Data development application authorization platform interaction method

Abstract

The invention discloses a data development application authorization platform interaction method, which comprises the following steps that firstly, a signing ticket is acquired, a data subject initiates a data authorization operation through a data application unit application end, and the application end pushes scene information and data subject information to a provincial public data resource development service platform to acquire a signing ticket service; and initiating a data authorization operation through the data main body, and pushing information to the provincial public data resource development service platform to obtain a ticket signing service. And after the data main body agrees to authorize, scene authorization is carried out in a short message verification code mode, so that authorization circulation of the data elements is effectively guaranteed. And meanwhile, after the authentication is finished, the platform synchronously pushes the service address of the token to the application unit according to the received data access token provided by the application end of the application unit. Through a mode of providing an Https interface, in combination with authorization of a data main body, the system runs on the premise that data is available and invisible, and finally, the system plays a supporting role in application scene business.

Description

Technical Field

[0001] The present invention relates to the technical field of data development, and in particular to a data development application authorization platform interaction method. Background Art

[0002] The Data Development Authorization Platform is a platform for managing and controlling data access rights. It is mainly for data subjects and data users, and provides "grant authorization" and "obtain authorization" functional services. The Data Development Authorization Platform explores a trusted authorization mechanism, is compatible with the data usage needs of diversified application units and application platforms, and authorizes application scenarios under the premise of legality and compliance; With the development of cloud computing, more and more companies choose to store data in the cloud. The provincial public data resource development service platform can reduce manual operations and improve the approval efficiency of agreement documents. Therefore, the authorization management platform needs to have the function of ensuring the authorized circulation of data elements to ensure comprehensive management and protection.

[0003] However, during the use of the existing data development authorization platform, the data subject and the data user need to obtain the scene approval agreement element data to generate the agreement file. Then, the provincial public data resource development service platform is used for approval and authorization. Since the verification of data approval often requires manual verification, the provincial public data resource development service platform cannot directly pass the verification information to the data application unit application end, so the data approval circulation efficiency is low. It is difficult to perform scene authorization without signing the agreement file to quickly obtain CA digital signature certification, which leads to slow data file authorization; and after the agreement is signed and authenticated, the provincial public data resource development service platform cannot push the data access token to the corresponding data application unit according to the service address of receiving the data access token, which will affect the efficiency of data development.

[0004] Therefore, a data development application authorization platform interaction method is proposed to solve this problem. Summary of the invention

[0005] The purpose of the present invention is to provide a data development application authorization platform interaction method, which operates under the premise of "available but invisible" data by providing an Https interface and combining data subject authorization, and ultimately supports application scenario business. This effectively guarantees the authorized circulation of data elements, so that unsigned agreement files can quickly perform scenario authorization and then quickly obtain CA digital signature authentication.

[0006] To achieve the above object, the present invention provides the following technical solution: a data development application authorization platform interaction method, comprising the following steps: Step 1: Obtain a signed ticket: The data subject initiates a data authorization operation through the data application unit application end, and the application end pushes the scenario information and data subject information to the provincial public data resource development service platform to obtain a signed ticket service; Step 2: Get the authorization authentication page: After the parameter verification of the obtained signature ticket service is passed, the ticket information is returned to the data application unit application end. The data application unit application end obtains the signature page according to the obtained ticket information, and opens the authorization agreement authentication page with the signature ticket combined with the signature page address; Step 3: Agreement signing and authentication: After the data subject agrees to the authorization, he will obtain the SMS verification code through the provincial public data resource development service platform, and perform scene authorization through the SMS verification code interaction to obtain CA digital signature authentication; Step 4: Receive data access token: After the agreement is signed and authenticated, the provincial public data resource development service platform will push the data access token to the corresponding data application unit based on the data access token receiving service address provided by the data application unit application end.

[0007] Preferably, in step 1, the data application unit application end uses an encrypted push method to push the scene information and data subject information to the provincial public data resource development service platform.

[0008] Preferably, in step 1, the environmental dependency basis for interaction between the data subject and the data application unit application end and the provincial public data resource development service platform is: Jdk 1.8+; the dependency package is: sirc-security-nsc-1.0.2.jar.

