Weighing management and control method and device for data file

Abstract

The invention relates to an empowerment management and control method for a data file, which comprises the following steps of: realizing empowerment, verification and traceability of the data file by registering, analyzing, signing, combining and packaging empowerment information, and ensuring the integrity, authenticity, legality and traceability of data; meanwhile, by introducing digital identity, digital signature, markup language description, abstract verification and modular processing technologies, security, flexibility, traceability, usability and full-life-cycle management and control of data file empowerment management are achieved, and the requirements for high-security and high-efficiency management and control of sensitive data files are met; and the method has good practical value and industrial suitability.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method and device for empowering and controlling data files. Background Art

[0002] With the rapid development of information technology, data has become an important asset in modern society. Data circulation, that is, the transfer of data files between different data ownership roles, is a key link in realizing data value. The existing technologies used in data circulation and authorization are mainly reflected in the following points: (1) Data property certificates are issued by authoritative institutions and cannot be universally used for issuance in every link of data circulation. They only unilaterally confirm the identity information of the data recipient by the data sender, and cannot leave information of the recipient's knowledge or consent on the data file, such as adding a watermark. (2) For business scenarios that require business process control, when data files are used offline or their legal sources are traced, they need to be checked through the chain of business application systems. On the one hand, the actual operation is time-consuming and labor-intensive, and requires the participation of informed persons, and the logs of the corresponding business systems need to be retrieved; on the other hand, if the business systems under investigation are incomplete or the logs of individual business systems are missing, it is impossible to form a chain of evidence, and thus it is impossible to effectively trace the source of the document.

[0003] Therefore, this application mainly solves the following defects: (1) Difficulty in confirming data ownership: During the data circulation process, data files and data property certificates are two independent files that must be used together to determine the ownership of data files; (2) Risk of data leakage and abuse: When data is shared or distributed, the recipient of the file may copy or pass it to a third party at will, causing the sender of the data to suffer explicit or implicit losses, and it is difficult to trace the source of the data file leakage; (3) Low data circulation efficiency: Due to the lack of unified data standards and exchange protocols, the cost of data format conversion and standard matching is high, which affects the efficiency of data circulation. Summary of the invention

[0004] In order to address the deficiencies in the prior art, the present invention provides a data file authorization control method, which maps the authorization initiator and the authorization recipient and their operating behaviors to a data structure through data empowerment, and simultaneously utilizes markup language description and digital signature technology to package the data file from its original state into a data file circulation control method that carries the authorization initiator information, the authorization recipient information, and realizes functions such as data file ownership confirmation and helping data file circulation.

[0005] A first aspect of the present invention provides a data file authorization management method, characterized by comprising:

[0006] S1 The initiator of empowerment registers empowerment information;

[0007] S2 parses the authorization information to obtain authorization registration information;

[0008] S3 converts the authorization registration information into a data package 1 to be signed, and sends it to the authorization initiator to obtain the authorization initiator's signature information, and combines the authorization initiator's signature information with the data package 1 to be signed according to the authorization production structure to obtain the authorization production data;

[0009] Specifically, it can include the identity of the authorization initiator and the identity of the authorization recipient, the scope of data permissions (reading, editing permissions), the validity period of data permissions (such as expiration date), etc. Use digital identity technology to generate a unique digital signature (digital identity private key) for the authorization initiator to ensure the legitimacy of the authorization document; use standardized markup languages ​​(such as ASN.1, XML, JSON) to describe the authorization information to obtain the authorization registration information, which is convenient for structured storage and parsing; and use document processing technology to parse, store, and encapsulate the authorization production data.

[0010] S4 parses and obtains the authorization receipt information according to the request of the authorized receipt party;

[0011] S5 reads the authorization production data and combines the authorization receipt information and the original file information according to the authorization receipt structure combination to obtain the data package 2 to be signed;

[0012] S6 The authorized signatory performs a digital signature on the signature data package 2 to generate the authorized signatory signature information, and combines the authorized signatory signature information, the authorized production data and the original file summary according to the authorized signatory structure to generate the authorized signatory data;

[0013] Specifically, a unique digital signature is generated by the signatory to ensure the uniqueness of the signature; the signature information of the authorized signatory, the authorized production data, the original file summary, the time of signature and other signature information are combined according to the authorized signature structure to form authorized signature data to ensure the authenticity of the signature process and avoid unauthorized operations without signature.

