A network trusted identity mutual recognition method based on network identity application identification conversion

Abstract

The present invention discloses a network trusted identity mutual recognition method based on network identity application identification conversion, which can complete the network identity application identification conversion between different application organizations, and can control the scope of the source organization and destination organization of the conversion through software licensing. The present invention changes the traditional practice of using personal identity information to connect business services between application organizations, prevents application organizations from associating and aggregating personal information data, and helps to open up the entire industry chain.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a network trusted identity mutual recognition method based on network identity application identifier conversion. Background Art

[0002] The online identity application identifier (AID) is a code generated by the online identity authentication public service platform and used by application access organizations to associate a natural person. The same natural person's AIDs will be different for different application access organizations. The online identity authentication public service platform provides services for individuals to apply for online accounts, online certificates, and conduct identity verification.

[0003] In recent years, in order to prevent the theft of network activity logs and conduct serial analysis of personal network behavior, the network identity authentication public service will return the network identity application identifier after verifying the identity of a natural person. The network identity application identifier of the same person in different application institutions is different.

[0004] Currently, online services are primarily conducted using personal mobile phone numbers or citizen ID numbers, leading to significant leakage of citizens' personal information. This abuse and aggregation of private information also facilitates various types of targeted telecommunications fraud. The identity authentication system provided by the public online identity authentication service addresses the issue of personal identity information leakage and isolates personal identity information between commercial organizations. However, because the same individual's online identity application identifiers differ across different organizations, it is impossible to verify that they are the same individual when information needs to be shared or circulated between organizations, impacting interoperability across some cross-organizational or cross-industry businesses. Summary of the Invention

[0005] In view of the deficiencies in the prior art, the present invention aims to provide a network trusted identity mutual recognition method based on network identity application identifier conversion.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions:

[0007] A network trusted identity mutual recognition method based on network identity application identification conversion, including two processes: initialization and mutual recognition;

[0008] A. Initialization:

[0009] A1. The network identity application identification conversion system uses the key management module and the signature verification algorithm to import and store the application organization's key;

[0010] A2. The network identity application conversion system uses the Liscense management module to import and store the authorization license using a signature verification algorithm. The license exists in the form of a file and is used to clearly identify the source and destination organizations that have obtained permission for identity conversion, including the source organization ID and the destination organization ID.

[0011] B. Mutual Recognition:

[0012] B1. When mutual recognition of trusted network identities is required, the application institution's business system sends a conversion request to the network identity application identifier conversion system, requesting that the user's network identity application identifier at the source institution be converted to the user's network identity application identifier at the target institution; the conversion request includes the source institution ID, the target institution ID, and the source institution's network identity application identifier;

[0013] B2. The network identity application conversion system compares the source organization ID and target organization ID included in the conversion request with the stored license file. If a pair of source organization ID and target organization ID that are authorized for identity conversion can be accurately matched in the license file, it indicates that the license has been obtained, and then proceeds to step B3.

[0014] B3. The network identity application identifier conversion system uses a conversion algorithm module to convert the user's network identity application identifier at the source institution, obtains the converted network identity application identifier of the target institution, and outputs it to the business system of the application institution;

[0015] B4. The business system of the application organization compares the known user's network identity application identifier at the target organization with the network identity application identifier of the target organization converted by the network identity application identifier conversion system. If the comparison is successful, it is considered that the user's network identity application identifier at the source organization and the network identity application identifier at the target organization correspond to the same user.

[0016] Furthermore, in step B4, the conversion algorithm module mathematically transforms the source organization ID and the target organization ID in the conversion request through an algorithm to generate the source organization's organization key index and the target organization's organization key index respectively, and then uses the source organization's organization key to decrypt and mathematically transform the source organization's network identity application identifier to obtain an intermediate data, and then uses the target organization's organization key to encrypt the intermediate data, and finally outputs the target organization's network identity application identifier.

