Urban platform and method based on national network identity authentication public service

Abstract

The invention discloses a city platform and method based on a national network identity authentication public service, and relates to the field of smart cities, and the method comprises the steps: firstly completing user identity authentication through the national network identity authentication public service, so as to establish a trusted access basis; and constructing a data request contract, and storing an evidence after a user confirms authorization, thereby forming a transparent and traceable authorization mechanism. And then generating a data token for limiting access based on a user authorization range, obtaining required cross-source data based on a unified data aggregation service, realizing on-demand aggregation and safe circulation of the data, automatically auditing the aggregated data through business logic to obtain an auditing result, and finally returning the auditing result to the user. In this way, the business process can be simplified, the problems of repeated authorization and data islands are solved, meanwhile, the user data control right is guaranteed, and the intelligence and efficiency of urban platform business handling are improved.

Description

Technical Field

[0001] The present application relates to the field of smart cities, and more specifically, to a city platform and method based on national network identity authentication public services. Background Art

[0002] With the deepening advancement of digital government construction and the popularization of smart city concepts, urban services are gradually moving towards online, integrated, and intelligent development. Against this backdrop, building a secure, efficient, and convenient urban service platform to meet the growing and diverse needs of citizens has become a key issue in urban governance. As a national infrastructure, the National Network Identity Authentication Public Service aims to provide unified, authoritative, and trusted identity authentication capabilities. It has irreplaceable advantages in ensuring cyberspace security and improving the efficiency of government services. Deeply integrating the city platform with the National Network Identity Authentication Public Service will not only effectively address the fragmentation, inconsistency, and insecurity issues of user identity authentication on traditional urban service platforms, but also provide citizens with a more convenient and reliable "one-stop" service experience.

[0003] However, existing city platforms often face numerous challenges when integrating with national online identity authentication services. For example, in complex scenarios involving multi-department data sharing and cross-business collaboration, simple identity authentication alone cannot fully meet business needs. Under the current model, users applying for services requiring data from multiple sources, such as talent introduction subsidies, still need to repeatedly submit documents and obtain authorization across different departments. This can even lead to data silos and information barriers, resulting in cumbersome and inefficient business processes. More importantly, there is a lack of a unified, transparent, and traceable mechanism for data authorization and use. Users often passively accept data authorization terms, struggling to control the scope, flow, and purpose of their personal data. Furthermore, they cannot implement refined "minimum necessary" authorization, posing potential risks of data misuse and privacy breaches. Traditional business processes often rely on manual review and offline transactions, which are not only time-consuming and labor-intensive but also hinder automated data aggregation and intelligent review. This hinders the development of city service platforms towards higher levels of intelligence and refinement.

[0004] Therefore, there is an urgent need for an optimized urban platform and method based on national network identity authentication public services. Summary of the Invention

[0005] In order to solve the above technical problems, this application is proposed.

[0006] According to one aspect of the present application, a city platform based on national network identity authentication public services is provided, which includes: A user identity authentication module is used to respond to a login request initiated by a user on the city platform client, perform user identity authentication based on the national network identity authentication public service, and generate a platform primary access token after successful identity authentication; A business request and contract generation module, configured to: in response to a user clicking to apply for a talent introduction subsidy, the city platform client initiates a business request to the backend business acceptance service; wherein the business acceptance service generates a data request contract draft in response to the business request; The contract authorization and evidence storage module is used to display the draft data request contract on the city platform client and, in response to the user clicking the "Agree to Authorization" button, submit the draft data request contract to the authorization evidence storage chain of the city platform and return an authorization receipt; A business data token generation module, configured to generate a business data token in response to receiving the authorization receipt, wherein the audience of the business data token is limited to the data aggregation service; a data aggregation module configured to, in response to obtaining the business data token, cause the business acceptance service to call an interface of a unified data aggregation service of the platform and receive and aggregate data from different data sources based on the data range field in the business data token to obtain an aggregated data packet; A data audit module, used for the business acceptance service to audit the aggregated data packets based on business logic to obtain an audit result; The audit result returning module is used to return the audit result to the city platform client.

[0007] According to another aspect of the present application, a service method of a city platform based on a national network identity authentication public service is provided, comprising: In response to a login request initiated by a user on the city platform client, user identity authentication is performed based on the national network identity authentication public service and a platform primary access token is generated after successful identity authentication; In response to the user clicking to apply for the talent introduction subsidy, the city platform client initiates a business request to the backend business acceptance service, wherein the business acceptance service generates a data request contract draft in response to the business request; Display the draft data request contract on the city platform client, and in response to the user clicking the consent authorization button, submit the draft data request contract to the authorization evidence chain of the city platform and return an authorization receipt; In response to receiving the authorization receipt, generating a business data token, wherein the audience of the business data token is limited to the data aggregation service; In response to obtaining the business data token, the business acceptance service calls the platform's unified data aggregation service interface and receives and aggregates data from different data sources based on the authorized access data range field in the business data token to obtain an aggregated data packet; The business acceptance service reviews the aggregated data packets based on business logic to obtain a review result; Return the review results to the city platform client.

[0008] Compared with the existing technology, the city platform and method provided by this application based on the national network identity authentication public service first use the national network identity authentication public service to complete user identity authentication to establish a trusted access basis. When the user handles the business, a data request contract is constructed and after the user confirms the authorization, it is stored to form a transparent and traceable authorization mechanism. Then, a data token with limited access is generated based on the user's authorization scope, and the required cross-source data is obtained based on a unified data aggregation service to achieve on-demand aggregation and secure flow of data. The aggregated data is then automatically audited through business logic to obtain the audit results, and the audit results are finally returned to the user. In this way, the business process can be simplified, the problems of repeated authorization and data islands can be solved, while the user's control over data is guaranteed, and the intelligence and efficiency of the city platform's business handling can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] The above and other purposes, features, and advantages of the present application will become more apparent through a more detailed description of the embodiments of the present application in conjunction with the accompanying drawings. The accompanying drawings are intended to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the present application and do not constitute a limitation of the present application. In the drawings, the same reference numerals generally represent the same components or steps.

[0010] Figure 1 This is a block diagram of a city platform based on national network identity authentication public services according to an embodiment of the present application.

[0011] Figure 2 This is a data flow diagram of a city platform based on national network identity authentication public services according to an embodiment of the present application.

[0012] Figure 3 This is a block diagram of a user identity authentication module in a city platform based on the national network identity authentication public service according to an embodiment of the present application.

[0013] Figure 4 This is a block diagram of a business request and contract generation module in a city platform based on national network identity authentication public services according to an embodiment of the present application.

[0014] Figure 5This is a block diagram of the contract authorization and evidence storage module in the city platform based on the national network identity authentication public service according to an embodiment of the present application.

[0015] Figure 6 This is a block diagram of a data aggregation module in a city platform based on national network identity authentication public services according to an embodiment of the present application.

[0016] Figure 7 This is a flowchart of a service method of a city platform based on national network identity authentication public services according to an embodiment of the present application. DETAILED DESCRIPTION

[0017] The following describes embodiments of the present disclosure in more detail with reference to the accompanying drawings. While the drawings illustrate certain embodiments of the present disclosure, it should be understood that the present disclosure can be implemented in various forms and should not be construed as limited to the embodiments described herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are for illustrative purposes only and are not intended to limit the scope of protection of the present disclosure.