[0014] S7 encapsulates the authorized receipt data and the original data file to obtain an authorized data file;

[0015] S8 analyzes the authorized data file to verify the integrity, authenticity and accuracy of the authorized production data, authorized receipt data and original data file;

[0016] Specifically, markup language description technology is used to parse the structure of the authorized data file, extract the authorized production data, authorized receipt data and original file information. Digital identity authentication technology is used to verify the digital signatures of the producer and the recipient to ensure the legality of the data source. Data integrity verification technology is used to ensure that the original data file has not been tampered with through digest matching and other methods. In this way, the integrity and authenticity of the authorized file during transmission and storage are ensured, and the security of the authorization data and the correctness of the authorization chain information are verified.

[0017] S9 analyzes the authorized data file layer by layer, extracts the authorized production data and the authorized receipt data, and traces the chain information of the authorized initiator and the authorized receipt.

[0018] Specifically, the markup language description technology is used to parse the authorized data files, and the authorized signatory and the authorized initiator are tracked layer by layer. The digital identity association technology is used to connect the subject information of each stage of data authorization through digital signatures to quickly locate all relevant subjects in the authorization chain, ensure the traceability of each link, and support multiple authorization tracing in complex scenarios.

[0019] Exemplarily, the authorization production structure specifically includes: the authorization initiator identity, the authorization recipient identity, the original file information, the extended data, and the authorization initiator signature information;

[0020] The authorization receipt structure specifically includes: authorization production data, original file summary, extended data, and authorization receipt party signature information;

[0021] The specific structure of the data file after empowerment is: original data file and empowered receipt data.

[0022] Exemplarily, the data packet to be signed 1 and the data packet to be signed 2 are described based on a markup language, and the markup language includes ASN.1, XML or JSON.

[0023] Exemplarily, before the S5 reads the authorization production data and combines the authorization receipt information and the original file information according to the authorization receipt structure combination to obtain the data packet 2 to be signed, it also includes determining whether it is necessary to produce an authorization identification image, and generating an authorization identification image if necessary.

[0024] Specifically, the authorization identification image is mainly a visual mark in the data file authorization control, which is used to intuitively reflect the status and content of the authorization operation. Its functions can be divided into the following aspects:

[0025] Visual permission marking: Deliver authorization information in the form of images, such as the scope of authorization, validity period, and the identities of the authorizer and the recipient. Embed an identification image (such as a watermark) in the authorized file to remind the user that the file is subject to the authorization rules.

[0026] Enhance security and non-repudiation. Through the generated authorization identification image, the authorized file can reflect the complete permission chain and security verification information, reduce the risk of forgery or misuse, and prevent the file from being tampered with. The authorization identification image can be used as part of the authorization signature information, combined with the digital signature and file content to verify the integrity of the file. The image contains the identity information of the authorizer or the recipient, which becomes a visual proof of the legitimacy of the file.

[0027] Used for file tracing: The authorization identification image can be used as an important visual content in the file tracing process, providing background information related to authorization, such as important node information in the authorization chain, such as authorization time and identity of the signatory, and supporting the tracing module to quickly locate the authorization source and receipt record by parsing the image content. Supporting the tracing module to quickly locate the authorization source and receipt record by parsing the image content;

[0028] Permission prompts for file content. The authorization identification image can contain instructions for specific permissions to remind the signatory or recipient to follow specific rules when operating the file. For example, when browsing or printing a file, specific permission information (such as "read only" or "no copying") is displayed as a dynamic prompt for permission management to help users avoid behaviors that do not comply with permission rules.

[0029] Specific implementation forms may include: (1) Embedded watermark: The authorized identification image can be used as a digital watermark and embedded in a prominent position of the file, which does not affect the use of the file but is always visible; (2) Additional signature information: The image is encapsulated together with the file as part of the signature; (3) Independent visual mark: The image file is stored separately but is associated with the authorized data file.

[0030] The authorization identification image is not only a visual element, but also a technical means to enhance file security, clarify permission descriptions and facilitate traceability management. Through the identification image, the authorization information can be more transparently embedded in the file life cycle, providing visual support for subsequent verification and control.

[0031] Exemplarily, the signature information of the authorization initiator and the signature information of the authorization recipient are encrypted using asymmetric encryption;

[0032] The chain information may include multiple levels of authorized initiators and authorized signatories.

