Network trusted identity mutual recognition method based on network identity application identifier conversion

Abstract

The invention discloses a network credible identity mutual recognition method based on network identity application identifier conversion, which can complete network identity application identifier conversion among different application mechanisms, and can control the range of a source mechanism and a destination mechanism of conversion through a software license mode. According to the invention, a traditional method of using personal identity information to carry out series business service between application mechanisms is changed, and the application mechanisms are prevented from associating and aggregating personal information data while the whole industrial chain is assisted to get through.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a network trusted identity mutual recognition method based on network identity application identifier conversion. Background Art

[0002] The network identity application identifier is generated by the network identity authentication public service platform and can be used by application access institutions to associate natural persons with codes. The network identity application identifiers of the same natural person in different application access institutions are different. The network identity authentication public service provides natural persons with services such as applying for network numbers, network certificates, and identity verification.

[0003] In recent years, in order to prevent the theft of network activity logs and conduct serial analysis of personal network behavior, the network identity authentication public service will return a network identity application identifier after verifying the identity of a natural person. The network identity application identifiers of the same person in different application agencies are different.

[0004] At present, network business connections are basically carried out using personal mobile phone numbers or citizen ID numbers, resulting in serious leakage of citizens' personal information. This abuse of private information also provides the possibility for various types of targeted telecommunications network fraud. The identity authentication system provided by the network identity authentication public service solves the problem of personal identity information leakage and realizes the isolation of personal identity information between commercial organizations. However, since the network identity application identifiers of the same natural person in different application organizations are different, when different application organizations need to share or circulate information, they cannot confirm that it is the same person, which affects the interoperability of some cross-institutional or cross-industry businesses. Summary of the invention

[0005] In view of the deficiencies in the prior art, the present invention aims to provide a network trusted identity mutual recognition method based on network identity application identifier conversion.

[0006] In order to achieve the above object, the present invention adopts the following technical solution:

[0007] A network trusted identity mutual recognition method based on network identity application identification conversion, including two processes of initialization and mutual recognition;

[0008] A. Initialization:

[0009] A1. The network identity application identification conversion system uses the key management module and the signature verification algorithm to import and store the key of the application organization;

[0010] A2. The network identity application conversion system uses the Liscense management module to import and store the authorization license Liscense using the signature verification algorithm. The Liscense exists in the form of a file and is used to clearly identify the source and destination institutions that have obtained the license for identity conversion, including the source institution ID and the destination institution ID.

[0011] B. Mutual Recognition:

[0012] B1. When mutual recognition of network trusted identities is required, the business system of the application institution sends a conversion request to the network identity application identifier conversion system, requesting to convert the network identity application identifier of the user at the source institution into the network identity application identifier of the user at the target institution; the conversion request includes the source institution ID, the target institution ID and the network identity application identifier of the source institution;

[0013] B2. The network identity application identification conversion system compares the source organization ID and the target organization ID contained in the conversion request with the stored Liscense file. If a pair of source organization ID and target organization ID that are authorized to perform identification conversion can be accurately matched in the Liscense file, it means that the permission has been obtained, and then proceed to step B3;

[0014] B3. The network identity application identifier conversion system uses the conversion algorithm module to convert the network identity application identifier of the user at the source institution, obtains the converted network identity application identifier of the target institution and outputs it to the business system of the application institution;

[0015] B4. The business system of the application organization compares the network identity application identifier of the known user in the target organization with the network identity application identifier of the target organization converted by the network identity application identifier conversion system. If the comparison is successful, it is considered that the network identity application identifier of the user in the source organization and the network identity application identifier in the target organization correspond to the same user.

[0016] Furthermore, in step B4, the conversion algorithm module mathematically transforms the source organization ID and the target organization ID in the conversion request through an algorithm to generate the source organization's organization key index and the target organization's organization key index respectively, and then uses the source organization's organization key to decrypt and mathematically transform the source organization's network identity application identifier to obtain an intermediate data, and then uses the target organization's organization key to encrypt the intermediate data, and finally outputs the target organization's network identity application identifier.

