Cross-border data verification system and method

Abstract

The invention provides a cross-border data verification system and method, and the system comprises a data main body, an overseas receiver, and a domestic agent provided with a domestic trusted third party. And the data subject sends the first data security certification file of the target cross-border data and the data subject identity identifier to an overseas receiver. And the overseas receiver performs data encryption processing on the first data security certificate file and the data subject identity identifier to obtain a second data security certificate file and a cross-border service identifier, and sends at least one of the second data security certificate file and the cross-border service identifier to the domestic agent and the data subject. The domestic agent performs data verification on the target cross-border data based on a first data security certification file, a second data security certification file, a data subject identity identifier and a cross-border service identifier stored by the domestic trusted third party to obtain a target verification result, and sends the target verification result to the overseas receiver; therefore, the effect of improving the verification security of the cross-border data is achieved.

Description

Technical Field

[0001] The present application relates to the technical field of cross-border data processing, and in particular to a cross-border data verification system and method. Background Art

[0002] In traditional cross-border data verification solutions, data recipients located overseas are often required to verify cross-border data to ensure compliance of cross-border data. However, the verification of cross-border data by overseas recipients needs to be based on the identity privacy information of the data subject (i.e., the cross-border data provider), and the identity privacy information of the data subject is often provided by a specific data source in China. The data source stores the identity privacy information of multiple different data subjects, which is used to provide a unified basis for cross-border data verification for overseas recipients. These identity privacy information has a certain risk of data leakage during the data transmission process through the data source, resulting in poor security for cross-border data verification at present.

[0003] Therefore, how to solve the problem of poor security in cross-border data verification in related technologies has become a technical problem that technical personnel in this field urgently need to solve. Summary of the invention

[0004] Based on the above problems, in order to improve the verification security of cross-border data, the embodiments of the present application provide a cross-border data verification system and method.

[0005] The embodiments of the present application disclose the following technical solutions: In a first aspect, the embodiment of the present application provides a cross-border data verification system, including: a data subject, an overseas recipient, and a domestic agent; the domestic agent includes: a domestic trusted third party; The data subject is used to send the first data security certification document for the target cross-border data and the data subject identity identifier to the overseas recipient; the first data security certification document is generated by the domestic trusted third party based on the target cross-border data and the identity data of the data subject through security verification; The overseas recipient is configured to perform data encryption processing on the first data security certification document and the data subject identity identifier to obtain a second data security certification document and a cross-border business identifier, and send at least one of the second data security certification document and the cross-border business identifier to the domestic agent and the data subject; The domestic agent is used to verify the target cross-border data based on the first data security certification document, the second data security certification document, the data subject identity and the cross-border business identifier stored in the domestic trusted third party, obtain the target verification result, and send the target verification result to the overseas recipient.

[0006] In a possible implementation, the domestic agent includes: a domestic data calling module; the domestic data calling module is specifically used to: Receiving the data subject identity identifier sent by the data subject; Perform data encryption on the data subject identity identifier to obtain a domestic business identifier; Based on the domestic business identifier, the first data security certification document is called from the domestic trusted third party.

[0007] In a possible implementation, the domestic agent includes: a domestic data processing module; the domestic data processing module is specifically used to: The first data security certification document is encrypted using the same data encryption method as that used by the overseas recipient to obtain a third data security certification document.

[0008] In a possible implementation, the domestic agent includes: a domestic data verification module; the domestic data verification module is specifically used to: Performing an integrity comparison between the second data security certification document and the third data security certification document to obtain a security certification document comparison result, and performing an integrity comparison between the cross-border business identifier and the domestic business identifier to obtain a business identifier comparison result; When the comparison result of the security certification document and the comparison result of the business identification are both the same, it is determined that the target verification result is passed.

[0009] In a possible implementation, the data body includes: a data feedback module; the data feedback module is specifically used to: Receiving the cross-border business identifier fed back by the overseas recipient; Based on the cross-border business identifier, the data subject identity identifier is sent to the domestic agent.