[0017] Furthermore, the steps B1 and B4 are completed in the business system of the same application organization or in the business systems of different application organizations.

[0018] The beneficial effects of the present invention are: the method of the present invention can be used to complete the conversion of network identity application identifiers between different application organizations, and the scope of the source organization and destination organization of the conversion can be controlled through software licensing. The present invention changes the traditional practice of using personal identity information between application organizations to provide serial business services, preventing application organizations from associating and aggregating personal information data while helping to open up the entire industry chain. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 This is a flow chart of the method of Example 1 of the present invention;

[0020] Figure 2 This is a flow chart of the method of embodiment 2 of the present invention;

[0021] Figure 3 This is a flow chart of the method of embodiment 3 of the present invention;

[0022] Figure 4 This is a flow chart of the method of Example 4 of the present invention;

[0023] Figure 5 This is a flow chart of the method of Example 5 of the present invention;

[0024] Figure 6 This is a flow chart of the method of Example 6 of the present invention. DETAILED DESCRIPTION

[0025] The present invention will be further described below in conjunction with the accompanying drawings. It should be noted that this embodiment is based on the technical solution and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to this embodiment.

[0026] Example 1

[0027] like Figure 1 As shown, a network trusted identity mutual recognition method based on network identity application identification conversion includes two processes: initialization and mutual recognition.

[0028] A. Initialization:

[0029] A1. The network identity application identification conversion system uses the key management module and the signature verification algorithm to import and store the application organization's key;

[0030] A2. The network identity application conversion system uses the Liscense management module and the signature verification algorithm to import and store the authorization license Liscense; Liscense exists in the form of a file and is used to clearly identify the source and destination organizations that have obtained permission for identity conversion, including the source organization ID and the destination organization ID.

[0031] B. Mutual Recognition:

[0032] B1. When mutual recognition of trusted network identities is required, the application organization's business system sends a conversion request to the network identity application identifier conversion system, requesting that the user's network identity application identifier at the source organization be converted to the user's network identity application identifier at the target organization. The conversion request includes the source organization ID, the target organization ID, and the source organization's network identity application identifier. The returned data is the converted target organization ID.

[0033] B2. The network identity application identification conversion system compares the source organization ID and target organization ID contained in the conversion request with the stored Liscense file. If a pair of source organization ID and target organization ID that have obtained permission for identification conversion can be accurately matched in the Liscense file, it means that permission has been obtained, and step B3 is performed.

[0034] B3. The network identity application identifier conversion system uses a conversion algorithm module to convert the user's network identity application identifier at the source institution, obtaining the converted target institution's network identity application identifier and outputting it to the application institution's business system. Specifically, the conversion algorithm module mathematically transforms the source institution ID and target institution ID in the conversion request through an algorithm to generate the source institution's organization key index and the target institution's organization key index, respectively. The source institution's organization key is then used to decrypt and mathematically transform the source institution's network identity application identifier, generating intermediate data. This intermediate data is then encrypted using the target institution's organization key, and the target institution's network identity application identifier is finally output.

[0035] B4. The business system of the application organization compares the known user's network identity application identifier at the target organization with the network identity application identifier of the target organization converted by the network identity application identifier conversion system. If the comparison is successful, it is considered that the user's network identity application identifier at the source organization and the network identity application identifier at the target organization correspond to the same user.

[0036] The steps B1 and B4 can be completed in the business system of the same application organization or in the business systems of different application organizations.

[0037] Example 2

[0038] This embodiment provides an example of the mutual recognition of identity application of the method of embodiment 1 in one-to-one cross-institutional business processing. Figure 2 shown.

[0039] 1. The user performs identity authentication at application institution A. After successful authentication, the network identity authentication public service platform returns the user's network identity application identifier ID1 at application institution A.

[0040] 2. The user performs identity authentication at application organization B. After successful authentication, the network identity authentication public service platform returns the user's network identity application identifier ID2 at application organization B.