[0017] Furthermore, the step B1 and the step B4 are completed in the business system of the same application institution or in the business systems of different application institutions.

[0018] The beneficial effects of the present invention are as follows: the method of the present invention can be used to complete the conversion of network identity application identifiers between different application organizations, and the scope of the source organization and the destination organization of the conversion can be controlled by software licensing. The present invention changes the traditional practice of using personal identity information between application organizations to provide serial business services, prevents application organizations from associating and aggregating personal information data, and helps to open up the entire industry chain. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 is a flow chart of the method of embodiment 1 of the present invention;

[0020] Figure 2 is a flow chart of the method of embodiment 2 of the present invention;

[0021] Figure 3 This is a flow chart of the method of Embodiment 3 of the present invention;

[0022] Figure 4 is a flow chart of the method of embodiment 4 of the present invention;

[0023] Figure 5 is a flow chart of the method of embodiment 5 of the present invention;

[0024] Figure 6 This is a flow chart of the method of Example 6 of the present invention. DETAILED DESCRIPTION

[0025] The present invention will be further described below in conjunction with the accompanying drawings. It should be noted that this embodiment is based on the technical solution and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to this embodiment.

[0026] Example 1

[0027] like Figure 1 As shown, a network trusted identity mutual recognition method based on network identity application identification conversion includes two processes: initialization and mutual recognition.

[0028] A. Initialization:

[0029] A1. The network identity application identification conversion system uses the key management module and the signature verification algorithm to import and store the key of the application organization;

[0030] A2. The network identity application conversion system uses the Liscense management module and the signature verification algorithm to import and store the authorized license Liscense; Liscense exists in the form of a file and is used to clearly identify the source and destination institutions that have obtained permission for identity conversion, including the source institution ID and the destination institution ID.

[0031] B. Mutual Recognition:

[0032] B1. When mutual recognition of network trusted identities is required, the business system of the application organization sends a conversion request to the network identity application identifier conversion system, requesting to convert the network identity application identifier of the user in the source organization into the network identity application identifier of the user in the target organization. The conversion request includes the source organization ID, the target organization ID, and the network identity application identifier of the source organization. The returned data is the converted target organization ID.

[0033] B2. The network identity application conversion system compares the source organization ID and target organization ID contained in the conversion request with the stored Liscense file. If a pair of source organization ID and target organization ID that have obtained permission for identity conversion can be accurately matched in the Liscense file, it means that permission has been obtained, and then proceed to step B3.

[0034] B3. The network identity application identification conversion system uses the conversion algorithm module to convert the network identity application identification of the user in the source institution, obtains the converted network identity application identification of the target institution and outputs it to the business system of the application institution. Specifically, the conversion algorithm module uses the algorithm to mathematically transform the source institution ID and the target institution ID in the conversion request to generate the source institution's institution key index and the target institution's institution key index respectively, and then uses the source institution's institution key to decrypt and mathematically transform the source institution's network identity application identification to obtain an intermediate state data, and then encrypts the intermediate state data with the target institution's institution key, and finally outputs the target institution's network identity application identification.

[0035] B4. The business system of the application organization compares the network identity application identifier of the known user in the target organization with the network identity application identifier of the target organization converted by the network identity application identifier conversion system. If the comparison is successful, it is considered that the network identity application identifier of the user in the source organization and the network identity application identifier in the target organization correspond to the same user.

[0036] The steps B1 and B4 can be completed in the business system of the same application organization or in the business systems of different application organizations.

[0037] Example 2

[0038] This embodiment provides an example of the application of the method of Embodiment 1 in the mutual recognition of identity in one-to-one cross-institutional business handling. Figure 2 shown.

[0039] 1. The user performs identity authentication at application institution A. After successful authentication, the network identity authentication public service platform returns the user's network identity application identifier ID1 at application institution A.

[0040] 2. The user performs identity authentication at application institution B. After successful authentication, the network identity authentication public service platform returns the user's network identity application identifier ID2 at application institution B.