[0010] In a possible implementation, the data subject includes: a data acquisition module, and the data acquisition module is specifically used to: Send the identity data and the target cross-border data to the domestic trusted third party; Obtain the first data security certification document generated by the domestic trusted third party based on the identity data and the target cross-border data; the first data security certification document is used to prove the security and compliance of the target cross-border data.

[0011] In a possible implementation, the domestic trusted third party includes: a security verification module; the security verification module is specifically used to: receiving the target cross-border data and the identity data; Extracting target cross-border business requirements and cross-border original data from the target cross-border data; Conduct compliance analysis on the target cross-border business needs and integrity analysis on the cross-border original data to obtain cross-border data compliance certification; Perform security analysis on the identity data and generate an identity security certification document; The cross-border data compliance certificate and the identity security certificate document are determined as the first data security certificate document.

[0012] In a possible implementation, the domestic data verification module further includes: a mapping establishment unit; the mapping establishment unit is specifically configured to: Establishing a data verification mapping relationship between the target verification result and the second data security certification document and the cross-border business identifier; The data verification mapping relationship and the target verification result are sent to the overseas recipient.

[0013] In a second aspect, the embodiment of the present application provides a cross-border data verification method, which is applied to a cross-border data verification system, wherein the cross-border data verification system includes: a data subject, an overseas recipient, and a domestic agent; the domestic agent includes: a domestic trusted third party; the method includes: Control the data subject to send the first data security certification document for the target cross-border data and the data subject's identity identifier to the overseas recipient; the first data security certification document is generated by the domestic trusted third party based on the target cross-border data and the data subject's identity data through security verification; Control the overseas recipient to perform data encryption processing on the first data security certification document and the data subject identity identifier to obtain a second data security certification document and a cross-border business identifier, and send at least one of the second data security certification document and the cross-border business identifier to the domestic agent and the data subject; Control the domestic agent to verify the target cross-border data based on the first data security certification document, the second data security certification document, the data subject identity identifier and the cross-border business identifier stored in the domestic trusted third party, obtain a target verification result, and send the target verification result to the overseas recipient.

[0014] In a possible implementation, the domestic trusted third party includes: a security verification module; the security verification module is specifically used to: receiving the target cross-border data and the identity data; The target cross-border data and the identity data are verified for security compliance to generate the first data security certification document.

[0015] Compared with the prior art, the present application has the following beneficial effects: The embodiment of the present application provides a cross-border data verification system and method, in which a data subject, an overseas recipient, and a domestic agent with a domestic trusted third party are included. Among them, the data subject directly sends the first data security certification document related to the target cross-border data and its own data subject identity identifier to the overseas recipient. Among them, the identity identifier related to identity privacy is provided by the data subject to the overseas recipient by itself, without going through a specific data source, thereby avoiding the risk of leakage of identity privacy information at the data source and ensuring the verification security of cross-border data. However, the security certification document transmitted by the data subject may also be forged. In order to prove that the cross-border data transmitted by the data subject is authentic and secure, the overseas recipient needs to encrypt the received first data security certification document and the data subject identity identifier, and send the encrypted second data security certification document and the cross-border business identifier to the domestic agent. Subsequently, the domestic agent verifies the target cross-border data based on the first data security certification document, the second data security certification document, the data subject identity identifier and the cross-border business identifier stored in the domestic trusted third party. While preventing the data subject from forging security certification documents to improve the accuracy of verification, the verification process for the target cross-border data is transferred from abroad to within the country, thereby avoiding the risk of data leakage in the process of transmitting privacy data abroad and effectively improving the verification security of cross-border data. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0017] Figure 1 A schematic diagram of the structure of a cross-border data verification system provided in an embodiment of the present application; Figure 2 A flowchart of a method for calling domestic data provided in an embodiment of the present application; Figure 3 A flowchart of a domestic data verification method provided in an embodiment of the present application; Figure 4 A flowchart of a cross-border data verification method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0018] In order to make the purpose, technical solutions and advantages of this application more clear, the following is a further detailed description of this application in combination with specific embodiments and with reference to the accompanying drawings. It should be noted that the embodiments described in the embodiments of this application are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0019] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present application should be understood by people with ordinary skills in the field to which the present application belongs. The "first", "second" and similar words used in the embodiments of the present application do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "include" and similar words mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "down", "left", "right", etc. are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0020] As mentioned above, in traditional cross-border data verification solutions, data recipients located overseas are often required to verify cross-border data to ensure compliance of cross-border data. However, since the verification of cross-border data by overseas recipients needs to be based on the identity privacy information of the data subject (i.e., the cross-border data provider), the identity privacy information of the data subject is often provided by a specific data source in China. The data source stores the identity privacy information of multiple different data subjects, which is used to provide a unified basis for cross-border data verification for overseas recipients. These identity privacy information has a certain risk of data leakage during the data transmission process through the data source, resulting in poor security for the current verification of cross-border data.

