Sensitive data cross-network authorization application method based on trusted digital identity

Abstract

The invention relates to a sensitive data cross-network authorization application method based on trusted digital identity, which comprises the following steps that: a user initiates an authorization request through terminal equipment, and a trusted digital identity platform generates a trusted digital identity label and a unique authorization serial number after trusted digital identity authentication verification is carried out through a CTID platform; the trusted digital identity platform calls a special encryption machine program to encrypt the sensitive data, generates an authorization data ciphertext, packages the authorization data ciphertext together with an authorization validity period, a trusted digital identity identifier and a signature value into an authorization data packet, and transmits the authorization data packet to a target system for storage through a file switch and a security isolation gatekeeper; when a user needs to use data, a trusted digital identity two-dimensional code containing a trusted digital identity identifier and an authorization serial number is generated, a target system scans the code, verifies the signature, decrypts, obtains decrypted data, inquires a user authorization data packet, verifies the signature and verifies the validity period, and decrypts the sensitive data ciphertext if the verification is passed. According to the invention, the data security, the use efficiency and the user experience are improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and mainly to a cross-network authorization application method for sensitive data based on trusted digital identities. Background Art

[0002] In the field of modern communications and data processing, it is crucial to ensure the authenticity, integrity and immutability of information. Especially when processing sensitive data, such as personal identity information, financial transaction data, etc., traditional data processing methods often lack sufficient security guarantees. With the introduction of blockchain technology and trusted verification mechanisms, the credibility and security of data can be effectively improved by embedding trusted watermarks and dynamic features in the communication process. However, existing technologies still have some deficiencies in security and privacy protection when transmitting sensitive data across networks, especially in the process of data authorization and use, which can easily lead to data abuse or leakage.

[0003] In order to solve these problems, for example, a Chinese patent with publication number CN116828459A discloses a trusted intelligent communication terminal and a complete system and application. By introducing communication base stations, information communication blockchains and trusted verification agencies, the embedding and verification of trusted watermarks and dynamic features in the communication process are realized. However, the Chinese patent has obvious deficiencies in handling cross-network authorization and use of sensitive data: first, the data authorization mechanism of the Chinese patent is relatively simple, lacking detailed management of the user authorization process, which easily leads to data being accessed without authorization; second, the technical means of data encryption and decryption in the Chinese patent are relatively single and cannot cope with complex security threats. Therefore, there is an urgent need for a method that can ensure the secure cross-network transmission and use of sensitive data under the premise of authorization. Summary of the invention

[0004] In order to solve the above problems existing in the prior art, the present application provides a cross-network authorization application method for sensitive data based on trusted digital identity.

[0005] The technical solution of this application is as follows:

[0006] A cross-network authorization application method for sensitive data based on a trusted digital identity, the method comprising:

[0007] The user initiates an authorization request corresponding to sensitive data through the terminal device, and the terminal device verifies the user's identity through the trusted digital identity authentication platform. If the verification is successful, the trusted digital identity platform generates the user's trusted digital identity and generates a unique authorization serial number;

[0008] The trusted digital identity platform calls a dedicated encryption machine program based on the authorization serial number to encrypt the sensitive data authorized by the user to obtain the authorized data ciphertext; the authorized data ciphertext, the authorization validity period, the trusted digital identity identifier and the signature value are packaged to obtain an authorized data packet, and the authorized data packet is transmitted to the target system through the file switch and the security isolation network gate for storage;

[0009] When a user needs to use authorized sensitive data, a trusted digital identity QR code is generated based on the trusted digital identity and the authorization serial number, and the user presents the trusted digital identity QR code to the target system through a code scanning device; the target system verifies the signature of the trusted digital identity QR code and decrypts it to obtain decrypted data, which includes the trusted digital identity and authorization serial number corresponding to the user;

[0010] The target system obtains the user's authorization data packet based on the decrypted data query, and calls the dedicated encryption machine interface to verify the signature and validity period of the authorization data packet. If the signature verification and validity period verification are passed, the dedicated encryption machine is used to decrypt the authorization data ciphertext to obtain sensitive data.