[0041] 3. When a user handles the business of application institution A across institutions in the business system of application institution B, it is necessary to confirm whether ID1 and ID2 correspond to the same user. The business system of application institution B sends a network trusted identity mutual recognition request to the business system of application institution A. The request data should include the user's network identity application identifier ID2 in application institution B.

[0042] 4. The business system of application organization A sends a conversion request to the network identity application identifier conversion system, and sends the user's network identity application identifier ID2 in application organization B to the network identity application identifier conversion system. The network identity application identifier conversion system determines whether it has permission to convert the network identity application identifier of application organization B to the network identity application identifier of application organization A. If it has permission, it uses the conversion algorithm module to convert ID2, and outputs the converted network identity application identifier, which is returned to the business system of application organization A.

[0043] 5. The business system of application organization A compares the received converted network identity application identifier with ID1. If they are consistent, it determines that ID1 and ID2 are the same user. The mutual recognition result is sent to application organization B.

[0044] Example 3

[0045] This embodiment provides an application example of the method of Embodiment 1 in identity mutual recognition for one-to-many cross-institution business processing.

[0046] The network identity application identifiers ID1, ID2, ID3, and ID4 are the data returned to the corresponding application institutions by the network identity authentication public service platform after the user has completed identity authentication at application institution A, application institution B, application institution C, and application institution D respectively and the authentication is successful. Users can handle the business of multiple application institutions across institutions in one application institution. The specific process is as follows:

[0047] 1. When a user in application institution A handles business with other application institutions across institutions, mutual recognition of the user's network trusted identity is required.

[0048] 2. The business system of application organization A initiates a network trusted identity mutual recognition request to the business systems of other application organizations.

[0049] 3. Application organization A obtains the user’s network identity application identifier from other application organizations.

[0050] like Figure 3 As shown, there are three scenarios in this embodiment.

[0051] Scenario 1: A user in application institution A handles the business of application institution B across institutions:

[0052] (311) The business system of application organization A sends a network trusted identity mutual recognition request to the business system of application organization B.

[0053] (312) The business system of application organization B returns the network identity application identifier ID2 to the business system of application organization A.

[0054] Scenario 2: A user in application institution A handles the business of application institution C across institutions:

[0055] (321) The business system of application organization A sends a network trusted identity mutual recognition request to the business system of application organization C.

[0056] (322) The business system of application organization C returns the network identity application identifier ID3 to the business system of application organization A.

[0057] Scenario 3: A user in application institution A handles the business of application institution D across institutions:

[0058] (331) The business system of application organization A sends a network trusted identity mutual recognition request to the business system of application organization D.

[0059] (332) The business system of application organization D returns the network identity application identifier ID4 to the business system of application organization A.

[0060] 4. The business system of application institution A sends a conversion request to the network identity application identification conversion system, requesting to convert the user's network identity application identification in other application institutions into the user's identification in application institution A:

[0061] (41) The business system of application institution A inputs the user's network identity application identifier of another application institution into the network identity application identifier conversion system, and the network identity application identifier conversion system completes the permission judgment and identifier conversion operation.

[0062] (42) The business system of application organization A obtains the converted identifier.

[0063] 5. The business system of application organization A compares the converted identifier with the user's known network identity application identifier ID1 in application organization A. If they are the same, it is determined that they are the same person, and the user's network identity mutual recognition is completed.

[0064] Example 4

[0065] This embodiment provides an application example of the method of Embodiment 1 in identity mutual recognition for many-to-one (single-end deployment) cross-institutional business processing.

[0066] The network identity application identifiers ID1, ID2, ID3, and ID4 are the data returned by the network identity authentication public service platform to the corresponding application institution after the user has successfully authenticated the identity in application institution A, application institution B, application institution C, and application institution D. Users can handle the business of the same application institution across multiple application institutions. The specific process is as follows:

[0067] 1. When a user handles the business of application institution A across other application institutions, mutual recognition of the user's network trusted identity is required.