[0033] Exemplarily, the step S8 parses the authorized data file to verify the integrity, authenticity and accuracy of the authorized production data, authorized receipt data and original data file, including:

[0034] Parsing using the markup language;

[0035] Verify the accuracy of the authorization receipt data and authorization production data format;

[0036] Verify the authenticity of the signature information of the authorized initiator and the authorized signatory;

[0037] Verify the integrity of the original data file, extract the original file summary from the authorization production data and the authorization receipt data, calculate the original data file according to the same algorithm to obtain a new original data file summary, and compare the original file summary and the new original data file summary.

[0038] The present invention also provides a device for data file authorization control, which is characterized by comprising:

[0039] Data identity registration module, used to register empowerment information;

[0040] A data file processing module, used for parsing the authorization information to obtain authorization registration information;

[0041] A data authorization production module is used to convert the authorization registration information into a data packet 1 to be signed, and send it to the authorization initiator to obtain the authorization initiator's signature information, and combine the authorization initiator's signature information with the data packet 1 to be signed according to the authorization production structure to obtain the authorization production data;

[0042] The data file processing module is also used to parse and obtain the authorization receipt information according to the request of the authorized receipt party;

[0043] A data authorization and receipt module is used to read the authorization production data and combine the authorization and receipt information with the original file information to obtain a data packet 2 to be signed according to the authorization and receipt structure combination;

[0044] The data authorization signing module is also used to generate authorization signing data by combining the authorization signing party signature information, the authorization production data and the original file summary according to the authorization signing structure after the authorization signing party digitally signs the signature data package 2 and generates the authorization signing party signature information;

[0045] The data file processing module is further used to encapsulate the authorization receipt data and the original data file to obtain an authorized data file;

[0046] A data authorization verification module is used to parse the authorized data file and verify the integrity, authenticity and accuracy of the authorized production data, authorized receipt data and original data file;

[0047] Specifically, parse the authorized data file: use a markup language description method (such as ASN.1, XML, JSON) to parse the authorized data file; extract the data authorization receipt data part, as well as the authorized signatory signature information, authorization production data and original file summary contained therein; check whether the data field is complete according to the predetermined authorization receipt structure, and verify whether the signatory has signed the signature data packet 2 (authorization receipt data content, original file information, etc.) to ensure the authenticity and non-repudiation of the signature.

[0048] Parse the data authorization production data: including the authorization initiator's signature information, authorization registration information (authorization scope, validity period, identity of the recipient, etc.), and original file information; check whether the data fields in the authorization production structure are complete; use the authorization initiator's public key to verify the signature information; ensure that the authorization initiator has signed the signature data package 1 to verify its authenticity and integrity;

[0049] Extract the original file summary information: extract the stored original file summary from the authorization production data and authorization receipt data; calculate the summary of the current original data file: use the same hash algorithm (such as SHA-256) to recalculate the summary value of the current original data file;

[0050] Match digest value: Compare the extracted digest value with the calculated digest value to verify the integrity of the original data file. If they are consistent, the original file has not been tampered with.

[0051] If all the above verifications are successful, the authorized data file is confirmed to be complete and authentic; if any verification fails, the corresponding error message (such as invalid signature, file tampering, etc.) is returned.

[0052] The data empowerment traceability module is used to parse the empowered data file layer by layer, extract the empowerment production data and the empowerment receipt data, and trace the chain information of the empowerment initiator and the empowerment receipt.

[0053] Specifically, the main purpose of the traceability process is to track the flow of files in the authorization chain by parsing the authorized data file, and to identify all the authorization initiators and signatories involved. (1) Input the authorized data file to be traced, parse the authorized data file using the markup language description method, and extract the data authorization signatory data in the authorized data file; (2) Parse the authorization signatory data and extract the authorization signatory information; (3) Obtain the corresponding authorization production data part from the data authorization signatory data, parse the authorization production data, extract the authorization initiator information and the authorization time, scope, validity period and other information; (4) Parse the multi-level authorization chain; If the authorized data file contains multiple authorization signatory data (such as the file is sub-authorized multiple times), repeat the above steps to extract the authorization initiator and signatory information of each stage in sequence, and establish a complete authorization chain level by level.

[0054] Identify all the authorization initiators and signatories involved; record the time, scope of authority, file summary information, etc. of each authorization.