[0018] In response to the problems in the above-mentioned background technology, this application proposes a city platform based on national network identity authentication public services. Figure 1 This is a block diagram of a city platform based on national network identity authentication public services according to an embodiment of the present application. Figure 2 This is a data flow diagram of a city platform based on a national network identity authentication public service according to an embodiment of the present application. Figure 1 and Figure 2As shown, the city platform 100 based on the national network identity authentication public service includes: a user identity authentication module 110, which is used to respond to a login request initiated by a user on the city platform client, perform user identity authentication based on the national network identity authentication public service and generate a platform master access token after the identity authentication is successful; a business request and contract generation module 120, which is used to respond to the user clicking to apply for talent introduction subsidy, and the city platform client initiates a business request to the background business acceptance service, wherein the business acceptance service generates a data request contract draft in response to the business request; a contract authorization and evidence storage module 130, which is used to display the data request contract draft on the city platform client, and submit the data request contract draft in response to the user clicking the consent authorization button. To the authorization evidence chain of the city platform and return the authorization receipt; the business data token generation module 140 is used to generate a business data token in response to receiving the authorization receipt, and the audience of the business data token is limited to the data aggregation service; the data aggregation module 150 is used to respond to obtaining the business data token, the business acceptance service calls the platform's unified data aggregation service interface and receives and aggregates data from different data sources based on the data range field authorized to be accessed in the business data token to obtain an aggregated data packet; the data review module 160 is used for the business acceptance service to review the aggregated data packet based on business logic to obtain an review result; the review result return module 170 is used to return the review result to the city platform client.

[0019] In the aforementioned city platform based on the national network identity authentication public service, the user identity authentication module 110 is configured to respond to a login request initiated by a user on the city platform client, perform user identity authentication based on the national network identity authentication public service, and generate a platform primary access token upon successful authentication. It should be understood that the national network identity authentication public service, as a national infrastructure, possesses unified and authoritative identity verification capabilities and can provide nationally recognized identity authentication results. Therefore, when a user logs into the city platform client, identity authentication is completed based on the national network identity authentication public service, establishing a trusted identity foundation for subsequent operations such as data authorization and cross-source data access in business processing. This ensures the uniqueness and authenticity of the user's identity, safeguards the security and compliance of platform business processing, and avoids various business risks caused by unreliable identity authentication. By generating a platform primary access token, the user's identity information and login status are recorded in a standardized form, providing a unified identity credential for subsequent operations such as initiating business requests and performing data authorization within the platform. This eliminates the cumbersome process of users repeatedly performing identity authentication when handling different businesses, simplifies operational steps, and enhances the user experience.

[0020] In particular, in one embodiment, Figure 3FIG is a block diagram of a user identity authentication module in a city platform based on a national network identity authentication public service according to an embodiment of the present application. Figure 3 As shown, the user identity authentication module 110 includes: a platform jump unit 111, which is used to jump to the national network identity authentication public service in response to a login request initiated by the user on the city platform client; a face recognition authentication unit 112, which is used for the national network identity authentication public service to perform user identity authentication through face recognition; an authorization code generation and return unit 113, which is used for the national network identity authentication public service to generate an authorization code in response to successful identity authentication and return the authorization code to the city platform client; an authorization code transmission unit 114, which is used for the city platform client to send the authorization code to the identity authentication service; an authorization code verification unit 115, which is used for the identity authentication service to verify the validity of the authorization code to the national network identity authentication public service through a back-end signal, and generate the platform master access token after successful verification.

[0021] Specifically, the platform jump unit 111 is configured to respond to a login request initiated by a user on the city platform client and redirect the user to the national network identity authentication public service. Specifically, by redirecting the user to the national network identity authentication public service, a nationally authoritative authentication source is introduced, replacing the city platform's own authentication process. This ensures that the user authentication process complies with national standards and enhances the credibility and versatility of the authentication results. This also avoids duplication of identity authentication systems within the city platform, reducing development and maintenance costs. It provides a unified identity benchmark for users subsequently handling various services within the platform, reduces service congestion caused by inconsistent authentication standards, and promotes standardized and efficient platform authentication processes.

[0022] In particular, in a possible embodiment, the implementation process of the platform jump unit 111 is as follows: after the user clicks the login icon on the city platform client, the client immediately responds to the operation and starts the jump program through the built-in security SDK. The client first verifies the security of the device environment, and after confirming that there is no abnormality, it automatically opens the dedicated interface of the national network identity authentication public service, and guides the user to the security operation interface of the public service through system-level page switching. During the jump process, the client did not pass any user sensitive information, but only sent the platform identification information to the public service to indicate the source of the jump. The user can clearly see the official certification logo on the public service interface to confirm that they have entered the national authoritative certification environment. The entire jump process is smooth and without unnecessary operations, ensuring the continuity of the user experience.

[0023] Specifically, the facial recognition authentication unit 112 is used for the national network identity authentication public service to perform user identity authentication through facial recognition. It should be understood that since facial recognition is based on biometrics, it is unique and non-replicable, can be directly associated with the user's real identity, and is easy to operate without requiring the user to remember additional information. Therefore, the use of facial recognition for user identity authentication can make full use of the biometric information in the authoritative database of the national network identity authentication public service to achieve high-precision identity verification. Specifically, through biometric comparison, the authenticity of the user's identity can be accurately verified to prevent identity fraud, forgery, etc. With the convenience of facial recognition, the user authentication experience is improved, the complexity of user operations is reduced, the accuracy and legal effect of the comparison results are ensured, and a true and reliable identity basis is provided for subsequent platform operations.

[0024] In particular, in a possible embodiment, the implementation process of the face recognition authentication unit 112 is as follows: after receiving the user's entry instruction, the user is first prompted to place the face in the collection frame, and keep the light sufficient and the face unobstructed. After the user completes the operation according to the prompts, the server collects the facial image in real time and extracts key biometric feature points such as eye distance, nose shape, and jaw line. Subsequently, the system compares the extracted feature points with the user's biometric data stored in the National Population Basic Information Database in multiple dimensions, including feature point matching and dynamic liveness detection, such as blinking, turning the head, and other action verification. If the comparison result meets the preset threshold and passes the liveness detection, the system determines that the identity authentication is successful. If the comparison fails or the liveness detection fails, the user is prompted to re-operate or use other authentication methods. The entire process is carried out in an encrypted environment to ensure that biometric information is not leaked.

[0025] Specifically, the authorization code generation and return unit 113 is used to generate an authorization code in response to a successful identity authentication, and return the authorization code to the city platform client by the national network identity authentication public service. It should be understood that the authorization code, as a temporary, one-time credential, can replace sensitive information to transmit authentication results, which can not only prove that the user has passed the national-level identity authentication, but also avoid directly exposing the user's identity data. At the same time, the authorization code is timely and unique, which can effectively prevent the credential from being reused or abused, and ensure the security and controllability of the authentication result transmission. This application controls the scope of use and timeliness of the authentication result through the timeliness and uniqueness of the authorization code, realizes the secure transmission of the authentication result, eliminates the risk of leakage of sensitive identity information during the transmission process, and provides a reliable basis for subsequent verification.

