminal data verification module and a cryptographic operation module; The cryptographic operation module is used to generate a public key and a private key using an asymmetric cryptographic algorithm, and to encrypt business data and the public key using the symmetric key to obtain document ciphertext data; the cryptographic operation module is also used to perform message digest on the document ciphertext data using a message digest algorithm to obtain document ciphertext digest, and to encrypt the document ciphertext digest using the private key to generate a digital signature; The data verification module of the verification system server is used to obtain the encrypted document data, symmetric key index and digital signature sent by the access terminal; The cryptographic service module is used to send the symmetric key index to the key management module, decrypt the document ciphertext data using the symmetric key returned by the key management module to obtain the public key, use the decrypted public key to verify and decrypt the digital signature sent by the access end to obtain the first document ciphertext digest, use a message digest algorithm to calculate the digest of the document ciphertext data to obtain the second document ciphertext digest, perform signature verification based on the first document ciphertext digest and the second document ciphertext digest, and return the signature verification result to the data verification module. When the signature verification result is successful, the data verification module is used to obtain the scenario index information and the verification data of the business data from the topic information database based on the scenario information in the business data, and send them to the cryptographic service module. The cryptographic service module is used to send the scene index information to the key management module, use the scene information key returned by the key management module to decrypt the verification data, obtain the verification data topic summary information, and send it to the data verification module. The data verification module is used to search the topic database based on the topic summary information of the verification data, obtain the verification data results, and return them to the access terminal.

2. The system according to claim 1, characterized in that, The data verification module includes a data verification interface, a topic database index retrieval interface, and a topic database information retrieval interface; The cryptographic service module includes a data ciphertext decryption interface, a signature verification decryption interface, a signature verification interface, and a scenario information digest processing interface; The key management module includes a key management interface.

3. The system according to claim 2, characterized in that, The step involves sending the symmetric key index to the key management module, using the symmetric key returned by the key management module to decrypt the document ciphertext data to obtain the public key, and then verifying and decrypting the signature based on the digital signature and the public key to obtain the first document ciphertext digest, which includes: The document encrypted data, symmetric key index and digital signature sent by the access end are obtained through the data verification interface, and the document encrypted data and symmetric key index are sent to the data encrypted decryption interface. Submit the symmetric key index to the key management interface through the data ciphertext decryption interface, obtain the symmetric key returned by the key management interface, and use the symmetric key to decrypt the document ciphertext data to obtain the public key, and send the public key to the data verification interface. The digital signature and public key are sent to the signature verification and decryption interface through the data verification interface for verification and decryption, resulting in the first document ciphertext digest.

4. The system according to claim 2, characterized in that, The process of digesting the encrypted document data to obtain a second encrypted document digest, performing signature verification based on the first and second encrypted document digests, and returning the signature verification result to the data verification module includes: The encrypted document data and the first encrypted document digest are sent to the signature verification interface through the data verification interface. The signature verification interface uses a message digest algorithm to digest the encrypted document data to obtain a second encrypted document digest. The signature is then verified based on the first encrypted document digest and the second encrypted document digest, and the signature verification result is returned to the data verification interface.

5. The system according to claim 2, characterized in that, Based on the scenario information in the business data, the scenario index information and verification data of the business data are obtained from the topic information database and sent to the password service module, including: The scenario information in the business data is obtained from the topic information database through the topic database index retrieval interface, and the corresponding scenario index information is returned to the topic information database. The scenario index information and business data verification data are sent to the scenario information summary processing interface through the topic library index retrieval interface.

6. The system according to claim 2, characterized in that, The scene index information is sent to the key management module. The scene information key returned by the key management module is used to decrypt the verification data, obtaining the thematic summary information of the verification data, which is then sent to the data verification module, including: The scene index information is submitted to the key management interface through the scene information summary processing interface. The scene information key returned by the key management module is used to decrypt the verification data to obtain the verification data topic summary information, which is then sent to the topic database information acquisition interface.

7. The system according to claim 2, characterized in that, Based on the thematic summary information of the verification data, a search is performed in the thematic database to obtain the verification data results, which are then returned to the access point, including: The thematic summary information of the verification data is submitted to the thematic information database through the thematic database information acquisition interface to obtain the verification data results. The verification data results are then sent to the data verification interface, which returns the verification data results to the access end.

8. The system according to claim 1, characterized in that, The identity authorization information of the access terminal includes a symmetric key and a symmetric key index.

9. The system according to claim 1, characterized in that, The key management module is used to provide lifecycle management for symmetric cryptographic algorithm keys and asymmetric cryptographic algorithm keys.

10. A privacy data verification method based on signature verification implemented in the system as described in claim 1, wherein the method is implemented on a verification system server, characterized in that, The method includes: The system obtains the encrypted document data, symmetric key index, and digital signature sent by the access terminal; it obtains the symmetric key based on the symmetric key index, decrypts the encrypted document data using the symmetric key to obtain the public key, uses the decrypted public key to verify and decrypt the digital signature sent by the access terminal to obtain a first encrypted document digest, calculates the digest of the encrypted document data using a message digest algorithm to obtain a second encrypted document digest, and verifies the signature based on the first encrypted document digest and the second encrypted document digest to obtain the signature verification result. When the signature verification result is successful, the scenario index information and the verification data of the business data are obtained from the topic information database based on the scenario information in the business data. The scene information key is obtained from the scene index information. The scene information key is then used to decrypt the verification data to obtain the thematic summary information of the verification data. The verification data is retrieved from the thematic database based on the thematic summary information and returned to the access point.

Images