[0055] Responsibility tracing: Through the traceability results, the responsible party and historical operation path of the current status of the file can be located, providing a basis for accountability.

[0056] The present invention also provides a computer-readable storage medium, characterized in that a computer program is stored on the storage medium, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

[0057] The present invention also provides an electronic device, characterized in that it includes a processor and a memory;

[0058] The memory is used to store computer programs;

[0059] The processor is configured to execute the method according to any one of claims 1 to 6 by calling a stored computer program.

[0060] The present invention also relates to a computer program product, comprising a computer program and / or instructions, characterized in that the computer program and / or instructions implement the steps of the above method when executed by a processor.

[0061] The beneficial effects of the present invention are as follows: This technical solution realizes the security, flexibility, traceability, ease of use and full life cycle control of data file authorization management by introducing digital identity, digital signature, markup language description, summary verification and modular processing technology. This solution is applicable to a variety of scenarios (such as file sharing, electronic contract management, data rights management, etc.), meets the needs of high security and high efficiency control of sensitive data files, and provides traceability and auditing capabilities, with good practical value and industry adaptability. It is specifically manifested in the following points:

[0062] (1) The authorization control process supports multiple authorizations and reauthorizations, and the authorization chain is clear, which facilitates tracking of file flows and operator information at different stages; (2) When authorizing, the scope of file operation permissions (such as reading, modifying, forwarding, etc.) and validity period can be specified. After authorization, the use of files is strictly restricted to avoid unauthorized operations or abuse; (3) The digital signatures, timestamps and other information of all authorization and receipt operations can be verified to ensure the reliability of traceability results and provide a strong basis for subsequent audits and supervision; (4) The complete life cycle management of file authorization, receipt, packaging, verification and traceability is realized to ensure the security and controllability of data throughout the life cycle; (5) Various authorization, receipt, verification and traceability operations are automatically completed through modular devices, reducing manual intervention and improving operational efficiency; (6) All operation records of authorized files (such as authorization information, signature information, etc.) can be stored for a long time, providing a basis for future audits, supervision or dispute resolution. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 The present invention is a flowchart of a method for data file authorization control.

[0064] Figure 2 The present invention is a schematic diagram of the structure of a device for data file authorization control.

[0065] Figure 3 It is a data structure schematic diagram of the present invention. DETAILED DESCRIPTION

[0066] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. The components of the embodiments of the present invention generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the claimed invention, but merely represents selected embodiments of the present invention. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0067] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings. At the same time, in the description of the present invention, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0068] In a first aspect, the present invention provides a method for data file authorization control, such as Figure 1 As shown, including:

[0069] S1 The initiator of empowerment registers empowerment information;

[0070] S2 parses the authorization information to obtain authorization registration information;

[0071] S3 converts the authorization registration information into a data package 1 to be signed, and sends it to the authorization initiator to obtain the authorization initiator's signature information, and combines the authorization initiator's signature information with the data package 1 to be signed according to the authorization production structure to obtain the authorization production data;

[0072] S4 parses and obtains the authorization receipt information according to the request of the authorized receipt party;

[0073] S5 reads the authorization production data and combines the authorization receipt information and the original file information according to the authorization receipt structure combination to obtain the data package 2 to be signed;

[0074] S6 The authorized signatory performs a digital signature on the signature data package 2 to generate the authorized signatory signature information, and combines the authorized signatory signature information, the authorized production data and the original file summary according to the authorized signatory structure to generate the authorized signatory data;

[0075] S7 encapsulates the authorized receipt data and the original data file to obtain an authorized data file;

[0076] S8 analyzes the authorized data file to verify the integrity, authenticity and accuracy of the authorized production data, authorized receipt data and original data file;

[0077] S9 analyzes the authorized data file layer by layer, extracts the authorized production data and the authorized receipt data, and traces the chain information of the authorization initiator and the authorization receipt.

[0078] The present invention first abstracts and summarizes the empowerment initiator, the empowerment recipient, the data file and the empowerment data structure, and uses the markup language description to summarize the empowerment production structure, the empowerment receipt structure, and the empowered data file structure. In order to ensure data security and behavior traceability during the empowerment process, the identity information of the empowerment initiator and the recipient is associated and bound with the operation behavior using a digital signature. Then, using document processing and markup language description, the empowerment data and the original data file are encapsulated and merged to facilitate data storage and shared exchange. Finally, the empowerment production data, the empowerment receipt data, and the empowered data file are combined with the data empowerment business scenario and operation process, and a virtual device is made using a reality restoration method, including: a data registration module, an empowerment production module, a data file processing module, and a data empowerment receipt module. The roles mainly include a data empowerment receipt recipient and a data empowerment receipt recipient.