[0021] In order to solve the above problems, the embodiment of the present application provides a cross-border data verification system and method, in which a data subject, an overseas recipient, and a domestic agent with a domestic trusted third party are included. Among them, the data subject directly sends the first data security certification document related to the target cross-border data and its own data subject identity identifier to the overseas recipient. Among them, the identity identifier related to identity privacy is provided by the data subject to the overseas recipient by itself, without going through a specific data source, thereby avoiding the risk of leakage of identity privacy information at the data source and ensuring the verification security of cross-border data. However, the security certification document transmitted by the data subject may also be forged. In order to prove that the cross-border data transmitted by the data subject is authentic and secure, the overseas recipient needs to encrypt the received first data security certification document and the data subject identity identifier, and send the encrypted second data security certification document and the cross-border business identifier to the domestic agent. Subsequently, the domestic agent verifies the target cross-border data based on the first data security certification document, the second data security certification document, the data subject identity identifier and the cross-border business identifier stored in the domestic trusted third party. While preventing the data subject from forging security certification documents to improve the accuracy of verification, the verification process for the target cross-border data is transferred from abroad to within the country, thereby avoiding the risk of data leakage in the process of transmitting privacy data abroad and effectively improving the verification security of cross-border data.

[0022] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0023] Next, the cross-border data verification system provided by the embodiment of the present application will be introduced in conjunction with the specific embodiment drawings.

[0024] See also Figure 1 , Figure 1 A schematic diagram of the structure of a cross-border data verification system provided in an embodiment of the present application. Figure 1It can be seen that the cross-border data verification system provided in the embodiment of the present application includes a data subject, an overseas recipient, and a domestic agent. Among them, the data subject is used to represent the subject that has cross-border business needs and needs to send target cross-border data to an overseas recipient. The domestic agent belongs to a broader category concept, and its core essence lies in acting as an agent for the overseas recipient to verify the cross-border data. Therefore, in actual application scenarios, the domestic agent can be a subsidiary of the overseas recipient, or it can be an institution specifically responsible for cross-border data verification, or even a combination of a subsidiary and a verification institution. Its essence lies in working together to complete the domestic-based data verification agency work, which will not be elaborated in the embodiment of the present application.

[0025] In the embodiment of the present application, although the domestic agent can be a subsidiary of the overseas recipient or any cross-border data verification agency, etc., in order to prove that the target cross-border data transmitted by the data subject is secure and compliant, a domestic trusted third party must be set up in the domestic agent as a source of proof of the security of the target cross-border data.

[0026] The main function of a domestic trusted third party is to provide a trusted source for the data to be processed and to ensure the compliance and security of cross-border data. When the data subject needs to send the target cross-border data to the overseas recipient to conduct cross-border business, the data acquisition module in the data subject needs to send the target cross-border data and its own identity data to the trusted third party, so that the trusted third party can verify the compliance and security of the target cross-border data, and then receive the first data security certification document fed back by the trusted third party.