[0009] Preferably, in step 2, after the data application unit application terminal opens the authorization agreement authentication page by combining the signed ticket with the signing page address, the authorization agreement authentication page will be synchronously returned to the data subject for browsing.

[0010] Preferably, in step 3, after the data subject agrees to the authorization, the transaction identifier will be pushed to the provincial public data resource development service platform synchronously through the data application unit application end.

[0011] Preferably, in step 3, after obtaining the SMS verification code, the provincial public data resource development service platform will synchronously return the SMS verification code to the data subject for browsing.

[0012] Preferably, in step 3, after the data subject inputs the returned SMS verification code, the verification code and transaction ID will be pushed to the provincial public data resource development service platform through the data application unit application end.

[0013] Preferably, in step 3, after the provincial public data resource development service platform performs digital signature authentication on the agreement, it will return the signed agreement and authorization result to the data subject through the data application unit application end.

[0014] Preferably, in step 3, the digital signature capability of the CA of the digital signature certification authority must comply with the "Electronic Signature Law of the People's Republic of China".

[0015] Preferably, in step 4, after the provincial public data resource development service platform pushes the data access token to the data application unit, the data application unit application end will synchronously return the push result to the provincial public data resource development service platform.

[0016] Compared with the prior art, the present invention has the following beneficial effects: The patent of this invention initiates data authorization operation through the application end of the data application unit, and pushes the information to the provincial public data resource development service platform to obtain the signing ticket service. When the data subject agrees to the authorization, the scene authorization is carried out through the SMS verification code interaction and the digital signature authentication is performed, thereby effectively ensuring the authorized circulation of data elements. At the same time, after the authentication is completed, the provincial public data resource development service platform will synchronously push the data access token to the application unit according to the service address for receiving data access tokens provided by the application end of the application unit. It enables it to operate under the premise of "available but invisible" data by providing Https interface and combining data subject authorization, and ultimately supports the application scenario business. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a schematic diagram of the interaction process of the present invention; Figure 2 This is a standard schematic diagram of input parameters of the present invention; Figure 3 This is a standard schematic diagram of output parameters of the present invention; Figure 4 This is a schematic diagram of the authorized access use status of the present invention; Figure 5 A schematic diagram of the key usage status of the present invention; Figure 6 This is a schematic diagram of the usage status of the client public key of the present invention; Figure 7 This is a schematic diagram of the use status of the access whitelist of the present invention; Figure 8 A schematic diagram of the interactive example usage state of the present invention; Fig. 9 A schematic diagram of the use status of the scene identification of the present invention. DETAILED DESCRIPTION

[0018] The present invention will be described in more detail below by way of examples, which are merely illustrative and do not in any way limit the scope of the present invention.

[0019] The present invention provides a technical solution: a data development application authorization platform interaction method, comprising the following steps: Step 1: Obtain a signed ticket: The data subject initiates a data authorization operation through the data application unit application end, and the application end pushes the scenario information and data subject information to the provincial public data resource development service platform to obtain a signed ticket service; Step 2: Get the authorization authentication page: After the parameter verification of the obtained signature ticket service is passed, the ticket information is returned to the data application unit application end. The data application unit application end obtains the signature page according to the obtained ticket information, and opens the authorization agreement authentication page with the signature ticket combined with the signature page address; Step 3: Agreement signing and authentication: After the data subject agrees to the authorization, he will obtain the SMS verification code through the provincial public data resource development service platform, and perform scene authorization through the SMS verification code interaction to obtain CA digital signature authentication; Step 4: Receive data access token: After the agreement is signed and authenticated, the provincial public data resource development service platform will push the data access token to the corresponding data application unit based on the data access token receiving service address provided by the data application unit application end.

[0020] Embodiment 1: First, obtain the signing ticket. The data subject initiates the data authorization operation through the data application unit application end. The application end pushes the scene information and data subject information to the provincial public data resource development service platform to obtain the signing ticket service; then obtain the authorization authentication page. After the signing ticket service receives the parameter verification, the ticket information is returned to the data application unit application end. The data application unit application end obtains the signing page based on the obtained ticket information, and uses the signing ticket in combination with the signing page address to open the authorization agreement authentication page; after the agreement is signed and authenticated, after the data subject agrees to the authorization, the SMS verification code will be obtained through the provincial public data resource development service platform, and the scene authorization will be performed through the SMS verification code interaction to obtain the CA digital signature authentication; finally, the data access token is received. After the agreement signing and authentication is completed, the provincial public data resource development service platform pushes the data access token to the corresponding data application unit according to the receiving data access token service address provided by the data application unit application end.