[0026] In particular, in a possible embodiment, the implementation process of the authorization code generation and return unit 113 is as follows: After confirming that the user identity authentication is passed, the national network identity authentication public service immediately starts the authorization code generation mechanism. The system randomly generates a set of strings containing uppercase and lowercase letters, numbers and special symbols with a length of 32 bits, and binds the user's unique identifier to the authorization code and generates a timestamp. The system sets the validity period of the authorization code to 5 minutes and marks it as a one-time use. After the generation is completed, the server sends the authorization code to the city platform client through an encrypted communication channel. The SSL encryption protocol is used during the transmission process to ensure that the data is not intercepted or tampered with. After receiving the authorization code, the city platform client immediately stores it in the local security cache area and marks it as pending. At the same time, it clears any historical authorization codes that may exist in the cache to prevent confusion.

[0027] Specifically, the authorization code transfer unit 114 is used for the city platform client to send the authorization code to the identity authentication service. That is, the authorization code obtained by the front end is securely transferred to the identity authentication service of the platform back end, and the validity verification process of the authorization code is started, providing a prerequisite for the subsequent generation of the platform master access token. Through the back-end service processing verification, it is ensured that the authorization code has not been tampered with, is within the validity period, and corresponds to the correct user identity, thereby ensuring the legitimacy of the identity identification within the platform. The secure transmission of the authorization code from the client to the back-end service is realized, ensuring that the verification process is carried out in the platform's trusted environment, and reducing the security vulnerabilities that may be caused by the front-end processing. After receiving the authorization code, the back-end identity authentication service can immediately start the interactive verification with the national public service, promote the authentication process to the next stage, lay the foundation for generating the platform master access token, and ensure the consistency and security of the entire process.

[0028] In particular, in a possible embodiment, the implementation process of the authorization code transmission unit 114 is as follows: after the city platform client obtains the authorization code in the local security cache area, it automatically starts a communication connection with the platform identity authentication service. The client first performs Base64 encoding on the authorization code, and then sends the encoded authorization code to the designated interface of the identity authentication service through the platform-specific encryption communication protocol. During the sending process, the client also attaches auxiliary information such as its own device identification and application version number for the identity authentication service to verify the legitimacy of the request. After receiving the request, the identity authentication service first verifies whether the client's device identification and application version are in the trust list. After confirming that they are correct, it decodes the authorization code and temporarily stores it, waiting for subsequent verification interaction with the national network identity authentication public service. The entire transmission process is completed within 1 second to ensure that the authorization code is processed within the validity period.

[0029] Specifically, the authorization code verification unit 115 is used by the identity authentication service to verify the validity of the authorization code with the National Network Identity Authentication Public Service via a backend signal, and to generate the platform primary access token upon successful verification. Specifically, by interacting with the backend of the National Network Identity Authentication Public Service, the authenticity, timeliness, and relevance of the authorization code are verified to ensure that it corresponds to a valid user identity. After successful verification, a platform primary access token containing information such as the user's unique identifier, authentication time, and validity period is generated. This token serves as the user's unified identity credential within the platform, eliminating the need for repeated identity authentication for subsequent transactions, significantly improving transaction processing efficiency.

[0030] In particular, in a possible embodiment, the implementation process of the authorization code verification unit 115 is as follows: after receiving the authorization code, the identity authentication service of the city platform immediately sends a verification request to the national network identity authentication public service through a dedicated back-end channel. The request contains the authorization code to be verified, the platform identifier and the timestamp, and is signed by the encryption algorithm predefined by both parties to ensure that the request has not been tampered with. After receiving the request, the national network identity authentication public service verifies the legitimacy of the signature, and then queries the internal records to verify the validity of the authorization code, including whether it is within the validity period, whether it has been used, and whether it corresponds to the correct user. After the verification is passed, the national public service returns the verification result containing the user's unique identifier. After the identity authentication service receives the result and confirms that it is correct, it generates a platform master access token: the token uses the JWT format, contains the user's unique ID in the platform, the authentication pass time, the token validity period, and is signed by the platform private key. After the generation is completed, the identity authentication service returns the token to the city platform client, and the client stores the token for identity identification in subsequent business requests.

[0031] In the aforementioned city platform based on the national network identity authentication public service, the business request and contract generation module 120 is used to respond to a user clicking to apply for a talent introduction subsidy, and the city platform client initiates a business request to the backend business acceptance service, wherein the business acceptance service generates a data request contract draft in response to the business request. Specifically, when the user clicks the apply button, the city platform client initiates a business request to the backend to initiate a standardized processing flow. At the same time, the business acceptance service generates a data request contract draft, which specifies the data type, source, and scope required to complete the business, making the data request standardized and targeted, and providing a specific authorization content basis for subsequent user authorization steps.

[0032] In particular, in one embodiment, Figure 4 FIG is a block diagram of a business request and contract generation module in a city platform based on a national network identity authentication public service according to an embodiment of the present application. Figure 4As shown, the business request and contract generation module 120 includes: a business request initiation unit 121, which is used for the city platform client to carry the platform primary access token to initiate a business request to the background business acceptance service in response to the user clicking to apply for talent introduction subsidy; a user identity confirmation unit 122, which is used for the business acceptance service to confirm the user identity based on the platform primary access token after receiving the business request; a data requirement template loading unit 123, which is used for the business acceptance service to load the data requirement template corresponding to the service ID from the configuration center based on the service ID in the business request; a data request contract draft generation unit 124, which is used for the business acceptance service to call the authorization center service in combination with the data requirement template to generate the data request contract draft for the business request.

[0033] Specifically, the service request initiation unit 121 is configured to, in response to a user clicking on a request to apply for a talent introduction subsidy, initiate a service request from the city platform client to the backend service acceptance service, carrying the platform's primary access token. It should be understood that by initiating a service request with the platform's primary access token, the user's talent introduction subsidy application request is communicated from the client to the backend service acceptance service. The platform's primary access token is used as an identity credential, ensuring that the backend service can identify the requester as a legitimate user who has passed national certification. This successfully establishes an association between the service request and the user's legitimate identity, eliminating the possibility of unauthenticated users initiating services and ensuring the security of service processing.

[0034] In particular, in a possible embodiment, the implementation process of the business request initiation unit 121 is as follows: after the user clicks on the option to apply for talent introduction subsidies in the talent service section of the city platform client, the client immediately retrieves the platform master access token from the local secure storage area. After the client encrypts the token, it embeds it into the header information of the business request and encapsulates the business operation identifier triggered by the user. Subsequently, the client sends the request to the designated interface of the background business acceptance service through the platform's dedicated encrypted communication channel. The transmission process uses an end-to-end encryption protocol to prevent data from being intercepted or tampered with. The request only contains the token and the business identifier, and does not carry other sensitive information. After receiving the request, the background service can use the token to preliminarily confirm the legitimacy of the request source. The entire process is completed without the user's perception, ensuring the smoothness and security of business initiation.

[0035] Specifically, the user identity confirmation unit 122 is used for the business acceptance service to confirm the user identity based on the platform master access token after receiving the business request. Specifically, by verifying the validity of the platform master access token, such as the legitimacy of the signature, the validity period, and the consistency of the user identifier, it is confirmed that the user who initiated the talent introduction subsidy application request is a legitimate user who has passed the national certification, ensuring that the business operation matches the real identity. The token verification process is efficient and does not require user participation, which does not increase the operational burden. At the same time, it provides a clear user unique identifier for subsequent links, so that data requests, authorizations, and audits can be accurately associated with specific users, improving the accuracy and reliability of business processing, and providing an identity traceability basis for compliance audits.

