Credit report online preview method and device

Abstract

The invention relates to the technical field of information processing, and provides a credit report online preview method and device. The method comprises the following steps: when a user initiates a preview report request, judging whether the user has an online preview permission or not so as to generate a temporary authorization token when the user has the online preview permission; when the temporary authorization token needs to be generated, encrypting the original report data to obtain a temporary file; when a user initiates a report access request, the temporary file is decrypted according to the temporary authorization token, and a one-time credit report is loaded, so that the user can check the one-time credit report; when the user finishes checking the one-time credit report, deleting the temporary file and the one-time credit report; and when the temporary authorization token is invalid, deleting the temporary authorization token. According to the method and the device, the problem that the content in the static file downloaded to the local storage device is likely to be easily read by an unauthorized user is solved.

Description

Technical Field

[0001] The present invention relates to the field of information processing technology, and in particular to a method and device for online previewing of a credit report. Background Art

[0002] Currently, personal credit reporting and related credit products on the market provide users with the function of viewing credit reports, which are usually implemented in the form of static files to preview or download credit reports online. For example, the static files can be in Portable Document Format (PDF). These static files are often downloaded by users to local storage devices for viewing.

[0003] However, the storage method of downloading to local storage devices has potential security risks and cannot protect the contents of static files from being easily read by unauthorized users. For example, static files may be illegally obtained due to the loss, theft, or malware attack of the local storage device, which in turn leads to serious privacy leakage risks.

[0004] In view of this, overcoming the defects of the prior art is an urgent problem to be solved in the field of this technology. Summary of the invention

[0005] The technical problem to be solved by the present invention is to provide a method and device for online preview of credit reports, the purpose of which is to provide an effective control mechanism for static files, adopt a temporary authorization preview method, and control the access time and authority of temporary files by setting temporary authorization tokens for temporary files, so as to achieve the purpose of strictly controlling the preview time and scope of temporary files, effectively avoid long-term storage and abuse of static files, thereby reducing the risk of user privacy leakage, and solving the problem that the content of static files downloaded to local storage devices may be easily read by unauthorized users.

[0006] The present invention adopts the following technical solution:

[0007] In a first aspect, the present invention provides a method for online previewing of a credit report, comprising:

[0008] When a user initiates a request for previewing a report, determining whether the user has online preview authority, and generating a temporary authorization token if the user has online preview authority;

[0009] When a temporary authorization token needs to be generated, the original report data is encrypted to obtain a temporary file;

[0010] When the user initiates a request to access the report, the temporary file is decrypted according to the temporary authorization token, and the one-time credit report is loaded, so that the user can view the one-time credit report;

[0011] When the user finishes viewing the one-time credit report, the temporary file and the one-time credit report are deleted; when the temporary authorization token expires, the temporary authorization token is deleted.

[0012] Furthermore, the online preview permission includes basic information permission and sensitive information permission; the temporary authorization token includes a web page token and a mobile terminal token; the temporary file includes a web page temporary file and a mobile terminal temporary file;

[0013] When the user initiates a request for previewing the report, determining whether the user has online preview authority to generate a temporary authorization token when the user has online preview authority includes:

[0014] When a user initiates a request to preview a report, it is checked whether the user has basic information permissions according to the access permission rules;

[0015] When the user has basic information authority, the fragment report data with a data sensitivity level less than the level threshold is obtained from the multiple fragment report data of the original report data to obtain the web page data to be encrypted, and a corresponding web page token is generated for the web page data to be encrypted, so as to encrypt the web page data to be encrypted and obtain a web page temporary file;

[0016] Check whether the user has permission to sensitive information; when the user has permission to sensitive information, determine the fragment report data with a data sensitivity level greater than or equal to the level threshold, and the fragment report data containing the user's basic information as mobile data to be encrypted, and generate a corresponding mobile terminal token for the mobile data to be encrypted, so as to facilitate the encryption processing of the mobile data to be encrypted and obtain a mobile terminal temporary file.

[0017] Furthermore, checking whether the user has sensitive information permission includes:

[0018] The current account information of the user is obtained, and when the current account information matches the real-name account information corresponding to the original report data, it is determined that the user has sensitive information permission.

[0019] Further, when the user initiates a request to access the report, decrypting the temporary file according to the temporary authorization token and loading the one-time credit report includes:

[0020] When the web page token is valid, decrypt the web page temporary file to obtain the web page decrypted data, so as to load a one-time credit report corresponding to the web page decrypted data on the credit report display web page;

[0021] The user is prompted to log in on the mobile terminal device, so that when the mobile token is valid, the mobile temporary file is received on the mobile terminal device, the mobile temporary file is decrypted, the mobile decrypted data is obtained, and a one-time credit report corresponding to the mobile decrypted data is loaded on the mobile terminal device.

[0022] Furthermore, it also includes:

[0023] When the mobile terminal device receives the mobile terminal temporary file, starting the front camera of the mobile terminal device;

[0024] When there is only a unique authorized face corresponding to the real-name facial information of the user within the collection range of the front camera, a one-time credit report corresponding to the mobile decrypted data is displayed.

[0025] Furthermore, when the front camera captures only the unique authorized face corresponding to the real-name face information of the user within its acquisition range, displaying the one-time credit report corresponding to the mobile decrypted data includes:

[0026] When there is only a unique authorized face corresponding to the real-name facial information within the collection range, and the unique authorized face is effectively observing the screen of the mobile terminal device, a one-time credit report corresponding to the mobile decrypted data is displayed;

[0027] When more than one face can be captured within the collection range, the one-time credit report corresponding to the mobile decrypted data is coded and / or blurred;

[0028] When any other electronic device can be captured within the collection range, the one-time credit report corresponding to the mobile decrypted data is coded and / or blurred.

