Digital identity data information access control security protection system and method
By calculating the time phase shift difference and generational difference rate to select a legitimate key set, a collision-resistant generational fingerprint is generated, which solves the problem of key set synchronization and update differences, ensuring the security and efficiency of digital identity authentication and adapting to complex network environments.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-16
- Publication Date
- 2026-03-13
AI Technical Summary
In existing technologies, digital identity authentication security risks arise from key set asynchrony between the cache and the origin server, differences in key generation updates, cross-stage time delays, and issues with the accuracy of signature verification and decryption. These risks are particularly high in complex network architectures, leading to verification failures and data tampering.
By parsing the authorization response data, calculating the time phase shift difference and generational difference rate, selecting a legitimate key set, and generating a collision-resistant generational fingerprint, the consistency and validity of the key set are ensured by combining signature verification and secondary verification. A time tolerance threshold is introduced to adapt to network latency.
It effectively avoids verification failures caused by cache expiration and key rotation, prevents the risk of false responses and data tampering, ensures authentication security and system fault tolerance, and adapts to digital identity access control under complex network architectures.
Smart Images
Figure CN121664543A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of information security access technology, and more specifically, to a security protection system and method for access control of digital identity data information. Background Technology
[0002] With the development of the Internet and cloud computing, digital identity authentication has become a core element in ensuring user data and system security. For example, protocols such as OpenID Connect and OAuth2.0 are widely used in the interaction between identity providers and clients. As the basis for signature verification and encryption / decryption, the security and consistency of the key set directly determine the validity of the authentication.
[0003] However, the existing architecture typically suffers from the following problems: 1. Inconsistency between cached and origin server key sets: To improve access efficiency, key sets are often distributed through cache nodes such as CDNs and reverse proxies. However, cached node data has a residency period. When the authorization server updates the key set, the client may still obtain an expired key set from the cache, resulting in a discrepancy with the latest key set from the origin server and causing verification failure. 2. Differences in key generation updates: To enhance security, the authorization server periodically rotates keys. New keys and retained old keys create a scenario where multiple generations of keys coexist. If the client cannot identify the current valid key generation, it is easy to use an expired key for operation. 3. Cross-stage time delays: The authentication process involves multiple stages such as response reception, signature verification, and token exchange. Network transmission or server processing delays may cause the key set to be updated within the stage interval. The client may not be aware of the update and continue to operate, leading to security risks. 4. Accuracy issues in signature verification and decryption: JWS and JWE format responses need to match the corresponding keys and algorithms. Inconsistencies in the above key sets may cause the client to use incorrect keys or algorithms, making it impossible to identify forged or tampered response data and threatening authentication security.
[0004] Therefore, there is an urgent need for a digital identity data access control security protection system to solve the above problems. Summary of the Invention
[0005] This invention provides a security protection system and method for access control of digital identity data information, which solves the technical problems mentioned in the background.
[0006] This invention provides a security protection system for access control of digital identity data information, comprising: The data parsing module is used to parse the response data returned by the authorization server to the client and read the target issuer identifier and key set address from the session record; The response data includes: issuer identifier, key identifier, signature method, and encryption method; The phase shift difference calculation module is used to obtain two key sets for the same key set address via a cache path and a direct connection to the source station, respectively, and read the cache dwell time field in the two responses to calculate the difference between the two to obtain the time phase shift difference; The key set selection module is used to perform intersection-union comparison of the key identifier sets of two key sets to obtain the generational difference rate, and to determine the selected key set based on this and the time phase shift difference. The generational fingerprint calculation module is used to sort and concatenate the key identifier list of the selected key set to obtain a normalized string, and then perform collision-resistant hashing on it to obtain the generational fingerprint. The signature verification module is used to complete the signature verification based on the public key in the selected key set and the signature and encryption methods of the response data. If the verification fails, the authorization callback is rejected. The secondary verification module is used to obtain the latest key set again through direct connection to the source server before initiating token exchange, and generate the latest generation fingerprint and compare it with the existing generation fingerprint. If the two match, authorization callback is allowed; otherwise, authorization callback is rejected.