[0011] As a preferred embodiment of the present invention, the method further includes generating a trusted digital identity, specifically:

[0012] When a user applies for a trusted digital identity for the first time, he / she enters his / her identity information on the terminal device and performs face recognition to obtain portrait data, wherein the identity information includes the user's name and ID number;

[0013] The terminal device sends the input identity information and portrait data to the trusted digital identity platform. The trusted digital identity platform calls the CTID platform to verify the user's identity. When the user's identity authentication is passed, the CTID platform generates a trusted credential factor file corresponding to the user. The trusted credential factor file contains the user's identity, encrypted digital signature and digital certificate; the trusted digital identity platform generates the user's trusted digital identity based on the trusted credential factor file; the CTID platform returns the trusted credential factor file to the terminal device for local encrypted storage.

[0014] As a preferred embodiment of the present invention, the terminal device verifies the user's identity through the trusted digital identity authentication of the CTID platform as follows:

[0015] When the user performs trusted digital identity authentication, the terminal device collects the user's portrait data again and calls the SDK interface to encrypt the trusted credential factor file to obtain the trusted credential factor ciphertext;

[0016] The terminal device uploads the portrait data and trusted credential factor ciphertext collected again to the trusted digital identity platform. The trusted digital identity platform calls the interface of the CTID platform and uploads the read trusted credential factor ciphertext and portrait data to the CTID platform for verification. The CTID platform verifies based on the uploaded trusted credential factor ciphertext and portrait data, and checks whether the portrait data and the trusted credential factor file obtained after decrypting the trusted credential factor ciphertext are consistent with those provided during the first application.

[0017] After verification is completed, the CTID platform returns the authentication result to the terminal device, including:

[0018] If the verification is successful, the trusted digital identity platform searches for the user's trusted digital identity based on the authentication result of the CTID platform and generates a unique authorization serial number. The authorization serial number is bound to the trusted digital identity and saved as the authentication result.

[0019] If the verification fails, the CTID platform generates the failure reason as the authentication result.

[0020] As a preferred implementation of the present invention, the trusted digital identity platform calls a dedicated encryption machine program based on the authorization serial number to encrypt the sensitive data authorized by the user, and obtains the authorization data ciphertext as follows:

[0021] The trusted digital identity platform organizes the sensitive data authorized by the user in JSON format and performs base64 encoding to obtain the encoded data; the encoded data and the authorization serial number are used as input factors of the encryption algorithm, and the trusted digital identity platform calls a dedicated encryption machine program to perform SM4 encryption on the input factors to obtain the encrypted authorization data ciphertext.

[0022] As a preferred implementation of the present invention, the authorization data ciphertext, the authorization validity period and the signature value are packaged to obtain the authorization data packet as follows:

[0023] The trusted digital identity platform determines the authorization validity period based on business needs, and calls a dedicated encryption machine program to use the national secret SM2 signature algorithm to sign the authorization data ciphertext, authorization validity period, trusted digital identity and authorization serial number to generate a signature value; the authorization data ciphertext, authorization validity period, trusted digital identity and signature value are encapsulated in json format to obtain the final authorization data packet.

[0024] As a preferred embodiment of the present invention, generating a trusted digital identity QR code based on a trusted digital identity identifier and an authorization serial number is specifically as follows:

[0025] The trusted digital identity QR code consists of three segments of data: A, B, and S, where:

[0026] Data in Section A is data generated by the CTID platform, specifically the index number of the trusted credential factor file, which is used to obtain the user's unique identification, timestamp, and validity period information;

[0027] The data in segment B is a ciphertext composed of user data and business data, wherein the user data is a trusted digital identity and the business data is an authorization serial number;

[0028] The S segment data is the overall signature value obtained by combining the A segment data and the B segment data.

