Open system and method based on data security verification

Abstract

The invention relates to the technical field of data security, in particular to an opening system and method based on data security verification. The user authentication module is used for verifying the identity and authority of a user; the access control module is used for controlling and intercepting the access of the user; the data gateway system is used for ensuring a secure transmission channel between the data verification security system and the service system; the data service module is used for providing various service functions and meeting the requirements of service logic by packaging request service of an API (Application Program Interface); and the data security module is used for performing data encryption and decryption on the incoming and outgoing data. Through the design method, the problem of data leakage caused by the fact that the service system is exposed in a public network environment is avoided to a great extent. And when the data security verification system responds to the request end to the data, the data is encrypted and signed again through the data security center, so that the problem that the data is intercepted and tampered by a man-in-the-middle possibly exists in the re-request end and the data security verification system is prevented.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to an open system and method based on data security verification. Background Art

[0002] With the rapid development of the digital age, data security issues have become an important challenge faced by all walks of life. Traditional data security measures rely only on technical means such as passwords and firewalls, which are difficult to fully protect data from unauthorized access and leakage. Therefore, there is an urgent need for an open system and method with high performance to ensure the security and integrity of data. The present invention adopts an open system architecture and multi-module integrated development, which can well integrate the data security verification module and the algorithm module. Through intelligent algorithms and multiple verification mechanisms, the integrity and security of data can be efficiently verified, which reduces the risk of data leakage and data tampering, improves the data security level, and protects the privacy and interests of users. Summary of the invention

[0003] The technical problem to be solved by the present invention is to provide an open system and method based on data security verification.

[0004] In order to solve the above technical problems, the technical solution of the present invention is: an open system based on data security verification, comprising:

[0005] User authentication module: used to verify user identity and permissions;

[0006] Access control module: used to control and intercept user access;

[0007] Data gateway system: used to ensure a secure transmission channel between the data verification security system and the business system;

[0008] Data business module: used to provide various business functions and meet the needs of business logic by encapsulating API interface request services;

[0009] Data security module: used to encrypt and decrypt incoming and outgoing data.

[0010] When a user initiates a request, the user authentication center will authenticate the user to ensure the authenticity and legality of his / her identity. By verifying the user's basic information and permissions, the user authentication center can control and manage the user's access to and use of system resources.

[0011] After the user authentication system verifies the user's basic information, the access control module is responsible for interface authentication to determine whether the user has the authority to call the interface. When the user is granted the calling authority, the access control module will execute the call of the data gateway API interface.

[0012] The data gateway system is the core module of the entire system, responsible for managing all service requests and serving as the only channel for the data service system to transmit data from the intranet to the extranet.

[0013] In the data service module, all data service systems are isolated from the external network environment and adopt traditional data security measures.

[0014] A method for an open system based on data security verification comprises the following steps:

[0015] Step S1: The user enters biometric data such as face information or fingerprint information on the terminal system, and then the terminal sends the biometric data to the user authentication center of the security verification system for authentication;

[0016] Step S2: The user center receives the user's biometric data information in step S1, performs biometric authentication on the user through a biometric recognition algorithm, and returns the authentication result to the terminal system;

[0017] Step S3: After receiving the authentication result information of step S2, the terminal system sends a data request to the security verification system; after receiving the data information, the data security center performs user authentication to verify the authenticity and legitimacy of the user;

[0018] Step S4: After receiving the authentication result of step S3, the system queries the user's interface access control information according to the primary key ID of the user information; through this query, it is determined whether the user has the authentication authorization for the interface;

[0019] Step S5: After the data logic processing is completed, the next step is to enter the gateway call phase. The system will start calling the business system based on the configuration information in the third-party configuration center and use the internal private network for the call;

[0020] Step S6: After receiving the return of the business system data, the data security verification system processes and encrypts the data through the data security module and then outputs it to the requesting end.