[0036] In particular, in a possible embodiment, the implementation process of the user identity confirmation unit 122 is as follows: after the background business acceptance service receives the user's business request, it immediately extracts the platform master access token in the request header. The server uses the preset public key to verify the digital signature of the token to confirm that the token has not been tampered with during transmission. Subsequently, the user unique identifier, authentication time and validity period fields in the token are parsed to check whether the token is within the valid time range. At the same time, the server queries the locally stored user identity mapping database to verify whether the user identifier in the token is consistent with the authenticated user information recorded by the system. If all verification items are passed, the server confirms that the business request is initiated by a legitimate user, and records the user identifier to the business processing context for subsequent operations. If the verification fails, the server rejects the request and returns a prompt to the client that the identity verification failed. The entire verification process is completed in milliseconds and does not affect the user experience.

[0037] Specifically, the data requirement template loading unit 123 is used for the business acceptance service to load the data requirement template corresponding to the service ID from the configuration center based on the service ID in the business request. It should be understood that the service ID is the unique identifier of the business type. Loading the template through the service ID can ensure the standardization and accuracy of the data requirements, and realize the centralized management and dynamic update of data requirements. Specifically, according to the service ID in the business request, the corresponding predefined data requirement template is accurately loaded to clearly complete the data source required for the application for talent introduction subsidies, such as the education department, human resources and social security department, etc., as well as specific data items such as academic information, social security records, etc., to ensure that the data request is targeted and necessary. Templated data requirements enable business processing to follow a unified standard, provide a standardized data basis for the subsequent generation of data request contract drafts, facilitate dynamic updates according to policy adjustments, ensure that data requests always comply with business specifications, and provide clear guidance for subsequent user authorization and data aggregation.

[0038] In particular, in a possible embodiment, the implementation process of the data requirement template loading unit 123 is as follows: first, the business acceptance service extracts the service ID from the received business request, and the service ID is a character sequence that uniquely corresponds to the talent introduction subsidy business. Then, the server sends a loading request to the configuration center through the internal communication interface. The request contains the service ID and the identity verification information of the server. After the configuration center verifies the identity of the server, it retrieves the data requirement template associated with the service ID. The template clearly records the data sources required to complete the application for talent introduction subsidies, such as the education department, the Human Resources and Social Security Bureau, the Housing and Urban-Rural Development Committee, and specific data items, such as educational information, social security payment records for the past 6 months, and current real estate information.

[0039] Specifically, the data request contract draft generation unit 124 is used for the business acceptance service to call the authorization center service in combination with the data requirement template to generate the data request contract draft for the business request. Specifically, the data requirement template is converted into a user-understandable data request contract draft through the authorization center service, clearly displaying the data source, specific data items, purpose of use and validity period required to complete the application for talent introduction subsidies, so that users can clearly know the authorization content. In this way, the transparency and standardization of data requests are achieved, providing a clear basis for subsequent users to confirm authorization, ensuring the compliance of the authorization process, and unifying the contract format to facilitate subsequent evidence storage and traceability, promoting the data authorization process to be transparent and standardized, and reducing business disputes caused by unclear authorization.

[0040] In particular, in a possible embodiment, the implementation process of the data request contract draft generation unit 124 is as follows: the business acceptance service calls the dedicated interface of the authorization center service and passes the loaded data requirement template to the authorization center in its entirety. After receiving the template, the authorization center service parses the technical department identifiers therein, such as the corresponding education department, human resources and social security department, etc., and converts them into full names that are easy for users to understand; at the same time, the data items are described in plain language, such as educational information, social security records for the past 6 months, etc. According to the business characteristics of talent introduction subsidies, a description of the purpose of data use is automatically generated, such as "used to review your eligibility for talent introduction subsidies", the contract validity period is set to single use, and a unique contract identifier is generated. The authorization center integrates this information into a structured contract draft, which includes the contract ID, user ID, data source and corresponding data items, purpose of use and validity period, etc. The language is concise and free of professional terms.

[0041] In the above-mentioned city platform based on the national network identity authentication public service, the contract authorization and evidence storage module 130 is used to display the data request contract draft on the city platform client, and in response to the user clicking the consent authorization button, submit the data request contract draft to the authorization evidence storage chain of the city platform and return the authorization receipt. Specifically, by displaying the data request contract draft on the city platform client, the user can clearly know the data source, specific data items and data usage purpose required to complete the talent introduction subsidy application, ensuring that the user makes authorization decisions under the premise of full knowledge. At the same time, the contract evidence storage process is triggered by the user clicking the consent authorization button, and the contract draft is submitted to the authorization evidence storage chain of the city platform. The tamper-proof nature of the evidence storage chain is used to record the authorization behavior, forming a legally effective authorization certificate, providing a verifiable authorization basis for subsequent data aggregation and access links, and ensuring the compliance and traceability of data use.

[0042] In particular, in one embodiment, Figure 5 FIG is a block diagram of the contract authorization and evidence storage module in the city platform based on the national network identity authentication public service according to an embodiment of the present application. Figure 5 As shown, the contract authorization and evidence module 130 includes: an informed consent action generation unit 131, which is used to generate a user informed consent action in response to the user clicking the consent authorization button; an informed consent and token sending unit 132, which is used to send the user informed consent action together with the platform master access token to the authorization center service; an authorization evidence submission unit 133, which is used for the authorization center service to encapsulate the user informed consent action and the data request contract draft into a transaction, and submit it to the authorization evidence chain of the city platform.

[0043] Specifically, the informed consent action generation unit 131 is configured to generate a user informed consent action in response to a user clicking the consent authorization button. It should be understood that by converting the user's click of the consent authorization button into structured data containing information such as a contract identifier, user identity identifier, authorization decision, and timestamp, the generated structured informed consent action allows the system to accurately capture the user's authorization intent, avoiding subsequent misjudgments of the authorization content due to ambiguous authorization records. This clearly records the user's consent to a specific data request contract, making the authorization action parseable and clear, and providing a standardized data foundation for subsequent transmission to the authorization center service and storage, ensuring that the system can accurately understand and process the user's authorization decision.

[0044] Specifically, the informed consent and token sending unit 132 is configured to send the user informed consent action along with the platform primary access token to the authorization center service. This means that by sending the user informed consent action, the user's consent decision to the data request contract is conveyed, while the platform primary access token is also carried, allowing the authorization center service to verify the sender's legitimate identity. This ensures that the authorization action represents the genuine intention of a nationally authenticated user, providing the authorization center service with a reliable identity basis and clear authorization content for processing authorization evidence, thus achieving dual confirmation of identity authenticity and authorization intent.

[0045] Specifically, the authorization evidence submission unit 133 is used by the authorization center service to encapsulate the user's informed consent action and the draft data request contract into a transaction and submit it to the city platform's authorization evidence chain. Specifically, the authorization center service integrates the user's informed consent action containing the authorization decision and the draft data request contract containing the authorization content into an unalterable transaction. Utilizing the characteristics of the authorization evidence chain, this transaction is permanently recorded, achieving solidified evidence of the authorization behavior. This ensures the traceability of the authorization content, user decision, and related identity information, provides verifiable authorization credentials for data aggregation services to access cross-departmental data, and ensures compliance in data usage.