[0029] As a preferred embodiment of the present invention, the target system verifies and decrypts the trusted digital identity QR code as follows:

[0030] The target system reads the trusted digital identity QR code presented by the user and decodes it using a dedicated encryption machine for the trusted digital identity QR code. The decoding specifically parses the A, B and S segments of data according to the partition length defined by the code system; verifies the overall signature value of the S segment, and decrypts the B segment data after successful verification to obtain the trusted digital identity and authorization serial number.

[0031] As a preferred implementation of the present invention, the validity period check specifically determines whether the authorization is valid based on the authorization validity period. If the authorization validity period is greater than the current time, it is valid. If the authorization validity period is less than the current time, the authorization will be judged as invalid.

[0032] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method for cross-network authorization application of sensitive data based on a trusted digital identity as described in any embodiment of the present invention is implemented.

[0033] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the cross-network authorization application method for sensitive data based on a trusted digital identity as described in any embodiment of the present invention.

[0034] Compared with the prior art, the present invention has the following beneficial effects:

[0035] 1) The present invention provides a cross-network authorization application method for sensitive data based on a trusted digital identity, which ensures personal authorization through real-person authentication, and sensitive data cannot be used fraudulently; the authorization data is encrypted and signed using a dedicated encryption machine to ensure data confidentiality security and integrity, and the signature verification and decryption of the dedicated program and the dedicated encryption machine require the participation of the authorization serial number to ensure that the user's authorization is obtained, otherwise it cannot be used;

[0036] 2) The present invention provides a cross-network authorization application method for sensitive data based on trusted digital identity. Through trusted digital identity authentication, dedicated encryption machine program and secure isolation network gatekeeper, the security of sensitive data during transmission and storage is ensured to prevent data leakage and tampering. At the same time, the cross-network authorization process is simplified. Users only need to initiate an authorization request through the terminal device, and the system automatically completes identity authentication and data encryption;

[0037] 3) The present invention provides a cross-network authorization application method for sensitive data based on trusted digital identity. The identity authentication method based on face recognition improves the user's operating experience and reduces the cumbersome identity authentication steps. Through authorization validity period management, the timeliness of authorization data is ensured, the abuse of expired data is prevented, and the effectiveness of authorization management is enhanced. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 It is a method flow chart of an embodiment of the present invention. DETAILED DESCRIPTION

[0039] The specific implementation modes of the present invention are described below so that those skilled in the art can understand the present invention. However, it should be clear that the present invention is not limited to the scope of the specific implementation modes. For those of ordinary skill in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the attached claims, these changes are obvious, and all inventions and creations utilizing the concept of the present invention are protected.

[0040] The present invention provides the following technical solution: a cross-network authorization application method for sensitive data based on trusted digital identity.

[0041] Embodiment 1:

[0042] This embodiment provides a method for cross-network authorization application of sensitive data based on a trusted digital identity, the method comprising:

[0043] S1. User authorization process:

[0044] When a user needs to use sensitive data (for example, applying for financial services, handling government affairs, etc.), he / she initiates a data authorization request. Specifically:

[0045] S11. The user selects sensitive data that needs to be authorized through a terminal device (such as a mobile phone), wherein the sensitive data includes personal privacy data such as name, ID number, portrait, mobile phone number, gender, ethnicity, address, and business data; the terminal device generates an authorization request and prepares for trusted digital identity authentication;

[0046] S12. Trusted digital identity authentication:

[0047] The trusted digital identity authentication is to confirm the real identity of the user and generate an authorization serial number. Specifically:

[0048] S121. When a user applies for a trusted digital identity for the first time, the user enters identity information in the terminal device and performs face recognition to obtain portrait data, wherein the identity information includes the user's name and ID number; the terminal device sends the entered identity information and portrait data to the trusted digital identity platform, and the trusted digital identity platform calls the CTID platform to verify the user's identity. When the user's identity authentication passes, the CTID platform generates a trusted credential factor file corresponding to the user, and the trusted credential factor file contains the user's identity identification, encrypted digital signature and digital certificate, which are used to prove that the user's identity is authentic and valid; the trusted digital identity platform generates the user's trusted digital identity based on the trusted credential factor file; the CTID platform returns the trusted credential factor file to the terminal device for local encrypted storage;