[0068] 2. Other application organizations send a network trusted identity mutual recognition request and the user's network identity application identifier in this organization to application organization A.

[0069] like Figure 4 As shown, this embodiment includes multiple scenarios.

[0070] Scenario 1:

[0071] (211) The user handles the business of application organization A in the business system of application organization B.

[0072] (212) The business system of application organization B sends a network trusted identity mutual recognition request and the user's network identity application identifier ID2 in application organization B to the business system of application organization A.

[0073] Scenario 2:

[0074] (221) A user handles the business of application organization A in the business system of application organization C.

[0075] (222) The business system of application organization C sends a network trusted identity mutual recognition request and the user's network identity application identifier ID3 in application organization C to the business system of application organization A.

[0076] Scenario 3:

[0077] (231) A user conducts business with application organization A in the business system of application organization D.

[0078] (232) The business system of application organization D sends a network trusted identity mutual recognition request and the user's network identity application identifier ID4 in application organization D to the business system of application organization A.

[0079] 3. The business system of application institution A sends a conversion request to the network identity application identifier conversion system to convert the user's network identity application identifier in other application institutions into the user's network identity application identifier in application institution A:

[0080] (31) The business system of application institution A inputs the user's network identity application identifier of another application institution into the network identity application identifier conversion system, and the network identity application identifier conversion system performs identifier conversion after completing the permission judgment.

[0081] (32) The business system of application organization A obtains the converted network identity application identifier.

[0082] 4. The business system of application organization A compares the converted network identity application identifier with the user's known network identity application identifier in application organization A to complete the mutual recognition of user identity.

[0083] 5. The business system of application institution A returns the user identity mutual recognition result to the business system of the application institution that initiated the mutual recognition request.

[0084] Example 5

[0085] This embodiment provides an application example of the method described in Embodiment 1 in identity mutual recognition for many-to-one (multi-terminal deployment) cross-institutional business processing.

[0086] The network identity application identifiers ID1, ID2, ID3, and ID4 are the data returned by the network identity authentication public service platform to the corresponding application institution after the user has successfully authenticated the identity in application institution A, application institution B, application institution C, and application institution D. Users can handle the business of the same application institution across multiple application institutions. The specific process is as follows:

[0087] 1. When a user handles the business of application institution A across other application institutions, mutual recognition of the user's network trusted identity is required.

[0088] 2. The business systems of other application organizations initiate a network trusted identity mutual recognition request to the business system of application organization A.

[0089] 3. The business system of application organization A returns the user's network identity application identifier ID1 in application organization A to the business systems of other application organizations.

[0090] 4. The business systems of application institutions B / C / D send conversion requests to their respective network identity application identifier conversion systems, requesting to convert the network identity application identifier ID1 of the user in application institution A into the network identity application identifier of the user in this application institution.

[0091] 5. The business system of application organization B / C / D compares the converted network identity application identifier with the user's network identity application identifier ID2 / ID3 / ID4 in the application organization to complete the mutual recognition of the user's network identity.

[0092] Specific example scenarios such as Figure 5 As shown, a detailed description is given taking application mechanism B as an example:

[0093] (101) A user conducts business with application organization A in the business system of application organization B.

[0094] (102) The business system of application organization B initiates a network trusted identity mutual recognition request to the business system of application organization A.

[0095] (103) The business system of application organization A returns the user's network identity application identifier ID1 in application organization A to the business system of application organization B.

[0096] (104) The business system of application organization B completes the identity conversion through its corresponding network identity application identity conversion system.

[0097] (105) The business system of application organization B compares the converted network identity application identifier with the user's network identity application identifier ID2 in the application organization to complete the mutual recognition of user identities.

[0098] Example 6

[0099] This embodiment provides an application example of the method described in Embodiment 1 in identity mutual recognition for many-to-one (multi-terminal deployment) cross-institutional business processing.