[0079] Embodiment 1

[0080] When a standards publishing house sells electronic books of standards and specifications, it usually reaches an agreement with the purchaser that "the electronic books of standards and specifications purchased by the purchaser are for their own use only and cannot be sent to third-party individuals or organizations for use through copying, reproduction, etc." However, in reality, when the purchaser violates this agreement, the standards publishing house is often unable to hold the person responsible because it is difficult to trace the leaker based on the electronic books, thus causing its own economic losses.

[0081] For example, using the patent application technology, a certain standard publisher owns the copyright of "** Product Technical Specifications" and sells it to multiple factories at the same time. At this time, the certain standard publisher is the initiator of data empowerment, and multiple factories are the signatories of data empowerment. "** Product Technical Specifications" is the original data file. To solve the problem that the "** Product Technical Specifications" file is limited to the scope of empowerment objects in multiple factories. The data empowerment process is as follows:

[0082] a) A publishing house registers all the purchaser information and the purchased electronic book information. At this time, the publishing house is the data authorization initiator, the purchaser is the data authorization signatory, and the electronic book is the original data file;

[0083] b) Generate authorization production data, in accordance with the data authorization production requirements, and use the digital identity of a publisher to digitally sign the digital identities and data files of all buyers to obtain authorization production data;

[0084] c) Generate authorization receipt data. According to the data authorization receipt requirements, each buyer uses his own digital identity to match the buyer's digital identity list in the authorization production data. If the match is successful, that is, the buyer is in the buyer's identity list, the buyer uses his own digital identity to digitally sign the authorization production data and the original data file to obtain his own corresponding authorization receipt data. Among them, different buyers generate different data authorization receipt data;

[0085] d) Generate weighted data files according to the weighted data file structure, such as Figure 3 As shown, the data authorization receipt data corresponding to each purchaser is packaged and merged with the original data file into a new data file, namely, the authorized data file. Among them, the authorized data files generated by different purchasers are different from each other;

[0086] At this point, a publishing house and an e-book purchasing platform have completed the transaction process, namely data empowerment.

[0087] Later, if an e-book is spread to the Internet, or if an organization or individual does not purchase the e-book, the complete data authorization information chain can be traced back based on the leaked e-book file and the data file tracing method of the patent application technology, thereby finding the leaker of the e-book.

[0088] Embodiment 2

[0089] A device for data file authorization control, such as Figure 2 As shown, including:

[0090] Data identity registration module, used to register empowerment information;

[0091] A data file processing module, used for parsing the authorization information to obtain authorization registration information;

[0092] A data authorization production module is used to convert the authorization registration information into a data packet 1 to be signed, and send it to the authorization initiator to obtain the authorization initiator's signature information, and combine the authorization initiator's signature information with the data packet 1 to be signed according to the authorization production structure to obtain the authorization production data;

[0093] The data file processing module is also used to parse and obtain the authorization receipt information according to the request of the authorized receipt party;

[0094] A data authorization and receipt module is used to read the authorization production data and combine the authorization and receipt information with the original file information to obtain a data packet 2 to be signed according to the authorization and receipt structure combination;

[0095] The data authorization signing module is also used to generate authorization signing data by combining the authorization signing party signature information, the authorization production data and the original file summary according to the authorization signing structure after the authorization signing party digitally signs the signature data package 2 and generates the authorization signing party signature information;

[0096] The data file processing module is further used to encapsulate the authorization receipt data and the original data file to obtain an authorized data file;

[0097] A data authorization verification module is used to parse the authorized data file and verify the integrity, authenticity and accuracy of the authorized production data, authorized receipt data and original data file;

[0098] The data empowerment traceability module is used to parse the empowered data file layer by layer, extract the empowerment production data and the empowerment receipt data, and trace the chain information of the empowerment initiator and the empowerment receipt.