[0007] Furthermore, if the target issuer identifier read from the session record and the issuer identifier in the response data are completely equal byte-by-byte, the authorization callback is allowed; otherwise, the authorization callback is rejected.
[0008] Further, the time phase shift difference is calculated, including the following steps: Step S201: Associate the key set address with the target issuer identifier; Step S202: Send a request to the key set address via the cache path to obtain the cache perspective key set, and read the cache dwell time field in the HTTP response header as the cache perspective dwell time; Step S203: Send a request to the key set address via direct connection to the origin server to obtain the key set from the origin server's perspective, and read the cache dwell time field in the HTTP response header as the dwell time from the origin server's perspective; Step S204: Calculate the absolute value of the difference between the dwell time of the cache view and the dwell time of the source view as the time phase shift difference; Step S205: Verify that the source of both the cache view key set and the origin view key set is the same key set address and is bound to the target issuer identifier.
[0009] Furthermore, the intergenerational difference rate The calculation formula is as follows: ,in Indicates the cached view key set. This represents the key set from the source server's perspective. Indicates intersection, Represents the union, Indicates the number of elements.
[0010] Further, the selected key set is obtained based on the intergenerational difference rate and the time phase shift difference, including the following steps: Step S301: Determine whether the key identifier in the response data exists in the cache view key set and the source site view key set, and obtain the cache coverage indicator and the source site coverage indicator respectively; If the key identifier in the response data exists in the cache view key set, then the cache overwrite indicator is set to 1; otherwise, it is set to 0. If the key identifier in the response data exists in the source station's view key set, then the source station coverage indicator is set to 1; otherwise, it is set to 0. Step S302: Obtain the time determination quantity based on the time phase shift difference, and obtain the structure determination quantity based on the intergenerational difference rate; If the time phase difference is less than the time phase difference threshold, the time determination value is set to 1; otherwise, it is set to 0. The time phase difference threshold is a user-defined parameter. If the intergenerational difference rate is less than the intergenerational difference rate threshold, the structural determination value is set to 1; otherwise, it is set to 0. The intergenerational difference rate threshold is a user-defined parameter. Step S303: Determine the selected key set according to preset rules based on the cache coverage indicator, source server coverage indicator, time determination indicator, and structure determination indicator; When both the time determination quantity and the structure determination quantity are 1 and the cache coverage indicator quantity is 1, the selected key set is the cache perspective key set; When the time determination quantity or structure determination quantity is 0 and the source station coverage indication quantity is 1, the selected key set is the source station perspective key set; If both the cache coverage indicator and the origin server coverage indicator are 0, then the authorization callback is rejected.
[0011] Furthermore, the key identifier list represents the set of all key identifiers in the selected key set. The key identifiers are sorted character by character according to their encoding order. Then, the key identifiers are concatenated without separators according to the sorting result to obtain a normalized string. A collision-resistant hash function is applied to the normalized string to obtain the generational fingerprint. The issuer identifier, key set address, generational fingerprint, key identifier, and verification time are concatenated in a fixed order. The same collision-resistant hash function used to generate the generational fingerprint is applied to the concatenated string to generate commitment data. This commitment data is then associated with the current session record and stored, and declared as read-only.
[0012] Furthermore, when the response data is in JWS format, the public key corresponding to the key identifier in the selected key set is used, combined with the signature method in the response data, to verify the signature of the payload data in the JWS. If the verification is successful, the authorization callback is allowed; otherwise, the authorization callback is rejected. When the response data is in JWE format, the private key corresponding to the key identifier in the selected key set and the encryption method are first used to decrypt the JWE to restore the JWS format. Then, the payload data in the JWS is verified by using the signature method in the response data. If the verification is successful, the authorization callback is allowed; otherwise, the authorization callback is rejected.
[0013] Furthermore, before initiating a token exchange, the latest key set is obtained again through a direct connection to the origin server. The key identifier list of the latest key set is sorted and concatenated to obtain a normalized string, and then subjected to collision-resistant hashing to obtain the latest generational fingerprint. If the latest generational fingerprint matches the existing generational fingerprint, the authorization callback is allowed; otherwise, the authorization callback is rejected.