[0029] Furthermore, the front camera is used to track the unique authorized person's face and to capture its eyes;

[0030] When there is only a unique authorized face corresponding to the real-name facial information within the collection range, and the unique authorized face is effectively observing the screen of the mobile terminal device, displaying a one-time credit report corresponding to the mobile decrypted data includes:

[0031] During the process of displaying the one-time credit report corresponding to the mobile decrypted data, when the unique authorized face cannot be captured within the collection range, and / or when the eye line of sight of the unique authorized face is not within the range of the screen, the corresponding one-time credit report is coded and / or blurred; until only the unique authorized face is within the collection range and the eye line of sight is within the range of the screen, the corresponding one-time credit report is displayed again.

[0032] Furthermore, when a temporary authorization token needs to be generated, the original report data is encrypted to obtain a temporary file including:

[0033] Dividing the original report data into a plurality of segment report data;

[0034] Determining an encryption method for the fragment report data according to the data sensitivity level;

[0035] According to the corresponding encryption method, each of the fragment report data is encrypted to obtain a plurality of encrypted data;

[0036] The encrypted data are combined to obtain a temporary file.

[0037] In a second aspect, the present invention further provides a credit report online preview device, comprising:

[0038] At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the processor to execute the online credit report preview method described in the first aspect.

[0039] In a third aspect, the present invention further provides a non-volatile computer storage medium storing computer executable instructions, which are executed by one or more processors to complete the online credit report preview method described in the first aspect.

[0040] In a fourth aspect, a computer program product comprising instructions is provided, which, when executed on a computer or a processor, causes the computer or the processor to execute the online credit report preview method of the first to third aspects and any one of the above.

[0041] In a fifth aspect, the present invention further provides an online preview system for a credit report, comprising an online preview device for a credit report as in the second aspect, and using an online preview method for a credit report as described in the first aspect to complete the interaction of the online preview device for a credit report of the second aspect.

[0042] Different from the prior art, the present invention has at least the following beneficial effects:

[0043] The present invention adopts a temporary authorization preview method. When a user with online preview authority initiates a preview report request, a temporary authorization token and an encrypted temporary file are generated, and the access time and authority to the temporary file are controlled by the temporary authorization token. When a user initiates a request to access the report, the temporary authorization token is used to ensure that only authorized users can preview the decrypted one-time credit report within the specified time, thereby achieving the purpose of strictly controlling the preview time and scope of temporary files, effectively avoiding long-term storage and abuse of static files, thereby reducing the risk of user privacy leakage, and solving the problem that the content of static files downloaded to local storage devices may be easily read by unauthorized users. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments of the present invention. Obviously, the drawings described below are only some embodiments of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0045] Figure 1 It is a flowchart of a credit report online preview method provided by an embodiment of the present invention;

[0046] Figure 2 is a flow chart of step 20 provided in an embodiment of the present invention;

[0047] Figure 3 It is a flowchart of a specific example of a credit report online preview method provided by an embodiment of the present invention;

[0048] Figure 4 is a flow chart of step 10 provided in an embodiment of the present invention;

[0049] Figure 5 is a flow chart of step 30 provided in an embodiment of the present invention;

[0050] Figure 6 It is a flowchart of another method for online previewing of a credit report provided by an embodiment of the present invention;

[0051] Figure 7 is a flowchart of step 402 provided by an embodiment of the present invention;

[0052] Figure 8 This is a schematic diagram of state switching of a one-time credit report display interface provided by an embodiment of the present invention;

[0053] Fig. 9 It is a schematic diagram of the architecture of a credit report online preview device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0055] Unless the context requires otherwise, throughout the specification and claims, the term "including" is to be interpreted as open inclusion, that is, "including, but not limited to". In the description of the specification, the terms "one embodiment", "some embodiments", "exemplary embodiments", "examples", "specific examples" or "some examples" and the like are intended to indicate that specific features, structures, materials or characteristics associated with the embodiment or example are included in at least one embodiment or example of the present disclosure. The schematic representation of the above terms does not necessarily refer to the same embodiment or example. In addition, the specific features, structures, materials or characteristics may be included in any one or more embodiments or examples in any appropriate manner, that is, although they may be carried in the embodiments or examples of the above terms due to reasons such as the order and position of appearance, it is not limited to that they can be carried in combination by one embodiment or example.

[0056] In the description of the present invention, it is necessary to understand that the terms "center", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating orientations or positional relationships, are based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present disclosure and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as a limitation on the present disclosure.

[0057] In the description of the present invention, the terms "first" and "second" are used only for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features. Thus, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of the present disclosure, unless otherwise specified, the meaning of "multiple" is two or more. In addition, for example, the same type of nouns may be described as two independent individuals by adding "A" and "B" at the end. In this case, the corresponding features defined as "A" and "B" are only used to distinguish the same type of individuals for description purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features.

[0058] When describing some embodiments, the expressions "coupling", "coupling" and "connection" and their derivatives may be used. For example, when describing some embodiments, the term "connection" may be used to indicate that two or more components are in direct physical or electrical contact with each other. For another example, when describing some embodiments, the term "coupling" may be used to indicate that two or more components are in direct physical or electrical contact. However, the terms "connection" or "coupling" may also refer to two or more components that are not in direct contact with each other, but still cooperate or interact with each other, such as "optical path coupling", "wireless connection", etc. The embodiments disclosed herein are not necessarily limited to the contents of the present invention.

[0059] In the description of the present invention, the expression "A and / or B" (where A and B are used to formally represent specific characteristic contents) will be involved, and the corresponding expressions include the following three combinations: only A, only B, and a combination of A and B.

[0060] As used herein, "about," "substantially," or "approximately" includes the stated value and an average value that is within an acceptable range of deviation from the particular value as determined by one of ordinary skill in the art taking into account the measurements in question and the errors associated with the measurement of the particular quantity (i.e., the limitations of the measurement system).