[0099] For example, Zhang San wants to grant the data management rights of a "** Statistical Data Analysis Report" to Li Si, then Zhang San is the initiator of data empowerment, Li Si is the signatory of data empowerment, and the "** Statistical Data Analysis Report" is the controlled data file. The data empowerment process is:

[0100] a) Zhang San submits data authorization information to the data file authorization control device, including the original data file, original file information, extended data (data permissions, data permission validity period), and Li Si's identity information. The data authorization file generation device generates data authorization production data, which includes information such as the authorization operation initiator, the signing subject, and the authorization data file. It can effectively express Zhang San's true intention to authorize Li Si to perform data files, and the data authorization production data generated this time is associated with the authorization signing object Li Si to avoid being mistakenly operated or signed with ulterior motives by people other than Li Si.

[0101] b) When Li Si signs and confirms the authorization of the data file, the device for data file authorization management and control generates authorization acceptance data, which includes authorization production data, original file summary, Li Si's signature information and extended data (other acceptance information such as acceptance time), which can effectively indicate Li Si's recognition and acceptance of the data file authorization made by Zhang San.

[0102] c) Finally, the data empowerment receipt data and the original "**Statistical Data Analysis Report" are encapsulated and merged to generate a new "**Statistical Data Analysis Report", that is, the empowered data file, so that the data empowerment initiator Zhang San, the data empowerment signatory Li Si, the original data file and the data empowerment process operation behavior are bound to the digital identity, which is convenient for data storage and sharing and exchange, and supports the traceability of the empowerment process.

[0103] By using this device, the above-mentioned processing method can be executed and the corresponding technical effects can be achieved.

[0104] An embodiment of the present invention also provides a computer-readable storage medium capable of implementing all the steps in the method in the above embodiment, wherein a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, all the steps in the method in the above embodiment are implemented.

[0105] An embodiment of the present invention also provides an electronic device for executing the above method. As an implementation device of the method, the electronic device has at least a processor and a memory, and in particular, the memory stores data and related computer programs required for executing the method, and the processor calls the data and programs in the memory to execute all steps of the implementation method and obtains the corresponding technical effect.

[0106] Preferably, the electronic device may include a bus architecture, the bus may include any number of interconnected buses and bridges, and the bus will include various circuits linked together by one or more processors and memories. The bus may also link together various other circuits such as peripherals, voltage regulators, and power management circuits, which are all well known in the art and are therefore not further described herein. The bus interface provides an interface between the bus and the receiver and transmitter. The receiver and transmitter may be the same component, i.e., a transceiver, providing a unit for communicating with various other systems over a transmission medium. The processor is responsible for managing the bus and general processing, while the memory may be used to store data used by the processor when performing operations.

[0107] In addition, the electronic device may further include components such as a communication module, an input unit, an audio processor, a display, and a power supply. The processor (or controller, operation control) used may include a microprocessor or other processor device and / or a logic device, which receives input and controls the operation of various components of the electronic device; the memory may be one or more of a cache, a flash memory, a hard drive, a removable medium, a volatile memory, a non-volatile memory, or other suitable devices, which may store the above-mentioned related data information, and may also store a program for executing related information, and the processor may execute the program stored in the memory to realize information storage or processing, etc.; the input unit is used to provide input to the processor, for example, it may be a key or a touch input device; the power supply is used to provide power to the electronic device; the display is used to display display objects such as images and text, for example, it may be an LCD display. The communication module is a transmitter / receiver that sends and receives signals via an antenna. The communication module (transmitter / receiver) is coupled to the processor to provide input signals and receive output signals, which may be the same as the case of a conventional mobile communication terminal. Based on different communication technologies, multiple communication modules may be provided in the same electronic device, such as a cellular network module, a Bluetooth module and / or a wireless local area network module, etc. The communication module (transmitter / receiver) is also coupled to a speaker and a microphone via an audio processor to provide an audio output via the speaker and receive an audio input from the microphone, thereby realizing a common telecommunication function. The audio processor may include any suitable buffer, decoder, amplifier, etc. In addition, the audio processor is also coupled to a central processor, so that recording can be performed on the machine through the microphone, and the sound stored on the machine can be played through the speaker.

[0108] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0109] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A system that specifies the functions of a box or multiple boxes.