[0014] Furthermore, the difference between the current timestamp and the verification time in the commitment data is calculated. If the difference is less than or equal to the time tolerance threshold, the authorization callback is allowed; otherwise, the authorization callback is rejected. The time tolerance threshold is a custom parameter.
[0015] This invention provides a method for security protection of digital identity data access control, comprising the following steps: Step S401: Parse the response data returned by the authorization server to the client, and read the target issuer identifier and key set address from the session record; Step S402: For the same key set address, obtain two key sets respectively via the cache path and the direct connection to the source station, and read the cache dwell time field in the two responses, calculate the difference between the two to obtain the time phase shift difference; Step S403: Perform intersection-union comparison on the key identifier sets of the two key sets to obtain the generational difference rate, and use this and the time phase shift difference to determine the selected key set; Step S404: Sort and concatenate the key identifier list of the selected key set to obtain a normalized string, and perform anti-collision hashing on it to obtain the generational fingerprint; Step S405: Complete signature verification based on the public key in the selected key set and the signature and encryption methods of the response data. If the verification fails, the authorization callback is rejected. Step S406: Before initiating the token exchange, obtain the latest key set again through direct connection to the source server, and generate the latest generational fingerprint based on it. Compare the new generational fingerprint with the existing generational fingerprint. If they match, the authorization callback is allowed; otherwise, the authorization callback is rejected.
[0016] The beneficial effects of this invention are as follows: This invention analyzes the authorization response data and locks the legitimate data source, quantifies the time phase difference between the cache and the origin server key set, accurately selects the effective key set by combining the generational difference rate, and generates a collision-resistant generational fingerprint by sorting and concatenating the key identifiers of the selected key set. The generational state of the key is solidified and associatedly stored to prevent tampering. Verification is completed based on the signature and encryption method of the selected key and the response data to ensure the authenticity and integrity of the data. Before initiating the token exchange, the generational fingerprint of the latest key set is verified again. At the same time, a time tolerance threshold is introduced to adapt to network latency, thereby effectively avoiding verification failures caused by cache expiration and key rotation, preventing the risk of false responses and data tampering, and taking into account authentication security, system fault tolerance and operating efficiency, thus adapting to the digital identity access control requirements under complex network architectures. Attached Figure Description
[0017] Figure 1 This is a schematic diagram of a digital identity data information access control security protection system according to the present invention; Figure 2 This is a flowchart of the calculation of the time phase shift difference according to the present invention; Figure 3 This is a flowchart of the present invention for determining the selected key set based on the generational difference rate and the time phase shift difference; Figure 4 This is a flowchart of a digital identity data information access control security protection method according to the present invention.
[0018] In the diagram: Data parsing module 101, phase shift difference calculation module 102, key set selection module 103, generational fingerprint calculation module 104, signature verification module 105, and secondary verification module 106. Detailed Implementation
[0019] The subject matter described herein will now be discussed with reference to exemplary embodiments. It should be understood that these embodiments are discussed only to enable those skilled in the art to better understand and implement the subject matter described herein, and changes may be made to the function and arrangement of the elements discussed without departing from the scope of this specification. Various processes or components may be omitted, substituted, or added as needed in the examples. Furthermore, features described in some examples may be combined in other examples.
[0020] It should be noted that, unless otherwise defined, the technical or scientific terms used in one or more embodiments of the present invention should have the ordinary meaning understood by one of ordinary skill in the art to which this invention pertains. The terms "first," "second," and similar terms used in one or more embodiments of the present invention do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" indicate that the element or object preceding the term encompasses the elements or objects listed following the term and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are used only to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.