[0027] When the trusted third party receives the target cross-border data and identity data sent by the data subject, the security verification module in the trusted third party extracts the target cross-border business requirements and the original data that needs to be transmitted across borders from the target cross-border data, and performs compliance analysis and integrity analysis on them respectively to obtain the cross-border data compliance certificate. The cross-border data compliance certificate can ensure the compliance of the target cross-border data from two levels: cross-border business requirements and original data.

[0028] At the same time, its security verification module verifies whether the identity information of the data subject is forged through the identity data sent by the data subject, thereby ensuring the security of the source of cross-border data and obtaining an identity security certificate. In this way, the identity security certificate and the cross-border data compliance certificate can be determined as the first data security certificate, thereby ensuring the security of the target cross-border data through the three levels of cross-border business needs, original data and identity information, and improving the accuracy of cross-border data verification. Among them, the first data security certificate can be in a variety of different forms such as a single value, multiple combined values, a single file, and multiple combined files. It can be accompanied by all or part of the target cross-border data, so that the overseas recipient can verify the security of the target cross-border data. The first data security certificate can also be accompanied by specific electronic signatures, trusted timestamps and other identifications to ensure the authenticity of the security certificate.

[0029] In addition, when the data subject sends identity data to a trusted third party, the identity data also includes one or more identity identifiers about the data subject. Based on the received identity data, the domestic trusted third party needs to agree with the data subject in advance on the data subject identity identifier to be used in the entire cross-border data verification process to ensure that the outside world can call the data subject's security certification documents through the uniformly agreed data subject identity identifier to ensure traceability.

[0030] The data subject is used to send the first data security certification document for the target cross-border data and the data subject's identity identification to the overseas recipient; the first data security certification document is generated by the domestic trusted third party based on the target cross-border data and the data subject's identity data after security verification.

[0031] When the data subject receives the first data security certification document fed back by a domestic trusted third party, the data subject will send the first data security certification document and its own data subject identity to the overseas recipient to initiate a cross-border business request to the overseas recipient and prove the security of the target cross-border data to the overseas recipient.

[0032] Among them, the data subject identity identifier is only used as a simple information to identify the data subject's identity, such as a processed mobile phone number, a specific number, etc. It can be a specific number pre-agreed by the data subject and the overseas recipient. Therefore, the cross-border transmission of the data subject identity identifier will not disclose the data subject's identity privacy information. At the same time, the first data security certification document is only used to prove the data security of the target cross-border data, and does not contain the original data of the target cross-border data. Therefore, the first data security certification document and the data subject identity identifier transmitted by the data subject to the overseas recipient can declare its own cross-border business needs and the security of cross-border data to the overseas recipient while ensuring that the privacy data is not leaked during the cross-border transmission process.

[0033] In one possible implementation, the data subject can also simultaneously send a data processing authorization letter to the overseas recipient to grant the overseas recipient the right to encrypt and process the received data.

[0034] The overseas recipient is used to perform data encryption processing on the first data security certification document and the data subject identity identifier to obtain a second data security certification document and a cross-border business identifier, and send at least one of the second data security certification document and the cross-border business identifier to the domestic agent and the data subject.

[0035] Although the first data security certificate document can prove that the target cross-border data transmitted by the data subject is safe, in actual application scenarios, there is also the possibility that the data subject forges the first data security certificate document. Therefore, in order to confirm the authenticity of the first data security certificate document, the overseas recipient needs to feedback the received first data security certificate document to the domestic agent, and the agent will verify the authenticity of the first data security certificate document, thereby transferring the cross-border data verification work that should be performed overseas to domestic execution.