[0061] Embodiment 1:

[0062] In order to solve the above problems, the embodiment of the present invention provides a credit report online preview method, such as Figure 1 Specifically, it includes:

[0063] Step 10: When the user initiates a request to preview the report, it is determined whether the user has online preview permission, so as to generate a temporary authorization token if the user has online preview permission.

[0064] Among them, the preview report request is used for: the user requests to preview his own credit report online; the method for determining the online preview permission is determined by technical personnel in this field based on specific usage scenarios and experience, and is not limited here.

[0065] In an optional embodiment, a temporary authorization token can be generated based on the following information: (1) Authorization object: the identity information that can access the user's credit report is specified in the temporary authorization token; (2) Authorization scope: the temporary authorization token defines the authorization content, such as which parts of the credit report can be viewed; (3) Validity period: the temporary authorization token contains the expiration time of the temporary authorization token, and the validity period can be set to half an hour to ensure that the temporary authorization token can only be used within the half-hour validity period; (4) Security settings: the temporary authorization token contains encryption information and desensitization settings to ensure the security of temporary file transmission. When generating a temporary authorization token, use encryption technology to sign it to ensure that it cannot be tampered with. The generated temporary authorization token has a timestamp, encrypted signature and access control rules to ensure the confidentiality and integrity of the credit report.

[0066] In one embodiment, after the user logs in to the web page of the credit report query website, he enters the credit report application interface, and then clicks the "Apply for View" button on the credit report application interface. At this time, the web page will use the user information of the user (e.g., user unique identifier), the file information of the requested credit report (e.g., credit report unique identifier) ​​and other request parameters automatically generated by the system (e.g., access method, access time range and environment) to generate a corresponding preview report request and send it to the server. The server first uses the user information to query the database or real-name authentication system of the credit report query website to verify whether the user's identity is legal; if it is legal, it checks whether the user has online preview permissions according to the pre-set file access permission rules. When there is wired preview permission, a temporary authorization token is generated using the relevant parameters carried in the preview report request.

[0067] It should be noted that, in order to reduce the risk of user privacy leakage, the embodiment of the present invention only provides users with an online preview mode for viewing credit reports.

[0068] Step 20: When a temporary authorization token needs to be generated, the original report data is encrypted to obtain a temporary file.

[0069] Among them, the original report data is the credit report data obtained after requesting the server; the encryption method is selected by technical personnel in this field according to the specific usage scenario, and an optional specific example will be described below.

[0070] Step 30: When the user initiates a request to access the report, the temporary file is decrypted according to the temporary authorization token and the one-time credit report is loaded, so that the user can view the one-time credit report.

[0071] The decryption method is determined by those skilled in the art according to the encryption method and is not limited here.

[0072] In one embodiment, after the user logs in to the web page of the credit report query website, he enters the credit report viewing interface, and then clicks the "View Report" button on the credit report viewing interface. At this time, the web page will use the temporary authorization token corresponding to the user to generate a corresponding access report request and send it to the server. When the server receives the access report request, after parsing the temporary authorization token, it first verifies whether the temporary authorization token is valid, for example, whether the temporary authorization token is in the valid period; when it is valid, it verifies whether the signature contained in the temporary authorization token is correct to prevent the token from being tampered with; then, according to the permissions contained in the temporary authorization token, check the user information that initiates the access report request to confirm whether it is authorized to access the requested content; after passing all verifications, decrypt the temporary file corresponding to the access report request. After decrypting the temporary file, it can be transmitted to the web page using the Hypertext Transfer Protocol (HTTP protocol); according to the user information contained in the temporary authorization token, a one-time encryption stream of the decrypted temporary file can be dynamically generated, and the one-time encryption stream can be used for transmission to ensure that only the user corresponding to the user information can access the decrypted temporary file when logging in to the credit report query website.

[0073] In one embodiment, for users with online preview permissions, a one-time credit report can also be loaded immediately after the user clicks the "Apply for View" button, so as to control the user's privacy risk while preventing the user from being aware of the process of checking online preview permissions, generating temporary authorization tokens, encryption and decryption. Specifically, after generating a temporary authorization token, the server encrypts the original report data in real time, and during the validity period of the temporary authorization token, decrypts the encrypted temporary file data in real time, transmits the corresponding decrypted data to the web page in real time, and the web page dynamically displays the decrypted data received in real time.

[0074] Step 40: When the user finishes viewing the one-time credit report, the temporary file and the one-time credit report are deleted; when the temporary authorization token expires, the temporary authorization token is deleted.

[0075] After the one-time credit report preview is completed, the temporary files and related data involved in the one-time credit report will be cleared to ensure that the original report data is not stored or leaked.

[0076] During the validity period of the corresponding temporary authorization token, the user of the embodiment of the present invention can initiate an access report request to the server through the web page, and use the temporary authorization token to request the decrypted temporary file from the server and load the corresponding one-time credit report on the web page; after the temporary authorization token expires, it cannot be previewed online; if online preview is still needed in the future, it is necessary to re-initiate a preview report request, generate a new temporary authorization token, and use the new temporary authorization token to generate a new temporary file and a one-time credit report.

[0077] In one embodiment, when a temporary authorization token is generated, a validity period can be set for it, for example, a validity period of half an hour. The user can also set the validity period and / or the access rights to the credit report previewed online. The user can also set the temporary authorization token to an invalid state at any time to immediately revoke the sharing rights of the credit report. No user can view the decrypted temporary file anymore, and then the new rights are pushed to the web page through the background through a dynamic refresh mechanism, allowing the user to change the rights within the validity period of the token; in addition, when the background system detects a change in sensitive rights, it automatically cancels the original temporary authorization token and regenerates a new temporary authorization token.