[0049] S122. When a trusted digital identity authentication is required later, the user should verify or authenticate his / her identity again if he / she already has a trusted credential factor file. Specifically:

[0050] In order to verify the user's current identity, the terminal device collects the user's portrait data again. The collected portrait data will be used to compare with the template collected during the first application or saved in the system to verify whether the user's biometric features are consistent;

[0051] The terminal device calls the SDK interface to encrypt the trusted credential factor file to obtain the trusted credential factor ciphertext;

[0052] The terminal device uploads the portrait data and trusted credential factor ciphertext collected again to the trusted digital identity platform. The trusted digital identity platform calls the interface of the CTID platform and uploads the read trusted credential factor ciphertext and portrait data to the CTID platform for verification. The CTID platform verifies based on the uploaded trusted credential factor ciphertext and portrait data, and checks whether the portrait data and the trusted credential factor file obtained after decrypting the trusted credential factor ciphertext are consistent with those provided during the first application.

[0053] Furthermore, the checking includes verifying the validity of the digital signature to ensure that the data has not been tampered with;

[0054] After verification is completed, the CTID platform returns the authentication result to the terminal device, including:

[0055] If the verification is successful, the authentication result includes a trusted digital identity and an authorization serial number. Specifically, the trusted digital identity platform searches for the user's trusted digital identity based on the authentication result of the CTID platform and generates a unique authorization serial number. The authorization serial number is used as the unique identifier of this authorization operation. The user will be deemed to have a valid identity and has passed the authentication. Preferably, the authorization serial number is bound and stored with the user's trusted digital identity.

[0056] If the verification fails, the authentication result includes the reason for the failure. Specifically, the CTID platform generates the reason for the failure, and the user needs to re-authenticate or provide other supporting materials;

[0057] S13. Sensitive data encryption and signature:

[0058] The encryption and signing of sensitive data is to protect data security and ensure data integrity and authenticity;

[0059] The trusted digital identity platform organizes the user's authorized sensitive data in JSON format and performs base64 encoding to obtain the encoded data;

[0060] The trusted digital identity platform determines the authorization validity period (e.g., 1 hour, 24 hours, etc.) based on business needs;

[0061] The coded data and the authorization serial number are used as input factors of the encryption algorithm, and the trusted digital identity platform calls a dedicated encryption machine program to perform SM4 encryption on the input factors to obtain the encrypted authorization data ciphertext;

[0062] During the encryption process, the authorization serial number participates in the encryption calculation as an input factor of the encryption algorithm. By referencing the authorization serial number, the encryption strength can be improved, making the ciphertext more difficult to crack, because even if the attacker obtains part of the ciphertext and the encryption algorithm, without the correct authorization serial number, the plaintext cannot be decrypted; correspondingly, during the decryption process, the authorization serial number is input into the decryption algorithm together with the authorization data ciphertext, acting as a "key" for decryption, ensuring that only when the authorization serial number is correct can the authorization encrypted ciphertext be successfully decrypted and the plaintext data be obtained, which further increases the security of the system, because even if the ciphertext is intercepted, it cannot be decrypted without the correct authorization serial number;

[0063] The dedicated encryption machine program uses the national secret SM2 signature algorithm to sign the authorization data ciphertext, authorization validity period, trusted digital identity and authorization serial number to generate a signature value. The authorization serial number in the signature verification part is equivalent to the component factor of the signature verification;

[0064] Encapsulate the authorization data ciphertext, authorization validity period, trusted digital identity and signature value in JSON format to obtain the final authorization data packet;

[0065] In this embodiment, the format of the final authorization data packet is further exemplified:

[0066] {

[0067] "data":

[0068] "hp9MjHUr7pHhiH9m / NfQK4jqLpbK+cIkA4Lr9s3IVTps15HQohpjlO6OOpkuF6ac+2oZn2V44Wf7Pg fpvckdvvPU5kjsI7BVji3FRXu / 1wx0T9YDnbIl7i43 / o6tbqaSUQGoZtpYCksJpeI / 7qzfQluIOQ==",