[0021] refer to Figure 4 2. Log in to the "Workbench" through the main account of the data application unit, select the "Authorization Access-Own Authorization" module in the left menu, and configure the "Call Key", "Client Public Key" and "Access Whitelist"; refer to Figure 5 , First call the key: a 16-bit string consisting of lowercase letters az, uppercase letters AZ, and numbers 0-9 randomly; refer to Figure 6 , Secondly, client public key: SM2 public and private key pairs are used as asymmetric encryption keys, and public and private key pairs are generated through standard generation rules. The private key is saved as an internal setting of the application platform and shall not be made public. The public key will be saved to the "Client Public Key" configuration item; refer to Figure 7 , Then visit the whitelist: It is the Internet exit IP address of the application service. The configured Internet IP addresses must not exceed ten, and different addresses are separated by English “,”.

[0022] After completing the configuration of "Call Key", "Client Public Key" and "Access Whitelist", click the "Save Settings" button at the bottom of the page. The page will prompt "Save Successfully" for the configuration to take effect. refer to Figure 8 After the configuration of "Call Key", "Client Public Key" and "Access Whitelist" is completed and saved successfully, the following four parameters need to be used in the service interaction process: Call ID, Call Key, Server Public Key and the private key corresponding to the configured "Client Public Key". These four parameters are used in basic services, synchronous authorization mode services and authorized file asynchronous upload mode services.

[0023] Take the interactive example as an example: Call ID: corresponding Figure 8 Call the "APP_ID" in the example; Call key: corresponding Figure 8 Call the "APP_KEY" in the example; Server public key: corresponding Figure 8 Call "remotePublicKey" in the example; Client private key: corresponding Figure 8 Call the "localPrivateKey" in the example, the private key corresponding to the configured "client public key"; refer to Fig. 9 , Finally, the data application unit logs in to the workbench according to the sub-account of the declared scene, selects the "Scene Construction->My Scene->Real-time Query Scene" module in the left menu bar, selects the "Online" category list in the right content page, and selects the corresponding scene ID (sceneId) that needs to be used in the list.

[0024] Embodiment 2: In the first embodiment, the following steps are added: In step 1, the data application unit application uses encrypted push to push the scene information and data subject information to the provincial public data resource development service platform; the environmental dependency basis for the interaction between the data subject and the data application unit application and the provincial public data resource development service platform is: Jdk 1.8+; the dependency package is: sirc-security-nsc-1.0.2.jar.

[0025] In step 2, after the data application unit application side combines the signed ticket with the signing page address to open the authorization agreement authentication page, the authorization agreement authentication page will be synchronously returned to the data subject for browsing.

[0026] First, obtain the signing ticket. The data subject initiates the data authorization operation through the data application unit application end. The application end pushes the scene information and data subject information to the provincial public data resource development service platform to obtain the signing ticket service. The data application unit application end uses encrypted push to push the scene information and data subject information to the provincial public data resource development service platform. The environment dependency basis for the interaction between the data subject and the data application unit application end and the provincial public data resource development service platform is: Jdk 1.8+; the dependency package is: sirc-security-nsc-1.0.2.jar. Then obtain the authorization authentication page. After the signing ticket service receives the parameter verification, the ticket information is returned to the data application unit application end. The data application unit application end obtains the signing page based on the obtained ticket information, and opens the authorization agreement authentication page with the signing ticket combined with the signing page address. After the data application unit application end opens the authorization agreement authentication page with the signing ticket combined with the signing page address, the authorization agreement authentication page will be synchronously returned to the data subject for browsing. After that, the agreement is signed and authenticated. When the data subject agrees to the authorization, he / she will obtain the SMS verification code through the provincial public data resource development service platform, and perform the scene authorization through the SMS verification code interaction to obtain the CA digital signature authentication; finally, the data access token is received. After the agreement is signed and authenticated, the provincial public data resource development service platform will push the data access token to the corresponding data application unit according to the data access token receiving service address provided by the application end of the data application unit.