[0078] After the temporary authorization token expires, the server automatically deletes the temporary authorization token to prevent the temporary authorization token from being stored for a long time, thereby minimizing the risk of leakage of the original report data.

[0079] The present invention adopts a temporary authorization preview method. When a user with online preview authority initiates a preview report request, a temporary authorization token and an encrypted temporary file are generated, and the access time and authority to the temporary file are controlled by the temporary authorization token. When a user initiates a request to access the report, the temporary authorization token is used to ensure that only authorized users can preview the decrypted one-time credit report within the specified time, thereby achieving the purpose of strictly controlling the preview time and scope of temporary files, effectively avoiding long-term storage and abuse of static files, thereby reducing the risk of user privacy leakage, and solving the problem that the content of static files downloaded to local storage devices may be easily read by unauthorized users.

[0080] If the amount of original report data is large, encryption may cause excessive computing resource usage and affect overall performance. To solve this problem, Figure 2 As shown, in step 20, when a temporary authorization token needs to be generated, the original report data is encrypted to obtain a temporary file including:

[0081] Step 101: Divide the original report data into a plurality of segment report data.

[0082] The method for dividing the original report data is selected by technical personnel in this field according to the specific usage scenario and experience, and is not limited here.

[0083] Step 102: Determine the encryption method of the fragment report data according to the data sensitivity level.

[0084] Among them, the method of dividing data sensitivity levels and the encryption method for each data sensitivity level are determined by technical personnel in this field based on specific usage scenarios and experience.

[0085] Step 103: Encrypt each of the fragment report data according to a corresponding encryption method to obtain a plurality of encrypted data.

[0086] Step 104: Combine the encrypted data to obtain a temporary file.

[0087] The embodiment of the present invention performs fragmented encryption on the original report data, and improves performance by encrypting multiple fragmented report data in parallel, so as to reduce the load pressure of a single encryption and avoid performance bottlenecks caused by encryption when the original report data is too large. In addition, in order to reduce the load pressure of encryption processing, different encryption algorithms are selected according to the data sensitivity level of each fragmented report data; for example, for data with a higher data sensitivity level, the Advanced Encryption Standard (AES) is used for encryption processing. AES is a symmetric encryption algorithm that uses a 256-bit key to encrypt and decrypt data; for ordinary data with a lower data sensitivity level, a lighter encryption method can be used, for example, an asymmetric encryption algorithm for encryption processing.

[0088] Embodiment 2:

[0089] The embodiment of the present invention provides a specific example of a temporary authorization token. The structure of the temporary authorization token includes a token header, a token payload, a token signature, and additional custom fields, as follows:

[0090] The token header mainly contains the meta information of the token, including the token type and signature algorithm.

[0091] Field Name Field Description type illustrate token_type Token Type String Identifies the type of token. alg Signature Algorithm String The signature algorithm used by the token

[0092] The token payload contains the actual authorization data, namely important parameters such as user information, file information, permission control, and validity period.

[0093]

[0094]

[0095] The token signature is the core of the token and is used to prevent the token from being tampered with. The token signature is used to encrypt the token header and payload content; in one embodiment, the encryption process can be achieved through a hash algorithm and a key.

[0096]

[0097] To support more complex scenarios, the temporary authorization token can also contain other additional custom fields. The following are some optional fields:

[0098]

[0099] Embodiment 3:

[0100] The embodiment of the present invention provides a specific example of encrypting a temporary authorization token.

[0101] First, collect the basic parameters of the temporary authorization token, including user ID, file ID, request time, and permission information. Set the validity period (valid for 30 minutes), access rights, and environmental constraints (i.e., IP addresses and device types allowed to access) according to the authorization content.

[0102] A pair of 256-bit AES keys are then randomly generated, which will be used to encrypt the sensitive contents of the temporary authorization token as follows:

[0103] from Crypto.Cipher import AES

[0104] from Crypto.Random import get_random_bytes

[0105] aes_key = get_random_bytes(32) #256-bit AES key

[0106] cipher_aes=AES.new(aes_key,AES.MODE_EAX)

[0107] ciphertext,tag=cipher_aes.encrypt_and_digest(b"Sensitive Data")

[0108] The generated AES key is then used to encrypt the sensitive data in the token (i.e., user ID, file ID, and permission information). The AES key is encrypted using RSA to ensure the security of the key; the AES key itself is also encrypted during transmission, as follows:

[0109] from Crypto.PublicKey import RSA

[0110] from Crypto.Cipher import PKCS1_OAEP

[0111] #Encrypt AES key

[0112] rsa_key=RSA.import_key(open('public_key.pem').read())

[0113] cipher_rsa=PKCS1_OAEP.new(rsa_key)

[0114] enc_aes_key=cipher_rsa.encrypt(aes_key)

[0115] The hash value is calculated for the entire content of the temporary authorization token (including the encrypted data and the encrypted AES key), and a digital signature is generated, as follows:

[0116] from Crypto.Signature import pkcs1_15

[0117] from Crypto.Hash import SHA256

[0118] # Calculate the hash

[0119] data_to_sign=ciphertext+enc_aes_key#data to be signed

[0120] hash_obj=SHA256.new(data_to_sign)

[0121] #Sign with private key

[0122] signature=pkcs1_15.new(private_key).sign(hash_obj)

[0123] Return Token:

[0124] The encrypted token (including the encrypted AES key, encrypted data, signature, etc.) is packaged and securely transmitted to the client via the HTTPS protocol.

[0125]

[0126] The embodiment of the present invention also provides a specific example of performing token verification and access control on a temporary authorization token.

[0127] When the server receives the access report request, it performs the following steps to verify the validity of the temporary authorization token:

[0128] (1) Decrypt the transmitted encrypted AES key.