[0069] "bid":"Ev711h8CEAA=",

[0070] "et":"1731045300",

[0071] "sign":

[0072] "MEUCIHwp6IF0mxsmkiLBxHm0TAzFMtt0+VNYg77 / Hx / LtF4bAiEAhDRx68 / so3xUbg23 / Iq2uHN9Dp3tFzEwkeAWRs07Mes="

[0073] };

[0074] In the Json format of the above authorization data packet, data is the ciphertext of the authorization data, bid is the trusted digital identity, et is the timestamp of the authorization validity period in seconds, and sign is the signature value;

[0075] In step S13, the dedicated encryption machine is a network security device specially used for data encryption and decryption. The dedicated encryption machine described in this embodiment meets the third level requirements of GM / T 0028-2014 "Technical Requirements for Cryptographic Module Security"; in this embodiment, a dedicated encryption machine is used to protect data security. The data is encrypted and decrypted through the national secret SM4 and SM2 algorithms provided by the encryption machine to ensure data confidentiality and integrity. The data is signed and verified to ensure data integrity and authenticity, and to ensure that the data has not been tampered with during transmission.

[0076] S14. Data transmission:

[0077] The authorization data packet is transmitted through the file switch and the security isolation network gate, wherein the security isolation network gate is part of the network security protection system at the boundary of the Internet and the security isolation network, and provides a strong guarantee for the network security and business development of the organization by providing physical isolation, secure data exchange, enhanced security protection, protection of sensitive data, business isolation and compliance with security compliance requirements. Furthermore, the physical isolation cuts off the direct link layer connection between the two networks at the physical level, thereby forming a physical barrier between the intranet and the extranet;

[0078] In this embodiment, the security isolation network gateway facility meets the "GB / T 20279-2006 Information Security Technology Network and Terminal Equipment Isolation Components Security Technical Requirements" standard and relevant regulations of the State Security Bureau, and passes information security technology certification or confidentiality technology testing to ensure the security of data during transmission;

[0079] The target system (such as financial institutions, government systems) receives the authorized data packet through the file switch and the security isolation network gatekeeper and stores it in a secure database.

[0080] S2. Application of authorization data package:

[0081] S21. The user presents the trusted digital identity QR code:

[0082] The trusted digital identity QR code presented by the user is a trusted identity credential provided by the user, specifically:

[0083] The user generates a trusted digital identity QR code based on the trusted digital identity and the authorization serial number. The trusted digital identity QR code consists of three segments of data: A, B, and S, where:

[0084] S211, Section A is the data generated by the CTID platform, specifically the index number based on the trusted credential factor file, to obtain the user's unique identification, timestamp and validity period information:

[0085] The user unique identifier is specifically a unique identifier of the user on the CTID platform, which is used to uniquely identify the user and ensure that the user identity can be accurately identified when the trusted digital identity QR code is presented; the timestamp is specifically a timestamp for generating the A segment data, accurate to milliseconds, and is used to record the time when the A segment data is generated, and is used to verify the validity and timeliness of the data; the validity period information is specifically the validity period of the A segment data, including the start time and the end time, and is used to control the use timeliness of the A segment data and ensure that the data can only be used within a specified time range;

[0086] Furthermore, during the user's first application process, the user enters identity information and portrait data on the terminal device in order to initialize the user's trusted digital identity authentication process; the trusted digital identity platform calls the interface of the CTID platform to download the user's trusted credential factor file in order to obtain the user's identity authentication information and generate segment A data; in summary, segment A data is generated based on the user's identity identifier, timestamp, validity period and trusted credential factor file;

[0087] S212, Section B is a ciphertext consisting of user data and business data, wherein the user data is a trusted digital identity and the business data is an authorization serial number;

[0088] S123, S segment is the overall signature value after segment A and segment B are combined;

[0089] According to the above sections A, B and S, the user presents the generated trusted digital identity QR code at the target system;

[0090] S22. The target system reads and decodes the trusted digital identity QR code, reads the user's authorization serial number, and verifies the authenticity of the trusted digital identity QR code. Specifically:

[0091] The target system reads the trusted digital identity QR code presented by the user and decodes it using a trusted digital identity QR code encryption machine, wherein the decoding specifically parses the A segment, B segment and S segment data according to the partition length defined by the code system;

[0092] Verify the overall signature value of segment S. After successful verification, decrypt segment B data to obtain the trusted digital identity and authorization serial number.