[0021] Compared with the prior art, the present invention has the following beneficial effects:

[0022] Because the present invention has multiple link verifications, if one link verification fails, all links will fail, and the security and reliability are higher, and it has higher scalability. The business data system is not connected to the external public network system, and is only connected to the data security verification system. A third party cannot directly access the business data system. If it needs to access the data, it must go through the data security verification system, and it must go through the data verification process after passing the security verification system. Through such a design method, the data leakage problem caused by the exposure of the business system to the public network environment is avoided to a great extent. Furthermore, when the data security verification system responds to the request end, the data is encrypted and signed again by the data security center. The purpose of this is to prevent the problem of middlemen intercepting and tampering with the data between the request end and the data security verification system. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 It is a block diagram of the overall architecture of the system of the present invention;

[0024] Figure 2 It is a schematic diagram of the system structure of the present invention;

[0025] Figure 3 The figure is a flow chart of the method of the present invention. DETAILED DESCRIPTION

[0026] The specific embodiments of the present invention are further described below in conjunction with the accompanying drawings. It should be noted that the description of these embodiments is used to help understand the present invention, but does not constitute a limitation of the present invention. In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0027] like Figure 1 As shown, the terminal system has the following modules:

[0028] 1. Face recognition authentication physical module: It uses a camera and related algorithms to scan and analyze the user's facial features to determine whether the user's identity matches the registered facial information in the system.

[0029] 2. Fingerprint recognition authentication physical module: A technology used to identify and verify the identity of a user. It uses sensors and related algorithms to scan and analyze the user's fingerprint characteristics to determine whether the user's identity matches the registered fingerprint information in the system.

[0030] like Figure 2 As shown in the figure, the security verification system is divided into the following modules:

[0031] 1. User authentication module: used to verify user identity and permissions; when a user initiates a request, the user authentication center will authenticate the user to ensure the authenticity and legitimacy of his or her identity. By verifying the user's basic information and permissions, the user authentication center can control and manage the user's access to and use of system resources.

[0032] 2. Access control module: used to control and intercept user access. After the user authentication system verifies the user's basic information, the access control module is responsible for interface authentication to determine whether the user has the authority to call the interface. When the user is granted the calling authority, the access control module will execute the call of the data gateway API interface.

[0033] 3. Data Gateway System: It is used to ensure the secure transmission channel between the data verification security system and the business system. It is the core module of the entire system, responsible for managing all business requests and serving as the only channel for the data business system to transmit data from the intranet to the extranet.

[0034] 4. Data business module: used to provide various business functions and meet the needs of business logic by encapsulating API interface request services. In order to ensure data security, all data business systems are isolated from the external network environment and adopt traditional data security measures, such as firewalls and other traditional security measures.

[0035] 5. Data security module (data encryption): This module only encrypts and decrypts incoming and outgoing data. This module adopts multiple encryption formats, using a one-time pad and symmetric encryption methods in combination with asymmetric encryption methods to ensure data security.

[0036] like Figure 3 As shown, a method for an open system based on data security verification includes the following steps:

[0037] Step S1: The user enters biometric data such as facial information or fingerprint information on the terminal system, and then the terminal sends the biometric data to the user authentication center of the security verification system for authentication.

[0038] Step S2: The user center receives the user's biometric data information in step S1, performs biometric authentication on the user through a biometric recognition algorithm, and returns the authentication result to the terminal system.

[0039] Step S3: After receiving the authentication result information of step S2, the terminal system sends a data request to the security verification system. After receiving the data information, the data security center performs user authentication to verify the authenticity and legitimacy of the user.

[0040] Step S4: After receiving the authentication result of step S3, the system queries the user's interface access control information according to the primary key ID of the user information. Through this query, it is determined whether the user has the authentication authorization for the interface.

[0041] Step S5: After the data logic processing is completed, the next step is to enter the gateway call phase. The system will start calling the business system based on the configuration information in the third-party configuration center and use the internal private network for the call.