[0036] Among them, in order to prevent information leakage when the first data security certificate document is transmitted back to the domestic agent, the overseas recipient needs to encrypt the first data security certificate document to convert the first data security certificate document into an anonymous and verified data security certificate document, namely the second data security certificate document. The encrypted second data security certificate document cannot point to and restore the data subject alone, thereby ensuring the security of cross-border data transmission. At the same time, in order to provide the domestic agent with the required index basis for data verification, the overseas recipient also needs to encrypt the identity of the data subject at the same time to obtain the cross-border business identifier, and feed back the cross-border business identifier to the domestic agent and the data subject, so as to assign a specific index tag (i.e., the cross-border business identifier) ​​to the target cross-border data, providing an index basis for subsequent data verification.

[0037] When the data feedback module in the data subject receives the cross-border business identifier fed back by the overseas recipient, since the overseas recipient also feeds back the cross-border business identifier to the domestic agent at the same time, the data feedback module can determine the specific domestic agent through the cross-border business identifier, thereby providing the domestic agent with its own identity identifier, so that the domestic agent can call the first data security certification document from the domestic trusted third party through the identity identifier.

[0038] In a possible implementation, the overseas recipient may encrypt the first data security certification document and the data subject's identity using a hash encryption algorithm, de-identification technology, data desensitization technology, or a combination of various encryption technologies. Taking the hash encryption algorithm as an example, the overseas recipient encrypts the first data security certification document and the data subject's identity and converts them into a single hash string to ensure the security of cross-border data transmission.

[0039] In another possible implementation, the overseas recipient can also establish a mapping between the cross-border business identifier and the second data security certification document to facilitate subsequent cross-border data verification work.

[0040] The domestic agent is used to verify the target cross-border data based on the first data security certification document, the second data security certification document, the data subject identity and the cross-border business identifier stored in the domestic trusted third party, obtain the target verification result, and send the target verification result to the overseas recipient.

[0041] The domestic agent is used to perform the data verification work on the target cross-border data that should be performed by the overseas recipient. It aims to verify the target cross-border data through the second data security certification document, the data subject identity identifier and the cross-border business identifier. The entire data verification process for the target cross-border data is completed by the domestic data call module, domestic data processing module and domestic data verification module set up by the domestic agent. Next, the specific functions implemented by the above three modules will be introduced respectively.

[0042] First, we will introduce the domestic data call module. For details, please refer to Figure 2 , Figure 2 A flowchart of a method for calling domestic data provided in an embodiment of the present application specifically includes the following steps: S1011: receiving the data subject identity identifier sent by the data subject; S1012: Encrypt the data subject's identity identifier to obtain a domestic business identifier; S1013: Based on the domestic business identifier, call the first data security certification document from the domestic trusted third party.

[0043] The second data security certification document and cross-border business identifier fed back by the overseas recipient to the domestic agent are received by the domestic data call module in the domestic agent. As can be seen from the foregoing, when the data subject receives the cross-border business identifier fed back by the overseas recipient, since the overseas recipient also feeds back the cross-border business identifier to the domestic agent, the data subject can determine the data that needs to be sent to the domestic agent through the cross-border business identifier, and then send the same data subject identity identifier as that sent to the overseas recipient to the domestic agent, so that the domestic agent can call the security certification document based on the identity identifier.

[0044] The data subject identity identifier is a representation of the data subject's identity information. Since the data subject has transmitted its own identity data to a domestic trusted third party during the generation of the first data security certification document, and the domestic trusted third party has generated the corresponding first data security certification document based on its identity data and the target cross-border data, the domestic call module can call the first data security certification document from the domestic trusted third party through the data subject identity identifier. Since this first data security certification document is stored in a trusted third party, there is no risk of being forged by the data subject, thereby ensuring the accuracy of data verification.