[0046] Specifically, in one possible embodiment, the authorization evidence submission unit 133 operates as follows: After receiving and verifying the user's informed consent action and the platform's primary access token, the authorization center service retrieves the corresponding data request contract draft from the system database based on the contract identifier contained therein. The server integrates the user identity, authorization decision, and timestamp from the user's informed consent action with the contract identifier, data source, specific data items, and intended use information from the data request contract draft, generating structured transaction data in accordance with the transaction format specified by the authorization evidence chain. Subsequently, the server digitally signs the transaction data using the platform's private key to ensure the integrity and source legitimacy of the transaction. After signing, the server submits the transaction to the city platform's authorization evidence chain through the authorization evidence chain's node access interface. The evidence chain node verifies the transaction format, signature, and legitimacy. Upon successful verification, the transaction is included in the consensus process. After consensus is reached, the transaction is written to the block and a unique transaction hash is generated. The authorization center service receives the transaction hash and success status information returned by the evidence chain as the basis for subsequently generating an authorization receipt. The entire packaging and submission process is completed in an encrypted environment, ensuring the security and integrity of the transaction data.

[0047] In the above-mentioned city platform based on the national network identity authentication public service, the business data token generation module 140 is used to generate a business data token in response to receiving the authorization receipt, and the audience of the business data token is limited to the data aggregation service. It should be understood that by strictly limiting the audience of the business data token to the data aggregation service, it can be ensured that only this service can use the token to access data, and the unauthorized use of other services can be eliminated. At the same time, the business data token must contain the data source and specific data items authorized by the user, so that each data source can clearly identify the access scope. This provides standardized access credentials for the data aggregation service, enabling it to efficiently connect to the data sources of various departments, and reduces the risk of abuse after the token is stolen through time control, ultimately achieving controllability, compliance and accuracy of data access, and ensuring the security of user data in cross-departmental circulation.

[0048] Specifically, in one possible embodiment, the business data token generation module 140 operates as follows: First, the service parses the contract identifier in the authorization receipt and retrieves the corresponding user authorization information from the system database. Subsequently, the service generates a structured business data token according to a pre-set format, which contains the user's unique identity within the platform, the token generation time, and a five-minute validity period. Key fields in the token explicitly specify that the recipient of the business data token is the platform's unified data aggregation service, ensuring that other services cannot parse or use the token. Furthermore, the business data token details the specific access scope corresponding to each data source, such as the education department's academic information query interface and the human resources and social security department's interface for the past six months of social security records, ensuring that each data source can accurately identify access boundaries. During the generation process, the service digitally signs the token using the platform's dedicated private key to prevent content tampering. Once generated, the authorization center service sends the token to the business acceptance service, which then passes it to the data aggregation service as the sole credential for subsequent data access. The entire process is completed in an encrypted environment, ensuring the security of token generation and transmission.

[0049] In the aforementioned city platform based on the national network identity authentication public service, the data aggregation module 150 is configured to, in response to obtaining the business data token, have the business acceptance service invoke the platform's unified data aggregation service interface and, based on the authorized data range field in the business data token, receive and aggregate data from different data sources to produce an aggregated data packet. It should be understood that the business data token clearly authorizes the data range to be accessed, and the platform's unified data aggregation service has the ability to adapt to multiple data source interfaces, centrally handling permission verification and data format conversion. Therefore, this application avoids direct interaction between the business acceptance service and various data sources by invoking the aggregation service interface, simplifying the system architecture and reducing adaptation costs. Furthermore, the authorization information in the business data token is utilized to ensure that the aggregation service only retrieves data within the user's authorized scope, thus ensuring data access compliance. The resulting aggregated data packet integrates all types of information required for processing talent introduction subsidies in a unified and complete format, providing a reliable data foundation for the business acceptance service to conduct audits based on business logic, reducing audit delays caused by missing data or formatting issues, and promoting efficient and compliant business processing.

[0050] In particular, in one embodiment, Figure 6 FIG is a block diagram of a data aggregation module in a city platform based on a national network identity authentication public service according to an embodiment of the present application. Figure 6 As shown, the data aggregation module 150 includes: a token verification unit 151, which is used by the business acceptance service to verify the signature, timeliness and whether the audience of the business data token is itself; a data range parsing unit 152, which is used by the business acceptance service to parse the content of the data range field authorized to be accessed from the business data token after successful verification; a data request unit 153, which is used to initiate requests to different data sources and receive data from different data sources based on the content of the data range field authorized to be accessed; and a data integration unit 154, which is used to integrate the data from different data sources to obtain the aggregated data packet.

[0051] Specifically, the token verification unit 151 is used by the business acceptance service to verify the signature, timeliness, and recipient identity of the business data token. This verification confirms the authenticity, validity, and relevance of the token by verifying the validity of the signature, timestamp, and recipient identifier of the business data token. This provides a secure and reliable foundation for subsequent token-based data access operations, ensures the compliance and security of data access, and prevents unauthorized data transfer caused by token issues.

[0052] In particular, in one possible embodiment, the implementation process of the token verification unit 151 is as follows: after the business acceptance service receives the business data token, it immediately starts the verification process. First, the service calls the built-in signature verification module and uses the preset public key to decrypt and verify the digital signature of the token to confirm that the token content has not been tampered with during transmission. Subsequently, the service extracts the expiration timestamp in the token and compares it with the current system time to ensure that the token is still within the set validity period, such as 5 minutes. Finally, the service parses the audience field in the token, checks whether the service identifier recorded in the field is consistent with its own service identifier, and confirms that it is the legal recipient of the token. If all three verifications are passed, the service determines that the token is valid and continues with subsequent operations. If any verification fails, the service immediately refuses to use the token, records the exception log, and terminates the data access process.

[0053] Specifically, the data range parsing unit 152 is configured to, after successful verification, enable the business acceptance service to parse the contents of the authorized data range field from the business data token. Specifically, by parsing the authorized data range field, the service extracts the user's authorized data sources, the specific data items corresponding to each data source, and the access constraints. This information is then converted into structured data understandable by the business acceptance service. The parsed specific data range information allows the service to clearly understand the details of the data the user is permitted to access, avoiding out-of-scope data requests due to ambiguous permissions and safeguarding user data privacy and compliance. Furthermore, the clear data item guidance ensures that subsequent requests to each data source are accurate and complete, reducing business processing delays caused by missing or redundant data and laying the foundation for efficient data aggregation.

[0054] In particular, in one possible embodiment, the implementation process of the data range parsing unit 152 is as follows: after confirming that the business data token is valid, the business acceptance service calls the parsing module to process the data range field in the token that is authorized to access. This field is stored in the form of structured code, and the parsing module converts the code into readable information through preset mapping rules: it is determined that the data sources include the education department, the Human Resources and Social Security Bureau, and the Housing and Urban-Rural Development Committee; the corresponding data items are educational level information, social security payment details for the past 6 months, and current property holding status; and all data items are limited to necessary information related to the application for talent introduction subsidies. After the parsing is completed, the service organizes this information into an internal data structure, and each data source and its corresponding data item are clearly marked, providing clear guidance for subsequent data requests to various departments.

[0055] Specifically, the data request unit 153 is used to initiate requests to different data sources and receive data from different data sources based on the content of the data range field that is authorized to be accessed. That is, for each data source's interface specifications and authentication requirements, a request message that meets its standards is constructed, such as carrying platform authentication credentials and user authorization identification, initiating a back-end to back-end security call, requesting to obtain the corresponding data item, ensuring that each data source can verify the legitimacy of the request and return the required data, and realizing the accurate acquisition of cross-departmental data. The data obtained from different data sources completely covers the information required for business audits, providing a reliable foundation for subsequent data integration. At the same time, the smooth acquisition of cross-departmental data breaks the data silos and improves the efficiency of business processing.