[0041] 3. When a user handles the business of application institution A across institutions in the business system of application institution B, it is necessary to confirm whether ID1 and ID2 correspond to the same user. The business system of application institution B sends a network trusted identity mutual recognition request to the business system of application institution A. The request data should include the user's network identity application identifier ID2 in application institution B.

[0042] 4. The business system of application organization A sends a conversion request to the network identity application identifier conversion system, and sends the user's network identity application identifier ID2 at application organization B to the network identity application identifier conversion system. The network identity application identifier conversion system determines whether it has permission to convert the network identity application identifier of application organization B to the network identity application identifier of application organization A. If it has permission, it uses the conversion algorithm module to convert ID2, and outputs the converted network identity application identifier, and returns it to the business system of application organization A.

[0043] 5. Application organization A's business system compares the received converted network identity application identifier with ID1. If they match, it determines that ID1 and ID2 are the same user and sends the mutual recognition result to application organization B.

[0044] Example 3

[0045] This embodiment provides an application example of the method of Example 1 in identity mutual recognition in one-to-many cross-institution business processing.

[0046] The network identity application identifiers ID1, ID2, ID3, and ID4 are the data returned by the network identity authentication public service platform to the corresponding application institution after the user successfully completes identity authentication at application institution A, application institution B, application institution C, and application institution D, respectively. Users can handle business with multiple application institutions across the same application institution. The specific process is as follows:

[0047] 1. When a user at application institution A conducts business with another application institution across institutions, mutual recognition of the user's network trusted identity is required.

[0048] 2. The business system of application organization A initiates a network trusted identity mutual recognition request to the business systems of other application organizations.

[0049] 3. Application organization A obtains the user's network identity application identifier in other application organizations.

[0050] like Figure 3 As shown, there are three scenarios in this embodiment.

[0051] Scenario 1: A user in institution A transacts business with institution B:

[0052] (311) The business system of application organization A sends a network trusted identity mutual recognition request to the business system of application organization B.

[0053] (312) The business system of application organization B returns the network identity application identifier ID2 to the business system of application organization A.

[0054] Scenario 2: A user at institution A transacts business with institution C:

[0055] (321) The business system of application organization A sends a network trusted identity mutual recognition request to the business system of application organization C.

[0056] (322) The business system of application organization C returns the network identity application identifier ID3 to the business system of application organization A.

[0057] Scenario 3: A user at institution A transacts business with institution D:

[0058] (331) The business system of application organization A sends a network trusted identity mutual recognition request to the business system of application organization D.

[0059] (332) The business system of application organization D returns the network identity application identifier ID4 to the business system of application organization A.

[0060] 4. The business system of application organization A sends a conversion request to the network identity application identifier conversion system, requesting that the network identity application identifier of the user at another application organization be converted to the identifier of the user at application organization A:

[0061] (41) The business system of application organization A inputs the user's network identity application identifier in other application organizations into the network identity application identifier conversion system, and the network identity application identifier conversion system completes the permission judgment and identifier conversion operation.

[0062] (42) The business system of application organization A obtains the converted identifier.

[0063] 5. The business system of application organization A compares the converted identifier with the user's known network identity application identifier ID1 in application organization A. If they are the same, it is determined that they are the same person, and the user's network identity mutual recognition is completed.

[0064] Example 4

[0065] This embodiment provides an application example of the method of Example 1 in identity mutual recognition in many-to-one (single-end deployment) cross-institutional business processing.

[0066] The network identity application identifiers ID1, ID2, ID3, and ID4 are the data returned by the network identity authentication public service platform to the corresponding application institution after the user successfully completes identity authentication at application institution A, application institution B, application institution C, and application institution D, respectively. Users can handle the same application institution's business across multiple application institutions. The specific process is as follows:

[0067] 1. When a user handles the business of application institution A across other application institutions, mutual recognition of the user's network trusted identity is required.