[0045] Among them, when calling the first data security certification document through the data subject identity identifier, in order to prevent the identity identifier from being tampered with by the outside world, the data subject identity identifier sent to the trusted third party needs to be encrypted. As can be seen in the previous article, the overseas recipient also encrypted the data subject identity identifier and generated a cross-border business identifier. In order to confirm that the data subject feedback to the domestic agent and the overseas recipient is the same identity identifier, the domestic calling module needs to use the same encryption method as the overseas recipient, encrypt the data subject identity identifier, obtain the domestic business identifier, and call the first data security certification document based on the domestic identifier, so that the domestic agent and the overseas recipient use the same data processing method for the data security certification document, thereby improving the accuracy of cross-border data verification.

[0046] Next, the domestic data processing module is introduced. The domestic data processing module is mainly used to perform the following steps: Step 1: Use the same data encryption method as that of the overseas recipient to encrypt the first data security certification document to obtain a third data security certification document.

[0047] Since the second data security certificate document is obtained based on the data encryption processing of the first data security certificate document by the overseas recipient. In order to ensure the accuracy of cross-border data verification, it is necessary to use the same encryption method as the overseas recipient to encrypt the first data security certificate document and obtain the third data security certificate document. In the subsequent cross-border data verification, because the domestic agent uses the same data processing method as the overseas recipient in the data processing stage for the security certificate document and business identification, when conducting cross-border data verification, the third data security certificate document can be directly compared with the second data security certificate document for consistency, and the cross-border data can be verified by judging whether the two are the same.

[0048] In addition, in addition to the first data security certification document, the cross-border business identifier, the second data security certification document and the generated domestic business identifier received by the overseas data call module will all be sent to the domestic data processing module. When the domestic data processing module generates the third data security certification document, it will send the third data security certification document, the second data security certification document, the cross-border business identifier and the domestic business identifier to the domestic data verification module, so that the domestic data verification module can verify the target cross-border data.

[0049] Next, we will introduce the domestic data verification module. For details, please refer to Figure 3 , which is a flow chart of a domestic data verification method provided in an embodiment of the present application, which includes the following steps: S2011: performing an integrity comparison between the second data security certification document and the third data security certification document to obtain a security certification document comparison result, and performing an integrity comparison between the cross-border business identifier and the domestic business identifier to obtain a business identifier comparison result; S2012: When the comparison result of the security certification document and the comparison result of the business identification are both the same, determining that the target verification result is verification passed.

[0050] During the data verification phase for the target cross-border data, the domestic data verification module needs to verify the data from two levels: business identification and security certification documents. At the security certification document level, since the second data security certification document and the third data security certification document are obtained by the same data encryption process, if the data subject does not tamper with or forge the first data security certification document when transmitting it, the second data security certification document and the third data security certification document are exactly the same. Therefore, by comparing the consistency of the second data security certification document and the third data security certification document, it can be used as a basis for data verification of the target cross-border data to obtain the security certification document comparison result. If the two are different, it proves that the first data security report was tampered with when it was transmitted to the overseas recipient, and the corresponding target verification result is determined to be failed.

[0051] Similarly, at the business identification level, the cross-border business identification is compared with the domestic business identification to obtain the business identification comparison result. Only when the business identification comparison result and the security certification document comparison result are exactly the same, can it be determined that the target cross-border data has not been tampered with or forged, and the target verification result can be determined to be passed.

[0052] The above is an introduction to the domestic data call module, the domestic data processing module and the domestic data verification module. It should be noted that in actual application scenarios, when there is a third-party cross-border data verification agency or a subsidiary of an overseas recipient, the work content performed by any of the above modules can be implemented by any party of the domestic trusted third party, the subsidiary of the overseas recipient and the third-party cross-border data verification agency. At the same time, the functions of all modules can also be implemented by any party. When there are multiple institutions or participants for data verification, the data flow is the same as the data flow of the above three modules, and this embodiment does not limit this.

[0053] In a possible extreme scenario, a domestic trusted third party can be responsible for all the work content of the domestic data call module, domestic data processing module and domestic data verification module, that is, the domestic trusted third party can be used as the actual domestic agent. If the domestic trusted third party does not directly face the market, the corresponding work process can be executed through the corresponding authorized party of the domestic trusted third party.