[0129] #Decrypt the AES key using the private key

[0130] cipher_rsa=PKCS1_OAEP.new(private_key)

[0131] decrypted_aes_key=cipher_rsa.decrypt(enc_aes_key)

[0132] (2) Use the decrypted AES key to decrypt the sensitive content (user ID, file ID, permission information) in the temporary authorization token.

[0133] #Decrypt the temporary authorization token content

[0134] cipher_aes=AES.new(decrypted_aes_key,AES.MODE_EAX,nonce=ciphertext[:16])

[0135] decrypted_data=cipher_aes.decrypt_and_verify(ciphertext[16:],tag)

[0136] (3) Use the public key to verify the signature of the temporary authorization token to ensure that the data has not been tampered with.

[0137] #Verify the signature

[0138] hash_obj=SHA256.new(decrypted_data)

[0139] pkcs1_15.new(public_key).verify(hash_obj,signature)

[0140] (4) Verify that the temporary authorization token is within the validity period. If the temporary authorization token expires, access is denied.

[0141] if datetime.utcnow()>expiration:

[0142] raise TokenExpiredError("Token expired.")

[0143] (5) Check the user's access rights and restrict corresponding operations if the rights do not meet the requirements.

[0144] if not check_permission(decrypted_data,requested_action):

[0145] raise PermissionDeniedError("Permission denied.")

[0146] Embodiment 4:

[0147] like Figure 3 As shown, the embodiment of the present invention provides a specific example of a method for online previewing of a credit report.

[0148] First, user identity authentication is performed, and the steps are as follows: Step (1): The user first verifies his identity through his mobile phone number, and the credit report query website verifies his identity through a text message verification code or other authentication methods.

[0149]

[0150]

[0151] Step (2): After the user passes the login verification and enters the platform, he or she can choose to query historical reports, preview reports, etc.

[0152] Next, when the user initiates an access report request, the server receives the access report request and parses it to confirm the file information and other related parameters requested by the user. The format of the access report request is as follows:

[0153] User information (UserID)

[0154] File Information (FileID)

[0155] Other request parameters (including access method, time range, environment, etc.)

[0156]

[0157] After the server receives the access report request, it first needs to verify whether the user's identity is legal and check whether the user has the file corresponding to the temporary authorization token. The verification process is as follows:

[0158]

[0159]

[0160] After user identity authentication and permission verification are passed, a temporary authorization token is generated based on parameters such as user information and file information, including the following steps: Step (1): Generation of dynamic authorization tokens collects information from multiple parameters: user information: user ID (used to uniquely identify the user); file information: file ID, version number; time information: token generation time and expiration time; permission information: access rights; device information: restrict device access, IP address.

[0161] import timefrom uuid import uuid4

[0162] #Collect raw report data requested by the user

[0163] user_id=user_request["userID"]

[0164] file_id=user_request["fileID"]

[0165] timestamp = int (time.time()) # Current timestamp

[0166] random_str=str(uuid4())#Random string enhances uniqueness

[0167] #Set the token validity period (30 minutes)

[0168] expiration_time = timestamp + 1800 # 30 minutes

[0169] #Build token data

[0170] raw_token_data=f"{user_id}{file_id}{timestamp}{random_str}"

[0171] Step (2): Calculate the hash value of the entire temporary authorization token content (including the encrypted data and the encrypted AES key) and generate a digital signature.

[0172]

[0173] Step (3): The generated temporary authorization token is stored in the cache system and its validity period is set.

[0174] import redis

[0175] #Store the token in Redis and set the token expiration time

[0176] redis_client=redis.StrictRedis(host='localhost',port=6379,db=0)

[0177] #Store the token and set the expiration time (30 minutes)

[0178] redis_client.setex(f"token_{user_id}_{file_id}",1800,str(final_token))

[0179] When a temporary authorization token is generated, a temporary file is generated and encrypted for transmission, the steps are as follows: Step (1): Based on the user's preview report request and file ID, the relevant credit report is queried from the database, and the original report data of the credit report is encrypted and then transmitted via the HTTPS protocol to ensure the security of the transmission process.

[0180]

[0181] cipher=AES.new(key,AES.MODE_CBC)

[0182] encrypted_file=cipher.encrypt(pad(file_content.encode(),AES.block_size))

[0183] #Transfer the encrypted file via HTTPS

[0184] def send_encrypted_file_to_user(user_id,file_id,encrypted_file):

[0185] url="https: / / securefileservice.com / preview / {user_id} / {file_id}"

[0186] response=requests.post(url,data={"file":encrypted_file})

[0187] return response.status_code

[0188] #Send encrypted temporary file

[0189] send_encrypted_file_to_user(user_id,file_id,encrypted_file)

[0190] When a user attempts to access a credit report, a temporary authorization token is extracted from the access report request and the validity of the temporary authorization token is verified.

[0191] def validate_token(user_id,file_id,token):

[0192] #Get the token from Redis

[0193] stored_token=redis_client.get(f"token_{user_id}_{file_id}")

[0194] if not stored_token:

[0195] raise PermissionError("The token is invalid or expired")

[0196] #Verify token signature

[0197] encrypted_token=stored_token["encrypted_token"]

[0198] expected_signature=hashlib.sha256(encrypted_token).hexdigest()

[0199] if stored_token["signature"]! =expected_signature:

[0200] raise PermissionError("Token signature verification failed")

[0201] #Check whether the temporary authorization token is within the validity period

[0202] if int(time.time())>stored_token["expiration_time"]:

[0203] raise PermissionError("Token has expired")

[0204] return True

[0205] Dynamically load original report data and restrict user permissions based on the authorization information in the temporary authorization token.