[0093] Query the authorization data package from the target system based on the trusted digital identity and authorization serial number,

[0094] The target system calls the dedicated encryption machine interface and uses the authorization data ciphertext, authorization validity period and signature value in the authorization data packet, as well as the digital identity and authorization serial number obtained by decoding the trusted digital identity QR code for signature verification. The purpose of signature verification is to verify the authenticity and integrity of the authorization data.

[0095] After the signature verification is passed, the target system will perform validity verification, specifically judging whether the authorization is valid. If the authorization validity period is greater than the current time, it is valid; if the authorization validity period is less than the current time, the authorization will be judged invalid;

[0096] Preferably, if both the signature verification and the validity period verification are passed, the target system will call the dedicated encryption machine interface to decrypt the authorization data ciphertext in the authorization data packet, obtain the plaintext corresponding to the authorization data ciphertext, and apply it in subsequent business processes.

[0097] Embodiment 2:

[0098] The present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the cross-network authorization application method for sensitive data based on a trusted digital identity as described in Embodiment 1 of the present invention is implemented;

[0099] Embodiment 3:

[0100] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the cross-network authorization application method for sensitive data based on a trusted digital identity as described in Example 1 of the present invention.

[0101] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A cross-network authorization application method for sensitive data based on a trusted digital identity, characterized in that: The method comprises: The user initiates an authorization request corresponding to sensitive data through the terminal device, and the terminal device verifies the user's identity through the trusted digital identity authentication platform. If the verification is successful, the trusted digital identity platform generates the user's trusted digital identity and generates a unique authorization serial number; The trusted digital identity platform calls a dedicated encryption machine program based on the authorization serial number to encrypt the sensitive data authorized by the user to obtain the authorized data ciphertext; the authorized data ciphertext, the authorization validity period, the trusted digital identity identifier and the signature value are packaged to obtain an authorized data packet, and the authorized data packet is transmitted to the target system through the file switch and the security isolation network gate for storage; When a user needs to use authorized sensitive data, a trusted digital identity QR code is generated based on the trusted digital identity and the authorization serial number, and the user presents the trusted digital identity QR code to the target system through a code scanning device; the target system verifies the signature of the trusted digital identity QR code and decrypts it to obtain decrypted data, which includes the trusted digital identity and authorization serial number corresponding to the user; The target system obtains the user's authorization data packet based on the decrypted data query, and calls the dedicated encryption machine interface to verify the signature and validity period of the authorization data packet. If the signature verification and validity period verification are passed, the dedicated encryption machine is used to decrypt the authorization data ciphertext to obtain sensitive data.

2. The cross-network authorization application method for sensitive data based on trusted digital identity according to claim 1 is characterized in that: The method also includes generating a trusted digital identity, specifically: When a user applies for a trusted digital identity for the first time, he / she enters his / her identity information on the terminal device and performs face recognition to obtain portrait data, wherein the identity information includes the user's name and ID number; The terminal device sends the input identity information and portrait data to the trusted digital identity platform. The trusted digital identity platform calls the CTID platform to verify the user's identity. When the user's identity authentication is passed, the CTID platform generates a trusted credential factor file corresponding to the user. The trusted credential factor file contains the user's identity, encrypted digital signature and digital certificate; the trusted digital identity platform generates the user's trusted digital identity based on the trusted credential factor file; the CTID platform returns the trusted credential factor file to the terminal device for local encrypted storage.