[0054] In a possible implementation, a mapping establishment unit may be provided in the domestic data verification module, and the mapping establishment unit is used to establish a data verification mapping relationship between the target verification result and the second data security certification document and the cross-border business identifier. When the obtained target verification result is fed back to the overseas recipient, the data verification mapping relationship and the target verification result may be further sent to the overseas recipient together, so that the overseas recipient can confirm the cross-border business involved in the target verification result based on the data verification mapping relationship, thereby improving the processing efficiency of the overseas recipient.

[0055] The embodiment of the present application provides a cross-border data verification system and method, in which the system includes a data subject, an overseas recipient, and a domestic agent with a domestic trusted third party. Among them, the data subject directly sends the first data security certification document related to the target cross-border data and its own data subject identity identifier to the overseas recipient. Among them, the identity identifier related to identity privacy is provided by the data subject to the overseas recipient by itself, without going through a specific data source, thereby avoiding the risk of leakage of identity privacy information at the data source and ensuring the verification security of cross-border data. However, the security certification document transmitted by the data subject may also be forged. In order to prove that the cross-border data transmitted by the data subject is authentic and secure, the overseas recipient needs to encrypt the received first data security certification document and the data subject identity identifier, and send the encrypted second data security certification document and the cross-border business identifier to the domestic agent. Subsequently, the domestic agent verifies the target cross-border data based on the first data security certification document, the second data security certification document, the data subject identity identifier and the cross-border business identifier stored in the domestic trusted third party. While preventing the data subject from forging security certification documents to improve the accuracy of verification, the verification process for the target cross-border data is transferred from abroad to within the country, thereby avoiding the risk of data leakage in the process of transmitting privacy data abroad and effectively improving the verification security of cross-border data.

[0056] A cross-border data verification method provided in an embodiment of the present application is introduced below. The cross-border data verification method described below and the cross-border data verification system described above can be referenced to each other.

[0057] See also Figure 4 , which is a flow chart of a cross-border data verification method provided by an embodiment of the present application, and the method is applied to a cross-border data verification system, the cross-border data verification system includes: a data subject, an overseas recipient and a domestic agent; the domestic agent includes: a domestic trusted third party, and the method includes the following steps: S101: Control the data subject to send a first data security certification document for the target cross-border data and the data subject's identity identifier to the overseas recipient; the first data security certification document is generated by the domestic trusted third party through security verification based on the target cross-border data and the data subject's identity data; S102: Control the overseas recipient to perform data encryption processing on the first data security certification document and the data subject identity identifier to obtain a second data security certification document and a cross-border business identifier, and send at least one of the second data security certification document and the cross-border business identifier to the domestic agent and the data subject; S103: Control the domestic agent to verify the target cross-border data based on the first data security certification document, the second data security certification document, the data subject identity identifier and the cross-border business identifier stored in the domestic trusted third party, obtain a target verification result, and send the target verification result to the overseas recipient.

[0058] In a possible implementation, the domestic trusted third party includes: a security verification module; the security verification module is specifically used to: receiving the target cross-border data and the identity data; The target cross-border data and the identity data are verified for security compliance to generate the first data security certification document.

[0059] It should be noted that each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the method and system, since they are basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. The method and system described above are merely schematic, in which the units described as separate components may or may not be physically separated, and the components indicated as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without creative work.

[0060] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A cross-border data verification system, characterized in that: include: Data subjects, overseas recipients and domestic agents; The domestic agent includes: a trusted third party within the country; The data subject is used to send the first data security certification document for the target cross-border data and the data subject identity identifier to the overseas recipient; the first data security certification document is generated by the domestic trusted third party based on the target cross-border data and the identity data of the data subject through security verification; The overseas recipient is configured to perform data encryption processing on the first data security certification document and the data subject identity identifier to obtain a second data security certification document and a cross-border business identifier, and send at least one of the second data security certification document and the cross-border business identifier to the domestic agent and the data subject; The domestic agent is used to verify the target cross-border data based on the first data security certification document, the second data security certification document, the data subject identity and the cross-border business identifier stored in the domestic trusted third party, obtain the target verification result, and send the target verification result to the overseas recipient.