[0021] like Figures 1-4 As shown, a digital identity data information access control security protection system includes: The data parsing module 101 is used to parse the response data returned by the authorization server to the client and read the target issuer identifier and key set address from the session record; The response data includes: issuer identifier, key identifier, signature method, and encryption method; The phase shift difference calculation module 102 is used to obtain two key sets for the same key set address via a cache path and a direct connection to the source station, respectively, and read the cache dwell time field in the two responses to calculate the difference between the two to obtain the time phase shift difference; The key set selection module 103 is used to perform intersection-union comparison of the key identifier sets of two key sets to obtain the generational difference rate, and to determine the selected key set based on this and the time phase shift difference. The generational fingerprint calculation module 104 is used to sort and concatenate the key identifier list of the selected key set to obtain a normalized string, and perform anti-collision hashing on it to obtain the generational fingerprint. The signature verification module 105 is used to complete the signature verification based on the public key in the selected key set and the signature method and encryption method of the response data. If the verification fails, the authorization callback is rejected. The secondary verification module 106 is used to obtain the latest key set again through direct connection to the source server before initiating token exchange, and generate the latest generation fingerprint and compare it with the existing generation fingerprint. If the two match, authorization callback is allowed; otherwise, authorization callback is rejected.
[0022] It's important to note that when a client needs to obtain a user's digital identity authorization, it first sends an authentication request to the corresponding authorization server. This could involve the user entering their account and password to log in, or scanning a QR code for verification. After authentication, the authorization server sends response data containing the authorization result to the client according to pre-agreed interaction rules. The client retrieves the response data through the callback address used when initiating the request, which is then used for subsequent identity verification and permission acquisition. The issuer identifier clearly identifies the issuing entity of the response data, ensuring the client can recognize the issuing entity. The key identifier is a unique number among multiple sets of keys used for signing or encryption by the authorization server. The client can find the corresponding key from the publicly available key set of the authorization server using the key identifier. The key is used for subsequent verification of the response data; the signature method is the technical means used by the authorizing server to sign and protect the response data. The client needs to use the same signature method to verify whether the response data has been tampered with during transmission and whether it truly comes from the corresponding authorizing server; the encryption method is the technical means used by the authorizing server to encrypt and protect the response data. The client needs to use the corresponding decryption method to read the encrypted response data; the key set address is a network address publicly disclosed by the authorizing server. The client can obtain the public key set of the authorizing server through this address. These public keys are used to verify the signature of the response returned by the authorizing server or to decrypt the encrypted response data to ensure that the response comes from a legitimate authorizing server and has not been tampered with.
[0023] In one embodiment of the present invention, if the target issuer identifier read from the session record and the issuer identifier in the response data are completely equal byte by byte, then the authorization callback is allowed; otherwise, the authorization callback is rejected.
[0024] It's important to note that a session record is a context record created by the client for this authorization transaction. This can be achieved through server-side session storage, signed request objects, or other means. When a user first accesses the site, the session record is generated during authorization. Specifically, after the user selects or the system defaults to selecting an authorizer, the client first determines the authorizer's identifier and related information, creates an authorization transaction record, and places the record index in the status information. The client then redirects to the authorizer. When the authorizer calls back, the client uses the status information carried in the callback to find the newly created transaction record, thus comparing the target issuer identifier with the current issuer identifier. This comparison ensures that the received response data truly comes from the target authorization server the client is connecting to, and not from any other fake or illegitimate server. This method prevents fake authorization servers from forging response data to deceive the client, thus locking in the correct data source for all subsequent verification operations.
[0025] In one embodiment of the present invention, such as Figure 2 As shown, the calculation of the time phase shift difference includes the following steps: Step S201: Associate the key set address with the target issuer identifier; Step S202: Send a request to the key set address via the cache path to obtain the cache perspective key set, and read the cache dwell time field in the HTTP response header as the cache perspective dwell time; Step S203: Send a request to the key set address via direct connection to the origin server to obtain the key set from the origin server's perspective, and read the cache dwell time field in the HTTP response header as the dwell time from the origin server's perspective; Step S204: Calculate the absolute value of the difference between the dwell time of the cache view and the dwell time of the source view as the time phase shift difference; Step S205: Verify that the source of both the cache view key set and the origin view key set is the same key set address and is bound to the target issuer identifier.