[0110] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction system, which is implemented in the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0111] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps of the functions specified in a box or multiple boxes. Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they know the basic creative concept. Therefore, the attached claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0112] The above is only a preferred specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A data file authorization management method, characterized in that: include: S1 The initiator of empowerment registers empowerment information; S2 parses the authorization information to obtain authorization registration information; S3 converts the authorization registration information into a data package 1 to be signed, and sends it to the authorization initiator to obtain the authorization initiator's signature information, and combines the authorization initiator's signature information with the data package 1 to be signed according to the authorization production structure to obtain the authorization production data; S4 parses and obtains the authorization receipt information according to the request of the authorized receipt party; S5 reads the authorization production data and combines the authorization receipt information and the original file information according to the authorization receipt structure combination to obtain the data package 2 to be signed; S6 The authorized signatory performs a digital signature on the signature data package 2 to generate the authorized signatory signature information, and combines the authorized signatory signature information, the authorized production data and the original file summary according to the authorized signatory structure to generate the authorized signatory data; S7 encapsulates the authorized receipt data and the original data file to obtain an authorized data file; S8 analyzes the authorized data file to verify the integrity, authenticity and accuracy of the authorized production data, authorized receipt data and original data file; S9 analyzes the authorized data file layer by layer, extracts the authorized production data and the authorized receipt data, and traces the chain information of the authorization initiator and the authorization receipt.

2. The method according to claim 1, characterized in that The authorization production structure specifically includes: authorization initiator identity, authorization recipient identity, original file information, extended data, authorization initiator signature information; The authorization receipt structure specifically includes: authorization production data, original file summary, extended data, and authorization receipt party signature information; The specific structure of the data file after empowerment is: original data file and empowered receipt data.

3. The method according to claim 2, characterized in that The data packet to be signed 1 and the data packet to be signed 2 are described based on a markup language, and the markup language includes ASN.1, XML or JSON.

4. The method according to claim 3, characterized in that: The step S5 reads the authorization production data and combines the authorization receipt information and the original file information to obtain the data package 2 to be signed according to the authorization receipt structure combination, and also includes determining whether it is necessary to produce an authorization identification image, and generating an authorization identification image if necessary.

5. The method according to claim 1, characterized in that: The signature information of the authorization initiator and the signature information of the authorization recipient are encrypted using asymmetric encryption; The chain information may include multiple levels of authorized initiators and authorized signatories.

6. The method according to claim 1, characterized in that The S8 analyzes the authorized data file to verify the integrity, authenticity and accuracy of the authorized production data, authorized receipt data and original data file, including: Parsing using the markup language; Verify the accuracy of the authorization receipt data and authorization production data format; Verify the authenticity of the signature information of the authorized initiator and the authorized signatory; Verify the integrity of the original data file, extract the original file summary from the authorization production data and the authorization receipt data, calculate the original data file according to the same algorithm to obtain a new original data file summary, and compare the original file summary and the new original data file summary.

7. A device for data file authorization control, characterized in that: include: Data identity registration module, used to register empowerment information; A data file processing module, used for parsing the authorization information to obtain authorization registration information; A data authorization production module is used to convert the authorization registration information into a data packet 1 to be signed, and send it to the authorization initiator to obtain the authorization initiator's signature information, and combine the authorization initiator's signature information with the data packet 1 to be signed according to the authorization production structure to obtain the authorization production data; The data file processing module is also used to parse and obtain the authorization receipt information according to the request of the authorized receipt party; A data authorization and receipt module is used to read the authorization production data and combine the authorization and receipt information with the original file information to obtain a data packet 2 to be signed according to the authorization and receipt structure combination; The data authorization signing module is also used to generate authorization signing data by combining the authorization signing party signature information, the authorization production data and the original file summary according to the authorization signing structure after the authorization signing party digitally signs the signature data package 2 and generates the authorization signing party signature information; The data file processing module is further used to encapsulate the authorization receipt data and the original data file to obtain an authorized data file; A data authorization verification module is used to parse the authorized data file and verify the integrity, authenticity and accuracy of the authorized production data, authorized receipt data and original data file; The data empowerment traceability module is used to parse the empowered data file layer by layer, extract the empowerment production data and the empowerment receipt data, and trace the chain information of the empowerment initiator and the empowerment receipt.

8. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

9. An electronic device, characterized in that: including a processor and a memory; The memory is used to store computer programs; The processor is configured to execute the method according to any one of claims 1 to 6 by calling a stored computer program.

10. A computer program product comprising a computer program and / or instructions, characterized in that: When the computer program and / or the instructions are executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images