[0206] / / Front-end implementation: Dynamically load report const token = getCookie("auth_token"); if(token){

[0207]

[0208] When the temporary authorization token expires, it will automatically become invalid and the user will be unable to access the report.

[0209]

[0210] Users can manually revoke access to their credit reports, rendering the temporary authorization token invalid immediately.

[0211] def revoke_token(user_id,file_id):

[0212] redis_client.delete(f"token_{user_id}_{file_id}")

[0213] print(f"The token has been revoked, user {user_id} can no longer access file {file_id}")

[0214] Notify users via messages about access and revocation reports, including token expiration, access logs, unusual behavior, etc.

[0215]

[0216] In addition, each time a user accesses a credit report, the information is recorded, including access time, content, operation behavior, etc.

[0217]

[0218] Embodiment 5:

[0219] Users often log in to the credit report query website through personal computers and other devices. However, since such devices do not have external cameras, they are often unable to capture whether the one-time credit report display interface has been illegally collected. In order to further reduce the risk of user privacy leakage and prevent the original report data in the credit report from being easily read by unauthorized users, this embodiment uses mobile terminal devices to display the original report data with a higher data sensitivity level; wherein mobile terminal devices include mobile phones and tablets. Specifically, the online preview permissions include basic information permissions and sensitive information permissions; the temporary authorization token includes a web-side token and a mobile-side token; the temporary files include web-side temporary files and mobile-side temporary files. Figure 4 As shown, in step 10, when the user initiates a request to preview the report, determining whether the user has online preview permission to generate a temporary authorization token when the user has online preview permission includes:

[0220] Step 201: When a user initiates a request to preview a report, it is checked whether the user has basic information authority according to access authority rules.

[0221] Among them, the access permission rules are used to: (1) check whether the account password and other information of the user who initiated the preview report request is legal; (2) specify the identity of at least one user who can access the original report data. The specific access permission rules are selected by technical personnel in this field according to the specific usage scenario. In one embodiment, the user to whom the original report data belongs (i.e., the personal credit report of which user the original report data belongs) is obtained, and the access permission rules are: the user who initiated the preview report request is the user to whom the original report data belongs, as well as the spouse, children and parents of the user; when receiving the preview report request, first check whether the account password and other information of the user who initiated the preview report request is legal. If legal, then check whether the identity relationship between the user who initiated the preview report request and the user to whom the original report data belongs complies with the access permission rules; when it complies with the access permission rules, the user who initiated the preview report request has the basic information permission of the original report data; when it does not comply with the access permission rules, the user who initiated the preview report request does not have the basic information permission of the original report data.

[0222] Step 202: When the user has basic information authority, obtain the fragment report data with a data sensitivity level less than the level threshold from the multiple fragment report data of the original report data, obtain the web page data to be encrypted, and generate a corresponding web page token for the web page data to be encrypted, so as to encrypt the web page data to be encrypted and obtain a temporary file on the web page.

[0223] The fragment report data with a data sensitivity level less than the level threshold may include: user name, gender, education level, height, etc. The level threshold is selected by those skilled in the art according to the specific usage scenario. In one embodiment, the data sensitivity level of the fragment report data may be divided into 1 to 3 levels, and the level threshold may be 2.

[0224] Step 203: Check whether the user has permission to obtain sensitive information; when the user has permission to obtain sensitive information, determine the fragment report data with a data sensitivity level greater than or equal to the level threshold, and the fragment report data containing the user's basic information, as mobile data to be encrypted, and generate a corresponding mobile token for the mobile data to be encrypted, so as to facilitate encryption processing of the mobile data to be encrypted and obtain a mobile temporary file.

[0225] The fragment report data with a data sensitivity level greater than or equal to the level threshold may include: user's credit information, property information and transaction information, etc. The fragment report data containing user basic information refers to: fragment report data with a data sensitivity level less than the level threshold but can identify the user's identity, such as the user's name. Since this embodiment will display the content of the mobile terminal temporary file for the user on the mobile terminal device, in order to facilitate the user to view, the user's basic information is also required.

[0226] The checking whether the user has sensitive information permission includes: obtaining the current account information of the user, and when the current account information matches the real-name account information corresponding to the original report data, determining that the user has sensitive information permission. In this embodiment, real-name authentication is performed on each user, and a preliminary check is performed to determine whether the user who initiates the preview report request is the user to which the original report data belongs, that is, to determine whether the user who wants to preview online is the user himself; for any fragment report data whose data sensitivity level is greater than or equal to the level threshold, only the user corresponding to the fragment report data can preview online.

[0227] To illustrate the process of loading a one-time credit report on a mobile terminal device, Figure 5 As shown, in step 30, when the user initiates a request to access the report, decrypting the temporary file according to the temporary authorization token and loading the one-time credit report includes:

[0228] Step 301: When the web page token is valid, the web page temporary file is decrypted to obtain the decrypted web page data, so as to load a one-time credit report corresponding to the decrypted web page data on the credit report display web page.

[0229] Among them, the server determines whether the web page token is valid based on whether the web page token is within the validity period. This process is the same as the process of determining whether the temporary authorization token is valid; the process of decrypting temporary files on the web page is also the same as the process of decrypting temporary files, which will not be repeated here.

[0230] Step 302: Prompt the user to log in on the mobile terminal device, so that when the mobile token is valid, the mobile temporary file is received on the mobile terminal device, the mobile temporary file is decrypted, the mobile decrypted data is obtained, and a one-time credit report corresponding to the mobile decrypted data is loaded on the mobile terminal device.