[0068] 2. Other application organizations send a network trusted identity mutual recognition request and the user's network identity application identifier in this organization to application organization A.

[0069] like Figure 4 As shown, this embodiment includes multiple scenarios.

[0070] Scenario 1:

[0071] (211) The user handles the business of application organization A in the business system of application organization B.

[0072] (212) The business system of application organization B sends a network trusted identity mutual recognition request and the user's network identity application identifier ID2 in application organization B to the business system of application organization A.

[0073] Scenario 2:

[0074] (221) A user conducts business with application institution A in the business system of application institution C.

[0075] (222) The business system of application organization C sends a network trusted identity mutual recognition request and the user's network identity application ID3 in application organization C to the business system of application organization A.

[0076] Scenario 3:

[0077] (231) A user conducts business with application organization A in the business system of application organization D.

[0078] (232) The business system of application organization D sends a network trusted identity mutual recognition request and the user's network identity application identifier ID4 in application organization D to the business system of application organization A.

[0079] 3. The business system of application institution A sends a conversion request to the network identity application identifier conversion system to convert the user's network identity application identifier in other application institutions into the user's network identity application identifier in application institution A:

[0080] (31) The business system of application organization A inputs the user's network identity application identifier from other application organizations into the network identity application identifier conversion system. The network identity application identifier conversion system performs identifier conversion after completing the permission judgment.

[0081] (32) The business system of application organization A obtains the converted network identity application identifier.

[0082] 4. The business system of application organization A compares the converted network identity application identifier with the user's known network identity application identifier in application organization A to complete the mutual recognition of user identity.

[0083] 5. The business system of application organization A returns the user identity mutual recognition result to the business system of the application organization that initiated the mutual recognition request.

[0084] Example 5

[0085] This embodiment provides an application example of the method described in Example 1 in identity mutual recognition in many-to-one (multi-terminal deployment) cross-institutional business processing.

[0086] The network identity application identifiers ID1, ID2, ID3, and ID4 are the data returned by the network identity authentication public service platform to the corresponding application institution after the user successfully completes identity authentication at application institution A, application institution B, application institution C, and application institution D, respectively. Users can handle the same application institution's business across multiple application institutions. The specific process is as follows:

[0087] 1. When a user handles the business of application institution A across other application institutions, mutual recognition of the user's network trusted identity is required.

[0088] 2. The business systems of other application organizations initiate a network trusted identity mutual recognition request to the business system of application organization A.

[0089] 3. The business system of application organization A returns the user's network identity application identifier ID1 in application organization A to the business systems of other application organizations.

[0090] 4. The business systems of application organizations B / C / D send a conversion request to their respective network identity application identifier conversion systems, requesting that the network identity application identifier ID1 of the user in application organization A be converted into the network identity application identifier of the user in this application organization.

[0091] 5. The business system of application organization B / C / D compares the converted network identity application identifier with the user's network identity application identifier ID2 / ID3 / ID4 in the application organization to complete the mutual recognition of the user's network identity.

[0092] Specific example scenarios such as Figure 5 As shown, a detailed description is given taking application mechanism B as an example:

[0093] (101) A user conducts business with application organization A in the business system of application organization B.

[0094] (102) The business system of application organization B initiates a network trusted identity mutual recognition request to the business system of application organization A.

[0095] (103) The business system of application organization A returns the user's network identity application identifier ID1 in application organization A to the business system of application organization B.

[0096] (104) The business system of application organization B completes the identity conversion through its corresponding network identity application identity conversion system.

[0097] (105) The business system of application organization B compares the converted network identity application identifier with the user's network identity application identifier ID2 in the application organization to complete the mutual recognition of user identity.

[0098] Example 6

[0099] This embodiment provides an application example of the method described in Example 1 in identity mutual recognition in many-to-one (multi-terminal deployment) cross-institutional business processing.