[0027] Embodiment three: In the second embodiment, the following steps are added: In step 3, after the data subject agrees to the authorization, the transaction identification will be pushed to the provincial public data resource development service platform through the application end of the data application unit; after obtaining the SMS verification code, the provincial public data resource development service platform will simultaneously return the SMS verification code to the data subject for browsing; after the data subject enters the returned SMS verification code, the verification code and transaction identification will be pushed to the provincial public data resource development service platform through the application end of the data application unit; after the provincial public data resource development service platform digitally signs and authenticates the agreement, it will return the signed agreement and authorization result to the data subject through the application end of the data application unit; the digital signature capability of the CA of the digital signature certification agency must comply with the "Electronic Signature Law of the People's Republic of China".

[0028] First, obtain the signing ticket. The data subject initiates the data authorization operation through the data application unit application end. The application end pushes the scene information and data subject information to the provincial public data resource development service platform to obtain the signing ticket service. The data application unit application end uses encrypted push to push the scene information and data subject information to the provincial public data resource development service platform. The environment dependency basis for the interaction between the data subject and the data application unit application end and the provincial public data resource development service platform is: Jdk 1.8+; the dependency package is: sirc-security-nsc-1.0.2.jar. Then obtain the authorization authentication page. After the signing ticket service receives the parameter verification, the ticket information is returned to the data application unit application end. The data application unit application end obtains the signing page based on the obtained ticket information, and opens the authorization agreement authentication page with the signing ticket combined with the signing page address. After the data application unit application end opens the authorization agreement authentication page with the signing ticket combined with the signing page address, the authorization agreement authentication page will be synchronously returned to the data subject for browsing. After the agreement is signed and authenticated, after the data subject agrees to the authorization, the SMS verification code will be obtained through the provincial public data resource development service platform, and the scene authorization will be carried out through the SMS verification code interaction to obtain the CA digital signature authentication; after the data subject agrees to the authorization, the data application unit application will synchronously push the flow mark to the provincial public data resource development service platform; after obtaining the SMS verification code, the provincial public data resource development service platform will synchronously return the SMS verification code to the data subject for browsing; after the data subject enters the returned SMS verification code, the data application unit application will push the verification code and flow mark to the provincial public data resource development service platform through the data application unit application; after the provincial public data resource development service platform digitally signs and authenticates the agreement, it will return the signed agreement and authorization result to the data subject through the data application unit application; the CA digital signature capability of the digital signature certification agency must comply with the "Electronic Signature Law of the People's Republic of China". Finally, the data access token is received. After the agreement is signed and authenticated, the provincial public data resource development service platform pushes the data access token to the corresponding data application unit according to the data access token receiving service address provided by the data application unit application.

[0029] Embodiment 4: In the third embodiment, the following steps are added: In step 4, after the provincial public data resource development service platform pushes the data access token to the data application unit, the data application unit application end will synchronously return the push result to the provincial public data resource development service platform.