[0231] In one embodiment, after the user logs in to the web page of the credit report query website through a personal computer, he enters the credit report viewing interface and then clicks the "View Report" button on the credit report viewing interface. At this time, the server decrypts the corresponding web page temporary file and sends it to the web page to load the one-time credit report corresponding to the web page temporary file on the web page. A prompt message pops up on the web page, "Sensitive data can only be viewed through the mobile application. Please confirm whether this account is logged in to the mobile application." The server directly transmits the mobile temporary file data to the mobile phone, which decrypts the mobile temporary file and loads the corresponding one-time credit report for the user to browse.

[0232] This embodiment uses the camera of the mobile terminal device to prevent the one-time credit report displayed on the mobile terminal from being illegally collected; since the current mobile terminal applications of personal credit reporting and related credit products are all prohibited from taking screenshots, illegal collection can only be achieved by a third party other than the user peeking at the one-time credit report display interface or taking a photo of the one-time credit report display interface. In order to prevent user privacy from being leaked through such illegal collection methods, such as Figure 6 As shown, the credit report online preview method of the embodiment of the present invention also includes:

[0233] Step 401: When the mobile terminal device receives the mobile temporary file, the front camera of the mobile terminal device is started.

[0234] Step 402: When the front camera has only the unique authorized face corresponding to the real-name face information of the user within its acquisition range, a one-time credit report corresponding to the mobile decrypted data is displayed.

[0235] In an embodiment of the present invention, when the mobile terminal device receives the mobile temporary file, it immediately starts the front camera of the mobile terminal device, and obtains the current facial information within the collection range through the front camera; obtains the user to whom the original report data belongs, and the real-name facial information of the user. Only when the current facial information contains only one facial information, and the current facial information matches the real-name facial information, the one-time credit report corresponding to the mobile decrypted data is displayed on the mobile terminal device for the first time. Subsequently, the one-time credit report can only be displayed on the mobile terminal device on the premise that the current facial information collected in real time contains only one facial information, and the current facial information matches the real-name facial information; whenever the current facial information collected in real time contains more than one facial information, and / or the current facial information does not match the real-name facial information, the one-time credit report corresponding to the mobile decrypted data is immediately coded and / or blurred.

[0236] Specifically, Figure 7 As shown, in step 402, when there is only a unique authorized face corresponding to the real-name face information of the user within the acquisition range of the front camera, displaying the one-time credit report corresponding to the mobile decrypted data includes:

[0237] Step 501: When there is only a unique authorized face corresponding to the real-name facial information within the collection range, and the unique authorized face is effectively observing the screen of the mobile terminal device, a one-time credit report corresponding to the mobile decrypted data is displayed.

[0238] Among them, when there is only the unique authorized face corresponding to the real-name facial information within the collection scope, that is, only the unique authorized face can be collected, there is no other face within the collection scope, and there is no electronic device (such as a mobile phone, camera, etc.).

[0239] In one embodiment, the method for judging whether the unique authority face is effectively observing the screen of the mobile terminal device can be as follows: tracking the unique authority face through the front camera and capturing its eyes; in the process of displaying the one-time credit report corresponding to the mobile decrypted data, when the unique authority face cannot be captured within the collection range, and / or when the eye line of the unique authority face is not within the range of the screen, coding and / or blurring the corresponding one-time credit report; until only the unique authority face is within the collection range and the eye line of the person is within the range of the screen, the corresponding one-time credit report is displayed again.

[0240] Step 502: When more than one face can be captured within the acquisition range, the one-time credit report corresponding to the mobile decrypted data is coded and / or blurred.

[0241] When other faces disappear from the collection range, that is, the collection range is changed back to a state where there is only the unique authorized face, and the unique authorized face is effectively observing the screen of the mobile terminal device, the one-time credit report is clearly displayed on the one-time credit report display interface again.

[0242] Step 503: When any other electronic device can be captured within the collection range, the one-time credit report corresponding to the mobile decrypted data is coded and / or blurred.

[0243] Among them, other electronic devices refer to: electronic devices other than the mobile terminal device that is displaying the one-time credit report; since the front cameras of some mobile terminal devices (for example, folding-screen mobile phones) may capture themselves, only when other electronic devices are captured within the collection range, will the other electronic devices be deemed to be suspected of illegally collecting data in the one-time credit report display interface.

[0244] When other electronic devices disappear from the collection range, that is, the collection range is changed back to a state where only the unique authorized face is within the collection range, and the unique authorized face is effectively observing the screen of the mobile terminal device, the one-time credit report is clearly displayed again on the one-time credit report display interface.

[0245] Embodiment 6:

[0246] like Fig. 9 , which is a schematic diagram of the structure of the online credit report preview device according to an embodiment of the present invention. The online credit report preview device according to this embodiment includes one or more processors 21 and a memory 22. Fig. 9 A processor 21 is taken as an example.

[0247] The processor 21 and the memory 22 may be connected via a bus or other means. Fig. 9 The example of connecting through bus is taken in the following.

[0248] The memory 22 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs and non-volatile computer executable programs, such as the online credit report preview method in this embodiment. The processor 21 executes the online credit report preview method by running the non-volatile software programs and instructions stored in the memory 22.

[0249] The memory 22 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage devices. In some embodiments, the memory 22 may optionally include a memory remotely arranged relative to the processor 21, and these remote memories may be connected to the processor 21 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0250] The program instructions / modules are stored in the memory 22, and when executed by the one or more processors 21, the online credit report preview method in the above-mentioned embodiment is executed, for example, each step of the online credit report preview method in the embodiment of the present invention described above is executed.

[0251] An embodiment of the present invention further provides a non-volatile computer storage medium, wherein the computer storage medium stores computer executable instructions, and the computer executable instructions are executed by one or more processors, such as Fig. 9 A processor 21 can enable the one or more processors to execute the online credit report preview method in the specific implementation of the present invention, for example, to execute the various steps of the online credit report preview method in the embodiment of the present invention described above; it can also realize Fig. 9 The modules and units described above; or executing the online credit report preview method in the specific implementation mode of the present invention, for example, executing the various steps of the online credit report preview method in the embodiment of the present invention described above; or realizing Fig. 9 The various modules and units described.