[0056] In particular, in a possible embodiment, the implementation process of the data request unit 153 is as follows: the business acceptance service prepares request information for each data source based on the parsed data range. When initiating a request to the education department, the service uses the mTLS client certificate pre-agreed by the platform and the department for identity authentication. The request header carries summary information of the business data token to prove the legitimacy of the authorization, and the request content clearly points to the educational level information. When requesting the social security payment details for the past six months from the Human Resources and Social Security Bureau, the service passes the request parameters signed by the platform through a dedicated API gateway, and attaches a description of the user's authorization scope. When requesting the property holding status from the Housing and Urban-Rural Development Committee, the service uses the token verification mechanism approved by the department to ensure that the source of the request is credible. After receiving the request, each data source verifies the authentication information and authorization scope, and returns the corresponding data after confirmation. The service receives and temporarily stores these data separately.

[0057] Specifically, the data integration unit 154 is configured to integrate the data from the different data sources to obtain the aggregated data package. It should be understood that due to differences in data formats, field naming, and structural specifications from different data sources—for example, academic qualifications information returned by the education department is presented in XML format, while social security records from the human resources and social security department are structured in JSON—directly utilizing these heterogeneous data types can make it difficult to uniformly process the review logic of the business acceptance service, increasing the complexity and error probability of the review process. Furthermore, the raw data may contain redundant information irrelevant to the business. If not integrated and cleansed, this can affect review efficiency. Therefore, data integration is required to form a unified data package. Specifically, heterogeneous data from different data sources is converted to a unified data format, such as standardized JSON. Field naming is standardized, redundant information is removed, and missing associated identifiers, such as user unique IDs, are supplemented to ensure consistency in data structure and field meaning. This provides the business acceptance service with a unified structure and precise content for review based on business logic, reducing review barriers caused by data format differences. The aggregated data packets feature a unified format, standardized fields, and complete content, eliminating data heterogeneity across different data sources. This allows business acceptance services to directly perform audit logic processing based on a unified structure, significantly improving audit efficiency. The removal of redundant information reduces data processing volume and lowers system resource consumption. At the same time, unified association identifiers ensure the accurate binding of each data item to the user's identity, avoiding data confusion and providing a data foundation for the accuracy of subsequent audit results.

[0058] Specifically, in one possible embodiment, the data integration unit 154 operates as follows: After the business acceptance service receives data from the education department, the Human Resources and Social Security Bureau, and the Housing and Urban-Rural Development Commission, it first converts the XML-formatted educational information returned by the education department into JSON format, extracting core fields such as highest educational level and graduation institution, and mapping them into standardized fields such as "education level" and "graduation institution name." Next, it processes the JSON data of social security records from the human resources and social security department, standardizing fields such as the number of consecutive payment months and payment status into continuous social security payment duration and social security status. Then, it converts the real estate information data from the Housing and Urban-Rural Development Commission, clarifying the property ownership status field to indicate whether a person owns their own home. During the integration process, all redundant fields unrelated to the talent introduction subsidy review, such as course grade records from the education department, are removed, and each data item is assigned a unique user identifier within the platform. The resulting aggregated data package is presented in a unified JSON format, containing standardized fields such as educational level, continuous social security payment duration, and whether a person owns their own home, with a clear structure and precise content.

[0059] In the above-mentioned city platform based on the national network identity authentication public service, the data review module 160 is used for the business acceptance service to review the aggregated data packet based on business logic to obtain the review result. In a specific example of the present application, the data review module 160 includes: the business acceptance service performs parallel verification on the aggregated data packet based on business logic to determine whether the user meets all the conditions for the talent introduction subsidy to obtain the review result. Specifically, the preset talent introduction subsidy application conditions are loaded through the business acceptance service, such as the academic qualification must be a doctorate or above, continuous social security payments for the past 6 months, no local self-owned property, etc., and the various data in the aggregated data packet are compared and verified with these conditions one by one to determine whether the user meets all the requirements, and finally generate a clear review result, such as passed review, additional materials required, and rejected review, to achieve standardization and automation of the review process, ensure that the results comply with policy specifications, and provide a basis for subsequent feedback to users.

[0060] In particular, in a possible embodiment, the implementation process of the data review module 160 is as follows: first, the educational information in the data packet is extracted, and compared with the doctoral degree or above required by the policy to confirm that the user's educational qualifications meet the requirements. Next, the module parses the social security records to verify whether the social security payment status in the past 6 months is continuous and normal payment, and there is no interruption record, which meets the policy requirement of continuous social security payment for 6 months. Subsequently, the module verifies the real estate information to confirm that the user currently has no self-owned real estate in the local area and meets the conditions for non-homeowners. During the comparison process, if a certain data does not meet the conditions, such as a one-month interruption in social security, the module will automatically mark the abnormal item and generate an audit result that requires additional social security payment instructions. If all data meet the policy requirements, the module will generate a conclusion that the audit has passed and associate it with the corresponding policy terms. The entire audit process is automatically executed by the system without manual intervention. All comparison results are recorded in the business log to ensure traceability.

[0061] In particular, in another preferred embodiment, the business acceptance service first performs parallel verification on the aggregated data packets based on the various rules in the business logic to obtain multiple rule verification results. This maximizes the efficiency and response speed of data review, ensuring comprehensive coverage of all relevant rules in the shortest possible time. The implementation effect is to significantly shorten the waiting time for business processing, improve the platform's ability to handle complex business operations, provide citizens with a more efficient service experience, and reduce the processing pressure on the backend system. For the Boolean type results obtained by the rule engine verifying data one by one / in parallel, a simple logical "AND" operation may not be able to obtain an accurate status judgment. In particular, the logical "AND" operation of the Boolean type result can only be used for "true" and "false" situations that meet the rules, but cannot obtain specific business rule details. In addition to "approved" and "rejected", the status also includes the possible "pending manual review" status. In other words, the precise logic of the Boolean type result conflicts with the logic of the fuzzy boundary of the status judgment, thereby reducing the corresponding accuracy.

[0062] Preferably, a codec model is designed for rule semantics and combined with rule results to perform mapping between different logical forms. The Boolean check result of each rule is combined with the predefined business semantics of the rule through semantic coding, for example, whether the rule is about education, social security years or place of residence, etc., and converted into a high-dimensional, continuous rule check result encoding feature vector. The rule check result encoding feature vector is not just a simple mapping of 0 or 1, but contains deep semantic information such as the type, weight, and associated data fields of the rule, so that the system can understand the true meaning of the rule, rather than just its superficial pass or fail. In this way, the discrete Boolean results lacking contextual information are promoted to a continuous, semantically rich intermediate logical form, providing richer and more expressive basic data for subsequent intelligent analysis and decision-making.

[0063] Specifically, the encoder model adopts a model based on the Transformer architecture, which has demonstrated excellent performance in processing complex semantic understanding and feature encoding tasks. The Transformer architecture, with its self-attention mechanism, enables the model to pay attention to different position information of the input sequence while processing sequence data, and accurately grasp the global semantic associations. Specifically, the encoder performs semantic encoding on the verification results of each rule. It first performs semantic encoding on the verification results of each rule, extracts meta-information such as rule type (such as education, social security, real estate, etc.), rule weights and associated data fields, and converts the rule type into a 128-dimensional semantic vector through the embedding layer. The rule weight and data field features are combined to generate a 193-dimensional initial feature vector, which is then processed by a 2-layer fully connected network to obtain a 128-dimensional standardized rule feature vector, and the output rule Boolean type result is represented probabilistically in the semantic space. If the verification result meets the rule requirement of "true", the probabilistic representation is The probability that the check result does not meet the rules is expressed as "false" is divided by the total number of rules. ,This is to unify the Boolean type results under simple and ,professional rule engines under the associated probabilistic fuzzy bounds in order to ,promote robust classification by probabilistic numerical representation classes.