[0100] Network identity application identifiers ID1, ID2, ID3, and ID4 are data returned by the network identity authentication public service platform to the corresponding application institution after the user successfully completes identity authentication at application institution A, application institution B, application institution C, and application institution D. Users can handle the same application institution's business across multiple application institutions. The specific process is as follows:

[0101] 1. When a user handles the business of application institution A across other application institutions, mutual recognition of the user's network trusted identity is required.

[0102] 2. The business systems of other application organizations initiate a network trusted identity mutual recognition request to the business system of application organization A.

[0103] 3. The business system of application organization A sends a conversion request to the network identity application identifier conversion system, requesting to convert the user's network identity application identifier ID1 in application organization A into the user's network identity application identifier in other application organizations.

[0104] 4. Application organization A returns the converted network identity application identifier to the business system of the corresponding application organization.

[0105] 5. The business system of application organization B / C / D compares the network identity application identifier returned by application organization A with the user's network identity application identifier ID2 / ID3 / ID4 in this application organization to complete the mutual recognition of the user's network identity.

[0106] Specific example scenarios such as Figure 6 As shown, a detailed description is given taking application mechanism C as an example:

[0107] (101) A user conducts business with application institution A in the business system of application institution C.

[0108] (102) The business system of application organization C initiates a network trusted identity mutual recognition request to the business system of application organization A.

[0109] (103) The business system of application organization A completes the identity conversion through the network identity application identity conversion system.

[0110] (104) The business system of application organization A returns the converted network identity application identifier ID3' to the business system of application organization C.

[0111] (105) The business system of application organization C compares the returned ID3' with the user's ID3 in the application organization, and completes the mutual recognition of user identity.

[0112] Those skilled in the art can make various corresponding changes and modifications based on the above technical solutions and concepts, and all of these changes and modifications should be included in the scope of protection of the claims of the present invention.

Claims

1. A network trusted identity mutual recognition method based on network identity application identification conversion, characterized in that: Including two processes: initialization and mutual recognition; A. Initialization: A1. The network identity application identification conversion system uses the key management module and the signature verification algorithm to import and store the application organization's key; A2. The network identity application conversion system uses the Liscense management module to import and store the authorization license using a signature verification algorithm. The license exists in the form of a file and is used to clearly identify the source and destination organizations that have obtained permission for identity conversion, including the source organization ID and the destination organization ID. B. Mutual Recognition: B1. When mutual recognition of trusted network identities is required, the application institution's business system sends a conversion request to the network identity application identifier conversion system, requesting that the user's network identity application identifier at the source institution be converted to the user's network identity application identifier at the target institution; the conversion request includes the source institution ID, the target institution ID, and the source institution's network identity application identifier; B2. The network identity application conversion system compares the source organization ID and target organization ID included in the conversion request with the stored license file. If a pair of source organization ID and target organization ID that are authorized for identity conversion can be accurately matched in the license file, it indicates that the license has been obtained, and then proceeds to step B3. B3. The network identity application identifier conversion system uses a conversion algorithm module to convert the user's network identity application identifier at the source institution, obtains the converted network identity application identifier of the target institution, and outputs it to the business system of the application institution; B4. The business system of the application organization compares the known user's network identity application identifier at the target organization with the network identity application identifier of the target organization converted by the network identity application identifier conversion system. If the comparison is successful, it is considered that the user's network identity application identifier at the source organization and the network identity application identifier at the target organization correspond to the same user.

2. The method according to claim 1, characterized in that In step B4, the conversion algorithm module performs mathematical transformation on the source organization ID and the target organization ID in the conversion request through an algorithm to generate the source organization's organization key index and the target organization's organization key index respectively, and then uses the source organization's organization key to decrypt and mathematically transform the source organization's network identity application identifier to obtain an intermediate data, and then uses the target organization's organization key to encrypt the intermediate data, and finally outputs the target organization's network identity application identifier.

3. The method according to claim 1, characterized in that Step B1 and step B4 are completed in the business system of the same application organization or in the business systems of different application organizations.

Images