[0100] Network identity application identifiers ID1, ID2, ID3, and ID4 are the data returned by the network identity authentication public service platform to the corresponding application institutions after the user has successfully authenticated the identity of the application institution A, application institution B, application institution C, and application institution D. Users can handle the business of the same application institution across multiple application institutions. The specific process is as follows:

[0101] 1. When a user handles the business of application institution A across other application institutions, mutual recognition of the user's network trusted identity is required.

[0102] 2. The business systems of other application organizations initiate a network trusted identity mutual recognition request to the business system of application organization A.

[0103] 3. The business system of application institution A sends a conversion request to the network identity application identifier conversion system, requesting to convert the network identity application identifier ID1 of the user in application institution A into the network identity application identifier of the user in other application institutions.

[0104] 4. Application organization A returns the converted network identity application identifier to the business system of the corresponding application organization.

[0105] 5. The business system of application organization B / C / D compares the network identity application identifier returned by application organization A with the user's network identity application identifier ID2 / ID3 / ID4 in this application organization to complete the mutual recognition of the user's network identity.

[0106] Specific example scenarios such as Figure 6 As shown, a detailed description is given by taking application mechanism C as an example:

[0107] (101) A user handles the business of application organization A in the business system of application organization C.

[0108] (102) The business system of application organization C initiates a network trusted identity mutual recognition request to the business system of application organization A.

[0109] (103) The business system of application organization A completes the identity conversion through the network identity application identity conversion system.

[0110] (104) The business system of application organization A returns the converted network identity application identifier ID3' to the business system of application organization C.

[0111] (105) The business system of application organization C compares the returned ID3' with the user's ID3 in the application organization to complete the mutual recognition of user identity.

[0112] For those skilled in the art, various corresponding changes and modifications can be made according to the above technical solutions and concepts, and all of these changes and modifications should be included in the protection scope of the claims of the present invention.

Claims

1. A network trusted identity mutual recognition method based on network identity application identifier conversion, characterized in that: Includes two processes: initialization and mutual recognition; A. Initialization: A1. The network identity application identification conversion system uses the key management module and the signature verification algorithm to import and store the key of the application organization; A2. The network identity application conversion system uses the Liscense management module to import and store the authorization license Liscense using the signature verification algorithm. The Liscense exists in the form of a file and is used to clearly identify the source and destination institutions that have obtained the license for identity conversion, including the source institution ID and the destination institution ID. B. Mutual Recognition: B1. When mutual recognition of network trusted identities is required, the business system of the application institution sends a conversion request to the network identity application identifier conversion system, requesting to convert the network identity application identifier of the user at the source institution into the network identity application identifier of the user at the target institution; the conversion request includes the source institution ID, the target institution ID and the network identity application identifier of the source institution; B2. The network identity application identification conversion system compares the source organization ID and the target organization ID contained in the conversion request with the stored Liscense file. If a pair of source organization ID and target organization ID that are authorized to perform identification conversion can be accurately matched in the Liscense file, it means that the permission has been obtained, and then proceed to step B3; B3. The network identity application identifier conversion system uses the conversion algorithm module to convert the network identity application identifier of the user at the source institution, obtains the converted network identity application identifier of the target institution and outputs it to the business system of the application institution; B4. The business system of the application organization compares the network identity application identifier of the known user in the target organization with the network identity application identifier of the target organization converted by the network identity application identifier conversion system. If the comparison is successful, it is considered that the network identity application identifier of the user in the source organization and the network identity application identifier in the target organization correspond to the same user.

2. The method according to claim 1, characterized in that In step B4, the conversion algorithm module mathematically transforms the source organization ID and the target organization ID in the conversion request through an algorithm to generate the source organization's organization key index and the target organization's organization key index respectively, and then uses the source organization's organization key to decrypt and mathematically transform the source organization's network identity application identifier to obtain an intermediate data, and then uses the target organization's organization key to encrypt the intermediate data, and finally outputs the target organization's network identity application identifier.

3. The method according to claim 1, characterized in that The steps B1 and B4 are completed in the business system of the same application organization or in the business systems of different application organizations.

Images