[0252] It is worth noting that the information interaction, execution process, etc. between the modules and units within the above-mentioned devices and systems are based on the same concept as the processing method embodiment of the present invention. The specific contents can be found in the description of the method embodiment of the present invention and will not be repeated here.

[0253] A person skilled in the art may understand that all or part of the steps in the various methods of the embodiments may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the storage medium may include: a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc.

[0254] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A credit report online preview method, characterized in that: include: When a user initiates a request to preview a report, determining whether the user has online preview permission, and generating a temporary authorization token if the user has online preview permission; When a temporary authorization token needs to be generated, the original report data is encrypted to obtain a temporary file; When the user initiates a request to access the report, the temporary file is decrypted according to the temporary authorization token, and the one-time credit report is loaded, so that the user can view the one-time credit report; When the user finishes viewing the one-time credit report, deleting the temporary file and the one-time credit report; When the temporary authorization token expires, the temporary authorization token is deleted.

2. The online credit report preview method according to claim 1, characterized in that: The online preview permissions include basic information permissions and sensitive information permissions; the temporary authorization tokens include web page tokens and mobile terminal tokens; the temporary files include web page temporary files and mobile terminal temporary files; When the user initiates a request for previewing the report, determining whether the user has online preview authority to generate a temporary authorization token when the user has online preview authority includes: When a user initiates a request to preview a report, it is checked whether the user has basic information permissions according to the access permission rules; When the user has basic information authority, the fragment report data with a data sensitivity level less than the level threshold is obtained from the multiple fragment report data of the original report data to obtain the web page data to be encrypted, and a corresponding web page token is generated for the web page data to be encrypted, so as to encrypt the web page data to be encrypted and obtain a web page temporary file; Check whether the user has permission to sensitive information; when the user has permission to sensitive information, determine the fragment report data with a data sensitivity level greater than or equal to the level threshold, and the fragment report data containing the user's basic information as mobile data to be encrypted, and generate a corresponding mobile terminal token for the mobile data to be encrypted, so as to facilitate the encryption processing of the mobile data to be encrypted and obtain a mobile terminal temporary file.

3. The online credit report preview method according to claim 2, characterized in that: The checking whether the user has sensitive information permission includes: The current account information of the user is obtained, and when the current account information matches the real-name account information corresponding to the original report data, it is determined that the user has sensitive information permission.

4. The online credit report preview method according to claim 2, characterized in that: When the user initiates a request to access the report, decrypting the temporary file according to the temporary authorization token and loading the one-time credit report includes: When the web page token is valid, decrypt the web page temporary file to obtain the web page decrypted data, so as to load a one-time credit report corresponding to the web page decrypted data on the credit report display web page; The user is prompted to log in on the mobile terminal device, so that when the mobile token is valid, the mobile temporary file is received on the mobile terminal device, the mobile temporary file is decrypted, the mobile decrypted data is obtained, and a one-time credit report corresponding to the mobile decrypted data is loaded on the mobile terminal device.

5. The online credit report preview method according to claim 4, characterized in that: Also includes: When the mobile terminal device receives the mobile terminal temporary file, starting the front camera of the mobile terminal device; When there is only a unique authorized face corresponding to the real-name facial information of the user within the collection range of the front camera, a one-time credit report corresponding to the mobile decrypted data is displayed.

6. The online credit report preview method according to claim 5, characterized in that: When there is only a unique authorized face corresponding to the real-name face information of the user within the acquisition range of the front camera, displaying a one-time credit report corresponding to the mobile decrypted data includes: When there is only a unique authorized face corresponding to the real-name facial information within the collection range, and the unique authorized face is effectively observing the screen of the mobile terminal device, a one-time credit report corresponding to the mobile decrypted data is displayed; When more than one face can be captured within the collection range, the one-time credit report corresponding to the mobile decrypted data is coded and / or blurred; When any other electronic device can be captured within the collection range, the one-time credit report corresponding to the mobile decrypted data is coded and / or blurred.

7. The online credit report preview method according to claim 6, characterized in that: Tracking the unique authorized person's face through the front camera and capturing its eyes; When there is only a unique authorized face corresponding to the real-name facial information within the collection range, and the unique authorized face is effectively observing the screen of the mobile terminal device, displaying a one-time credit report corresponding to the mobile decrypted data includes: During the process of displaying the one-time credit report corresponding to the mobile decrypted data, when the unique authorized face cannot be captured within the collection range, and / or when the eye line of sight of the unique authorized face is not within the range of the screen, the corresponding one-time credit report is coded and / or blurred; until only the unique authorized face is within the collection range and the eye line of sight is within the range of the screen, the corresponding one-time credit report is displayed again.

8. The online credit report preview method according to any one of claims 1 to 7, characterized in that: When a temporary authorization token needs to be generated, the original report data is encrypted to obtain a temporary file including: Dividing the original report data into a plurality of segment report data; Determining an encryption method for the fragment report data according to the data sensitivity level; According to the corresponding encryption method, each of the fragment report data is encrypted to obtain a plurality of encrypted data; The encrypted data are combined to obtain a temporary file.

9. A credit report online preview device, characterized in that: The online credit report preview device includes at least one processor and a memory, and the at least one processor and the memory are connected via a data bus. The memory stores instructions that can be executed by the at least one processor. After being executed by the processor, the instructions are used to implement the online credit report preview method described in any one of claims 1-8.

10. A non-volatile computer storage medium, characterized in that: The computer storage medium stores computer executable instructions, and the computer executable instructions are executed by one or more processors to complete the credit report online preview method described in any one of claims 1-8.

Images