[0064] Then, the plurality of rule verification results are encoded to obtain a plurality of rule verification result encoding feature vectors, and the number of rule verification results that are determined to meet the rule in the plurality of rule verification results is divided by the total number of rule verification results to obtain a probabilistic value. Then, the rule verification result encoding feature vector of each rule verification result is obtained. , in response to the rule verification result encoding feature vector corresponding to the rule verification result that meets the rule, it is activated by the probabilistic activation function and then multiplied by the probabilistic value, that is, In response to the rule verification result encoding feature vector corresponding to the rule verification result that does not conform to the rule, the probabilistic activation function is activated and then multiplied by one minus the probabilistic value, that is, , to obtain multiple confidence-adjusted feature vectors. Among them, For the confidence-adjusted feature vector, is the sigmoid activation function, For the The result encoding feature vector of rule verification is: for The corresponding probabilistic value. That is, in order to introduce the probabilistic fuzzy boundary for the rule semantics, intervals for binary confidence Fuzzy association. This allows the model to perform more flexible assessments of individual rule compliance, preventing the entire business from being simply rejected due to non-compliance with a non-critical rule. Furthermore, each rule's semantic feature vector carries richer contextual information, more accurately reflecting its contribution and certainty in the overall business review, providing a more reliable basis for subsequent refined decision-making.

[0065] For the semantic encoding vector after confidence adjustment, for example, it is recorded as , calculate the confidence loss value of each confidence-adjusted feature vector in the multiple confidence-adjusted feature vectors:

[0066] here, means taking the base 2 logarithm of each eigenvalue of the eigenvector, and is the norm of the vector, which is used to balance the information loss of rule semantics under the Boolean probabilistic fuzzy boundary. is the sigmoid activation function, For the The result encoding feature vector of rule verification is: For the confidence-adjusted feature vector, Calculate the confidence loss value function. This makes the final rule verification result encoding feature vector more optimized and reliable, providing high-quality input for the decoder to output the final audit result.

[0067] In this way, the confidence loss value can be used as the center point, the probabilistic limit can be used as the range parameter, and the confidence membership function can be introduced to correct the semantic coding vector. That is, semantic coding correction is performed based on the confidence loss value and the probabilistic value to obtain multiple optimized rule verification result coding feature vectors:

[0068] in, For the The optimized rule verification result encoding feature vector, For the confidence-adjusted feature vector, is the confidence loss value calculation function, For the The result encoding feature vector of rule verification is: for The corresponding probabilistic value.

[0069] This improves the certainty of the application of confidence-based quantified rules to semantics, that is, the Boolean output is fuzzified as a whole through confidence, and then the fuzzy membership function of confidence is used to quantify the certainty of the rule fuzzification application to semantics, so that it is delimited based on confidence around the confidence loss value, and semantic fuzzy association is performed within the rule decision boundary defined by the Boolean rule fuzzification parameters, thereby improving the fuzzy correspondence accuracy of the decoder output.

[0070] Finally, the encoded feature vectors of the optimized rule-verification results are input into a decoder to obtain the audit result. The decoder utilizes a multi-layer, fully connected neural network architecture incorporating an attention mechanism. The attention layer first processes the input optimized feature vectors, assigning weights by calculating the correlation between each vector and the business objective. For example, in the talent introduction subsidy review, optimized vectors related to academic qualifications may have a higher weight than those related to real estate. This generates a weighted, fused global feature vector. The global feature vector then enters a two-layer hidden layer, consisting of 64 neurons each and using the ReLU activation function, for nonlinear transformation to extract high-order semantic features. Finally, the output layer uses a softmax function to map the processed features into a probability distribution of three outcomes: "approved," "pending manual review," and "failed." The highest probability is taken as the final audit result. Specifically, the decoder performs comprehensive analysis and pattern recognition on these complex, high-dimensional, optimized, rule-verification result encoded feature vectors, mapping them into a clear and concise business audit result, such as "approved," "pending manual review," or "failed." By learning from a large amount of business rules and historical audit data, the decoder can understand the final business decision represented by different combinations of semantic feature vectors. This achieves a seamless connection from underlying data verification to final business decision-making, enabling the city platform to automatically output accurate and intelligent audit results, greatly improving the intelligence level and efficiency of business processing, and effectively solving the time-consuming, labor-intensive and inefficient problems of manual review under the traditional model, ultimately providing citizens with a convenient and reliable "one-stop" service experience.

[0071] In the above-mentioned city platform based on the national network identity authentication public service, the audit result return module 170 is used to return the audit result to the city platform client. That is, the audit results generated by the business acceptance service are transmitted to the city platform client in a clear and easy-to-understand form, and displayed to the user through the client interface, which reduces the time cost and operation complexity of information query and significantly improves the user experience. The specific instructions contained in the results, such as the reason for rejection and the requirement for supplementary materials, provide users with clear action guidelines, avoiding repeated applications or invalid operations due to ambiguous information. At the same time, the timeliness of the result feedback enhances the user's trust in the platform service, promotes the closed loop of the entire chain of business processes from application to result feedback, and improves the service quality and efficiency of the city platform.

[0072] Specifically, in one possible embodiment, the implementation process of the review result return module 170 is as follows: After the business acceptance service generates the review results, it immediately structures the results, integrating the conclusion of approval, the basis (e.g., compliance with educational qualifications, social security, and real estate requirements), and subsequent instructions (e.g., the subsidy will be disbursed to your linked bank card within 15 working days) into a standardized data format. The service then transmits this data to the city platform client via an encrypted communication channel, employing end-to-end encryption to ensure information security. After receiving the data, the client parses and converts it into a user-friendly display format. The application page displays "approval" with a prominent title, followed by a detailed explanation below: "You have a doctorate, have paid social security continuously for the past six months, and do not own local real estate. You meet the requirements for applying for the talent introduction subsidy. The subsidy will be disbursed to your bank card ending in XXXX within 15 working days. Please check." The client also provides a detailed portal, allowing users to click to view the complete review basis and policy terms. If the review result indicates that additional materials are required, the client will provide a list of specific materials and an upload interface to guide the user through the supplementary process.

[0073] In summary, the city platform based on the national network identity authentication public service based on the embodiment of the present application is explained. It first uses the national network identity authentication public service to complete user identity authentication to establish a trusted access basis. When the user handles the business, it builds a data request contract and stores it after the user confirms the authorization, forming a transparent and traceable authorization mechanism. Then, based on the user's authorization scope, a data token with limited access is generated, and the required cross-source data is obtained based on a unified data aggregation service to achieve on-demand aggregation and secure flow of data. The aggregated data is then automatically audited through business logic to obtain the audit results, and the audit results are finally returned to the user. In this way, the business process can be simplified, the problems of repeated authorization and data islands can be solved, while the user's data control is guaranteed, and the intelligence and efficiency of the city platform's business handling can be improved.

[0074] Furthermore, a service method of a city platform based on national network identity authentication public services is also provided.