[0042] Step S6: After receiving the return of the business system data, the data security verification system processes and encrypts the data through the data security module and then outputs it to the requesting end.

[0043] Because the present invention has multiple link verifications, if one link verification fails, all links will fail, and the security and reliability are higher, and it has higher scalability. The business data system is not connected to the external public network system, and is only connected to the data security verification system. A third party cannot directly access the business data system. If it needs to access the data, it must go through the data security verification system, and it must go through the data verification process after passing the security verification system. Through such a design method, the data leakage problem caused by the exposure of the business system to the public network environment is avoided to a great extent. Furthermore, when the data security verification system responds to the request end, the data is encrypted and signed again by the data security center. The purpose of this is to prevent the problem of middlemen intercepting and tampering with the data between the request end and the data security verification system.

[0044] The present invention combines the terminal system and uses face recognition and fingerprint recognition as unique biometric features that are difficult to forge as user biometric authentication in terms of security. Compared with the traditional username and password login method, face recognition and fingerprint recognition are more difficult to be impersonated or stolen. Face recognition and fingerprint recognition login can effectively prevent account sharing and theft. Since these biometric features are unique and cannot be copied or transferred by others, it can ensure that only authorized users can log in and access relevant accounts and data.

[0045] The embodiments of the present invention are described in detail above with reference to the accompanying drawings, but the present invention is not limited to the described embodiments. For those skilled in the art, various changes, modifications, substitutions and variations of these embodiments are made without departing from the principles and spirit of the present invention, and still fall within the scope of protection of the present invention.

Claims

1. An open system based on data security verification, characterized in that: include: User authentication module: used to verify user identity and permissions; Access control module: used to control and intercept user access; Data gateway system: used to ensure a secure transmission channel between the data verification security system and the business system; Data business module: used to provide various business functions and meet the needs of business logic by encapsulating API interface request services; Data security module: used to encrypt and decrypt incoming and outgoing data.

2. The open system based on data security verification according to claim 1, characterized in that: When a user initiates a request, the user authentication center will authenticate the user to ensure the authenticity and legality of his / her identity. By verifying the user's basic information and permissions, the user authentication center can control and manage the user's access to and use of system resources.

3. The open system based on data security verification according to claim 1, characterized in that: After the user authentication system verifies the user's basic information, the access control module is responsible for interface authentication to determine whether the user has the authority to call the interface. When the user is granted the calling authority, the access control module will execute the call of the data gateway API interface.

4. The open system based on data security verification according to claim 1, characterized in that: The data gateway system is the core module of the entire system, responsible for managing all service requests and serving as the only channel for the data service system to transmit data from the intranet to the extranet.

5. The open system based on data security verification according to claim 1, characterized in that: In the data service module, all data service systems are isolated from the external network environment and adopt traditional data security measures.

6. A method for an open system based on data security verification, characterized in that: The following steps are involved: Step S1: The user enters biometric data such as face information or fingerprint information on the terminal system, and then the terminal sends the biometric data to the user authentication center of the security verification system for authentication; Step S2: The user center receives the user's biometric data information in step S1, performs biometric authentication on the user through a biometric recognition algorithm, and returns the authentication result to the terminal system; Step S3: After receiving the authentication result information of step S2, the terminal system sends a data request to the security verification system; after receiving the data information, the data security center performs user authentication to verify the authenticity and legitimacy of the user; Step S4: After receiving the authentication result of step S3, the system queries the user's interface access control information according to the primary key ID of the user information; through this query, it is determined whether the user has the authentication authorization for the interface; Step S5: After the data logic processing is completed, the next step is to enter the gateway call phase. The system will start calling the business system based on the configuration information in the third-party configuration center and use the internal private network for the call; Step S6: After receiving the return of the business system data, the data security verification system processes and encrypts the data through the data security module and then outputs it to the requesting end.

Images