3. The cross-network authorization application method for sensitive data based on trusted digital identity according to claim 2 is characterized in that: The terminal device verifies the user's identity through the CTID platform through trusted digital identity authentication: When the user performs trusted digital identity authentication, the terminal device collects the user's portrait data again and calls the SDK interface to encrypt the trusted credential factor file to obtain the trusted credential factor ciphertext; The terminal device uploads the collected portrait data and trusted credential factor ciphertext to the trusted digital identity platform. The trusted digital identity platform calls the interface of the CTID platform and uploads the read trusted credential factor ciphertext and portrait data to the CTID platform for verification. The CTID platform verifies the uploaded trusted credential factor ciphertext and portrait data, and checks whether the portrait data and the trusted credential factor file obtained after decrypting the trusted credential factor ciphertext are consistent with those provided during the first application; After verification is completed, the CTID platform returns the authentication result to the terminal device, including: If the verification is successful, the trusted digital identity platform searches for the user's trusted digital identity based on the authentication result of the CTID platform and generates a unique authorization serial number. The authorization serial number is bound to the trusted digital identity and saved as the authentication result. If the verification fails, the CTID platform generates the failure reason as the authentication result.

4. The cross-network authorization application method for sensitive data based on trusted digital identity according to claim 3 is characterized in that: The trusted digital identity platform calls a dedicated encryption machine program based on the authorization serial number to encrypt the sensitive data authorized by the user, and obtains the authorization data ciphertext as follows: The trusted digital identity platform organizes the sensitive data authorized by the user in JSON format and performs base64 encoding to obtain the encoded data; the encoded data and the authorization serial number are used as input factors of the encryption algorithm, and the trusted digital identity platform calls a dedicated encryption machine program to perform SM4 encryption on the input factors to obtain the encrypted authorization data ciphertext.

5. The cross-network authorization application method for sensitive data based on trusted digital identity according to claim 4 is characterized in that: The authorization data ciphertext, authorization validity period, trusted digital identity and signature value are packaged to obtain the authorization data packet as follows: The trusted digital identity platform determines the authorization validity period according to business needs, and calls the dedicated encryption machine program to use the national secret SM2 signature algorithm to sign the authorization data ciphertext, authorization validity period, trusted digital identity and authorization serial number to generate a signature value; Encapsulate the authorization data ciphertext, authorization validity period, trusted digital identity and signature value in JSON format to obtain the final authorization data packet.

6. The cross-network authorization application method for sensitive data based on trusted digital identity according to claim 5 is characterized in that: The specific steps for generating a trusted digital identity QR code based on a trusted digital identity identifier and an authorization serial number are as follows: The trusted digital identity QR code consists of three segments of data: A, B, and S, where: Data in Section A is data generated by the CTID platform, specifically the index number of the trusted credential factor file, which is used to obtain the user's unique identification, timestamp, and validity period information; The data in segment B is a ciphertext composed of user data and business data, wherein the user data is a trusted digital identity and the business data is an authorization serial number; The S segment data is the overall signature value obtained by combining the A segment data and the B segment data.

7. The cross-network authorization application method for sensitive data based on trusted digital identity according to claim 6 is characterized in that: The target system verifies and decrypts the trusted digital identity QR code as follows: The target system reads the trusted digital identity QR code presented by the user and decodes it using a dedicated encryption machine for the trusted digital identity QR code. The decoding specifically parses the A, B and S segments of data according to the partition length defined by the code system; verifies the overall signature value of the S segment, and decrypts the B segment data after successful verification to obtain the trusted digital identity and authorization serial number.

8. The cross-network authorization application method for sensitive data based on trusted digital identity according to claim 7 is characterized in that: The validity period check specifically determines whether the authorization is valid based on the authorization validity period. If the authorization validity period is greater than the current time, it is valid. If the authorization validity period is less than the current time, the authorization will be judged invalid.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the cross-network authorization application method for sensitive data based on a trusted digital identity is implemented as described in any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method for cross-network authorization application of sensitive data based on a trusted digital identity as described in any one of claims 1 to 8 is implemented.

Images