[0075] Figure 7 Flowchart of the service method of the city platform based on the national network identity authentication public service according to the embodiment of the present application. Figure 7As shown, the service method of the city platform based on the national network identity authentication public service includes the following steps: S1, in response to a login request initiated by a user on the city platform client, user identity authentication is performed based on the national network identity authentication public service and a platform master access token is generated after the identity authentication is successful; S2, in response to the user clicking to apply for talent introduction subsidy, the city platform client initiates a business request to the background business acceptance service, wherein the business acceptance service generates a data request contract draft in response to the business request; S3, the data request contract draft is displayed on the city platform client, and in response to the user clicking the consent authorization button, the data request contract is executed. The draft agreement is submitted to the authorization evidence chain of the city platform and an authorization receipt is returned; S4, in response to receiving the authorization receipt, a business data token is generated, and the audience of the business data token is limited to the data aggregation service; S5, in response to obtaining the business data token, the business acceptance service calls the platform's unified data aggregation service interface and receives and aggregates data from different data sources based on the data range field authorized to be accessed in the business data token to obtain an aggregated data packet; S6, the business acceptance service reviews the aggregated data packet based on business logic to obtain an audit result; S7, returns the audit result to the city platform client.

[0076] As described above, the service method of the city platform based on the national network identity authentication public service according to the embodiment of the present application can be implemented in various wireless terminals. In one possible implementation method, the service method of the city platform based on the national network identity authentication public service according to the embodiment of the present application can be integrated into the wireless terminal as a software module and / or hardware module. For example, the service method of the city platform based on the national network identity authentication public service can be a software module in the operating system of the wireless terminal, or it can be an application developed for the wireless terminal; of course, the service method of the city platform based on the national network identity authentication public service can also be one of the many hardware modules of the wireless terminal.

[0077] Alternatively, in another example, the service method of the city platform based on the national network identity authentication public service and the wireless terminal may also be separate devices, and the service method of the city platform based on the national network identity authentication public service may be connected to the wireless terminal through a wired and / or wireless network and transmit interactive information in accordance with an agreed data format.

[0078] Here, those skilled in the art will appreciate that the specific operations of each step in the above-mentioned service method of the city platform based on the national network identity authentication public service have been referred to above. Figures 1 to 6 It has been introduced in detail in the description of the city platform based on the national network identity authentication public service, and therefore, its repeated description will be omitted.

Claims

1. A city platform based on national network identity authentication public services, characterized by: include: A user identity authentication module is used to respond to a login request initiated by a user on the city platform client, perform user identity authentication based on the national network identity authentication public service, and generate a platform primary access token after successful identity authentication; A business request and contract generation module, configured to: in response to a user clicking to apply for a talent introduction subsidy, the city platform client initiates a business request to the backend business acceptance service; wherein the business acceptance service generates a data request contract draft in response to the business request; The contract authorization and evidence storage module is used to display the draft data request contract on the city platform client and, in response to the user clicking the "Agree to Authorization" button, submit the draft data request contract to the authorization evidence storage chain of the city platform and return an authorization receipt; A business data token generation module, configured to generate a business data token in response to receiving the authorization receipt, wherein the audience of the business data token is limited to the data aggregation service; a data aggregation module configured to, in response to obtaining the business data token, cause the business acceptance service to call an interface of a unified data aggregation service of the platform and receive and aggregate data from different data sources based on the data range field in the business data token to obtain an aggregated data packet; A data audit module, used for the business acceptance service to audit the aggregated data packets based on business logic to obtain an audit result; The audit result returning module is used to return the audit result to the city platform client.

2. The city platform based on national network identity authentication public services according to claim 1 is characterized in that: The user identity authentication module includes: A platform jump unit, configured to jump to the national network identity authentication public service in response to a login request initiated by a user on a city platform client; The facial recognition authentication unit is used for national network identity authentication public services to authenticate users through facial recognition; an authorization code generating and returning unit, configured to generate an authorization code for the national network identity authentication public service in response to a successful identity authentication and return the authorization code to the city platform client; The authorization code transmission unit is used for the city platform client to send the authorization code to the identity authentication service; The authorization code verification unit is used for the identity authentication service to verify the validity of the authorization code to the national network identity authentication public service through the back-end signal, and generate the platform main access token after the verification is successful.

3. The city platform based on national network identity authentication public services according to claim 1 is characterized in that: The business request and contract generation module includes: A service request initiating unit, configured to, in response to a user clicking to apply for a talent introduction subsidy, initiate a service request from the city platform client to the backend service acceptance service by carrying the platform primary access token; A user identity confirmation unit, configured for the business acceptance service to confirm the user identity based on the platform primary access token after receiving the business request; A data requirement template loading unit, configured for the business acceptance service to load a data requirement template corresponding to the service ID from a configuration center based on the service ID in the business request; The data request contract draft generating unit is used for the business acceptance service to call the authorization center service and combine the data requirement template to generate the data request contract draft for the business request.

4. The city platform based on national network identity authentication public service according to claim 1 is characterized in that: The contract authorization and evidence storage module includes: An informed consent action generating unit, configured to generate a user informed consent action in response to the user clicking the consent authorization button; An informed consent and token sending unit, configured to send the user informed consent action together with the platform primary access token to an authorization center service; The authorization evidence submission unit is used for the authorization center service to encapsulate the user's informed consent action and data request contract draft into a transaction and submit it to the authorization evidence chain of the city platform.

5. The city platform based on national network identity authentication public service according to claim 1 is characterized in that: The business data token generation module is used to: In response to receiving the authorization receipt, the authorization center service generates the business data token based on the contract content of the data request contract draft, where the business data token includes a data scope field and an audience field for which access is authorized.

6. The city platform based on national network identity authentication public services according to claim 1 is characterized in that: The data aggregation module includes: The token verification unit is used for the business acceptance service to verify the signature, timeliness and whether the recipient of the business data token is itself; A data range parsing unit, configured to parse the content of the data range field authorized to be accessed from the business data token by the business acceptance service after successful verification; A data request unit, configured to initiate requests to different data sources and receive data from different data sources based on the content of the data range field permitted to be accessed by the authorization; The data integration unit is used to integrate the data from different data sources to obtain the aggregated data packet.

7. The city platform based on national network identity authentication public service according to claim 1 is characterized in that: The data review module is used for: the business acceptance service performs parallel verification on the aggregated data packets based on business logic to determine whether the user meets all the conditions for the talent introduction subsidy to obtain the review result.

8. A service method based on a city platform for national network identity authentication public services, characterized in that: include: In response to a login request initiated by a user on the city platform client, user identity authentication is performed based on the national network identity authentication public service and a platform primary access token is generated after successful identity authentication; In response to the user clicking to apply for the talent introduction subsidy, the city platform client initiates a business request to the backend business acceptance service, wherein the business acceptance service generates a data request contract draft in response to the business request; Display the draft data request contract on the city platform client, and in response to the user clicking the consent authorization button, submit the draft data request contract to the authorization evidence chain of the city platform and return an authorization receipt; In response to receiving the authorization receipt, generating a business data token, wherein the audience of the business data token is limited to the data aggregation service; In response to obtaining the business data token, the business acceptance service calls the platform's unified data aggregation service interface and receives and aggregates data from different data sources based on the authorized access data range field in the business data token to obtain an aggregated data packet; The business acceptance service reviews the aggregated data packets based on business logic to obtain a review result; Return the review results to the city platform client.

Images