[0030] First, obtain the signing ticket. The data subject initiates the data authorization operation through the data application unit application end. The application end pushes the scene information and data subject information to the provincial public data resource development service platform to obtain the signing ticket service. The data application unit application end uses encrypted push to push the scene information and data subject information to the provincial public data resource development service platform. The environment dependency basis for the interaction between the data subject and the data application unit application end and the provincial public data resource development service platform is: Jdk 1.8+; the dependency package is: sirc-security-nsc-1.0.2.jar. Then obtain the authorization authentication page. After the signing ticket service receives the parameter verification, the ticket information is returned to the data application unit application end. The data application unit application end obtains the signing page based on the obtained ticket information, and opens the authorization agreement authentication page with the signing ticket combined with the signing page address. After the data application unit application end opens the authorization agreement authentication page with the signing ticket combined with the signing page address, the authorization agreement authentication page will be synchronously returned to the data subject for browsing. After that, the agreement is signed and authenticated. After the data subject agrees to the authorization, the SMS verification code will be obtained through the provincial public data resource development service platform, and the scene authorization will be carried out through the SMS verification code interaction to obtain CA digital signature authentication; after the data subject agrees to the authorization, the transaction identifier will be pushed to the provincial public data resource development service platform through the data application unit application end; after obtaining the SMS verification code, the provincial public data resource development service platform will simultaneously return the SMS verification code to the data subject for browsing; after the data subject enters the returned SMS verification code, the verification code and transaction identifier will be pushed to the provincial public data resource development service platform through the data application unit application end; after the provincial public data resource development service platform digitally signs and authenticates the agreement, it will return the signed agreement and authorization result to the data subject through the data application unit application end; the CA digital signature capability of the digital signature certification agency must comply with the "Electronic Signature Law of the People's Republic of China". Finally, after receiving the data access token and completing the agreement signing and authentication, the Provincial Public Data Resource Development Service Platform will push the data access token to the corresponding data application unit according to the service address for receiving data access tokens provided by the application end of the data application unit; after the Provincial Public Data Resource Development Service Platform pushes the data access token to the data application unit, the application end of the data application unit will synchronously return the push result to the Provincial Public Data Resource Development Service Platform.

[0031] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A data development application authorization platform interaction method, characterized in that: The following steps are involved: Step 1: Obtain a signed ticket: The data subject initiates a data authorization operation through the data application unit application end, and the application end pushes the scenario information and data subject information to the provincial public data resource development service platform to obtain a signed ticket service; Step 2: Get the authorization authentication page: After the parameter verification of the obtained signature ticket service is passed, the ticket information is returned to the data application unit application end. The data application unit application end obtains the signature page according to the obtained ticket information, and opens the authorization agreement authentication page with the signature ticket combined with the signature page address; Step 3: Agreement signing and authentication: After the data subject agrees to the authorization, he will obtain the SMS verification code through the provincial public data resource development service platform, and perform scene authorization through the SMS verification code interaction to obtain CA digital signature authentication; Step 4: Receive data access token: After the agreement is signed and authenticated, the provincial public data resource development service platform will push the data access token to the corresponding data application unit based on the data access token receiving service address provided by the data application unit application end.

2. A data development application authorization platform interaction method according to claim 1, characterized in that: In step 1, the data application unit application end uses an encrypted push method to push the scene information and data subject information to the provincial public data resource development service platform.

3. A data development application authorization platform interaction method according to claim 1, characterized in that: In step 1, the environment dependency basis for the interaction between the data subject, the data application unit application end, and the provincial public data resource development service platform is: Jdk 1.8+; The dependent package is: sirc-security-nsc-1.0.2.jar.

4. A data development application authorization platform interaction method according to claim 1, characterized in that: In step 2, after the data application unit application terminal combines the signed ticket with the signing page address to open the authorization agreement authentication page, the authorization agreement authentication page will be synchronously returned to the data subject for browsing.

5. A data development application authorization platform interaction method according to claim 1, characterized in that: In step 3, after the data subject agrees to the authorization, the transaction identifier will be pushed to the provincial public data resource development service platform synchronously through the data application unit application end.

6. A data development application authorization platform interaction method according to claim 1, characterized in that: In step 3, after obtaining the SMS verification code, the provincial public data resource development service platform will synchronously return the SMS verification code to the data subject for browsing.

7. A data development application authorization platform interaction method according to claim 1, characterized in that: In step 3, after the data subject inputs the returned SMS verification code, the verification code and transaction ID will be pushed to the provincial public data resource development service platform through the data application unit application end.

8. A data development application authorization platform interaction method according to claim 1, characterized in that: In step 3, after the provincial public data resource development service platform digitally signs and authenticates the agreement, it will return the signed agreement and authorization result to the data subject through the data application unit application end.

9. A data development application authorization platform interaction method according to claim 1, characterized in that: In step 3, the digital signature capability of the CA of the digital signature certification authority must comply with the "Electronic Signature Law of the People's Republic of China".

10. A data development application authorization platform interaction method according to claim 1, characterized in that: In step 4, after the provincial public data resource development service platform pushes the data access token to the data application unit, the data application unit application end will synchronously return the push result to the provincial public data resource development service platform.

Images