2. The system according to claim 1, characterized in that The domestic agent includes: a domestic data calling module; the domestic data calling module is specifically used to: Receiving the data subject identity identifier sent by the data subject; Perform data encryption on the data subject identity identifier to obtain a domestic business identifier; Based on the domestic business identifier, the first data security certification document is called from the domestic trusted third party.

3. The system according to claim 2, characterized in that The domestic agent includes: a domestic data processing module; the domestic data processing module is specifically used to: The first data security certification document is encrypted using the same data encryption method as that used by the overseas recipient to obtain a third data security certification document.

4. The system according to any one of claims 2 to 3, characterized in that: The domestic agent includes: a domestic data verification module; the domestic data verification module is specifically used to: Performing an integrity comparison between the second data security certification document and the third data security certification document to obtain a security certification document comparison result, and performing an integrity comparison between the cross-border business identifier and the domestic business identifier to obtain a business identifier comparison result; When the comparison result of the security certification document and the comparison result of the business identification are both the same, it is determined that the target verification result is passed.

5. The system according to claim 1, characterized in that The data body includes: a data feedback module; the data feedback module is specifically used to: Receiving the cross-border business identifier fed back by the overseas recipient; Based on the cross-border business identifier, the data subject identity identifier is sent to the domestic agent.

6. The system according to claim 1, characterized in that The data subject includes: a data acquisition module, and the data acquisition module is specifically used to: Send the identity data and the target cross-border data to the domestic trusted third party; Obtain the first data security certification document generated by the domestic trusted third party based on the identity data and the target cross-border data; the first data security certification document is used to prove the security and compliance of the target cross-border data.

7. The system according to claim 1, characterized in that The domestic trusted third party includes: a security verification module; the security verification module is specifically used to: receiving the target cross-border data and the identity data; Extracting target cross-border business requirements and cross-border original data from the target cross-border data; Conduct compliance analysis on the target cross-border business needs and integrity analysis on the cross-border original data to obtain cross-border data compliance certification; Perform security analysis on the identity data and generate an identity security certification document; The cross-border data compliance certificate and the identity security certificate document are determined as the first data security certificate document.

8. The system according to claim 4, characterized in that The domestic data verification module further includes: a mapping establishment unit; the mapping establishment unit is specifically used to: Establishing a data verification mapping relationship between the target verification result and the second data security certification document and the cross-border business identifier; The data verification mapping relationship and the target verification result are sent to the overseas recipient.

9. A cross-border data verification method, characterized in that: Applied to a cross-border data verification system, the cross-border data verification system includes: a data subject, an overseas recipient and a domestic agent; the domestic agent includes: a domestic trusted third party; the method includes: Control the data subject to send the first data security certification document for the target cross-border data and the data subject's identity identifier to the overseas recipient; the first data security certification document is generated by the domestic trusted third party based on the target cross-border data and the data subject's identity data through security verification; Control the overseas recipient to perform data encryption processing on the first data security certification document and the data subject identity identifier to obtain a second data security certification document and a cross-border business identifier, and send at least one of the second data security certification document and the cross-border business identifier to the domestic agent and the data subject; Control the domestic agent to verify the target cross-border data based on the first data security certification document, the second data security certification document, the data subject identity identifier and the cross-border business identifier stored in the domestic trusted third party, obtain a target verification result, and send the target verification result to the overseas recipient.

10. The method according to claim 9, characterized in that The domestic trusted third party includes: a security verification module; the security verification module is specifically used to: receiving the target cross-border data and the identity data; The target cross-border data and the identity data are verified for security compliance to generate the first data security certification document.

Images