[0026] It should be noted that steps S201 and S202 form a closed loop of pre-marking and post-verification. That is, before the request is initiated, the key set address is marked as belonging to the target issuer. After obtaining the dual-view key sets, it is confirmed again that both key sets come from the authorization server corresponding to the target issuer's identifier, thus avoiding errors in subsequent time phase shift difference calculation and view selection due to network path or resource errors. Initiating a request to the key set address via a cached path means first passing through cache nodes in the network, such as a content delivery network or reverse proxy server, to obtain the key set data. If the cache node has already stored the key set and it has not expired, it directly returns the data without accessing the origin server. Initiating a request to the key set address via a direct connection to the origin server means that the client bypasses all... The intermediate cache node directly connects to the origin server of the authorization server to obtain the latest key set data from the origin server, ensuring that the obtained key set is the current real and valid key set of the authorization server and is not affected by the data of the intermediate cache node. The cache dwell time field is used to indicate the time that the currently returned response data has been stored in the cache node, in seconds. The purpose of calculating the time phase shift difference is to quantify the time difference of the key set data from the perspective of the cache and the perspective of the origin server. Through this difference, it can be determined whether the key set in the cache is in a similar time slice to the latest key set of the origin server. The larger the difference, the greater the risk of inconsistency between the cache data and the origin server data. This difference provides a quantitative basis for subsequent judgment and selection of key set, avoiding blindly using cache or origin server data, which may lead to verification failure.
[0027] In one embodiment of the present invention, the generational difference rate The calculation formula is as follows: ,in Indicates the cached view key set. This represents the key set from the source server's perspective. Indicates intersection, Represents the union, Indicates the number of elements.
[0028] It should be noted that the number of elements in the intersection represents the total number of identical key identifiers that exist simultaneously in both the cache-view key set and the source-view key set, while the number of elements in the union represents the total number of all unique key identifiers in both the cache-view key set and the source-view key set. The generational difference rate is used to quantify the degree of difference between the cache-view key set and the source-view key set at the key generation level. That is, the closer the value is to zero, the higher the overlap between the two key sets, the more common key identifiers there are, and the smaller the difference between the two at the key generation level. Otherwise, the difference is greater. This indicator provides a basis for selecting a more suitable key set in the future.
[0029] In one embodiment of the present invention, such as Figure 3 As shown, the selected key set is obtained based on the intergenerational difference rate and the time phase shift difference, including the following steps: Step S301: Determine whether the key identifier in the response data exists in the cache view key set and the source site view key set, and obtain the cache coverage indicator and the source site coverage indicator respectively; If the key identifier in the response data exists in the cache view key set, then the cache overwrite indicator is set to 1; otherwise, it is set to 0. If the key identifier in the response data exists in the source station's view key set, then the source station coverage indicator is set to 1; otherwise, it is set to 0. Step S302: Obtain the time determination quantity based on the time phase shift difference, and obtain the structure determination quantity based on the intergenerational difference rate; When the time phase difference is less than the time phase difference threshold, the time determination value is set to 1; otherwise, it is set to 0. The time phase difference threshold is a custom parameter. Preferably, the time phase difference threshold is set to 20 seconds. If the intergenerational difference rate is less than the intergenerational difference rate threshold, the structural determination quantity is assigned a value of 1; otherwise, it is assigned a value of 0. The intergenerational difference rate threshold is a user-defined parameter, preferably set to 0.35. Step S303: Determine the selected key set according to preset rules based on the cache coverage indicator, source server coverage indicator, time determination indicator, and structure determination indicator; When both the time determination quantity and the structure determination quantity are 1 and the cache coverage indicator quantity is 1, the selected key set is the cache perspective key set; When the time determination quantity or structure determination quantity is 0 and the source station coverage indication quantity is 1, the selected key set is the source station perspective key set; If both the cache coverage indicator and the origin server coverage indicator are 0, then the authorization callback is rejected.
[0030] It should be noted that typical JSON The lifetime of a Web Key Set (JWKS) cache is typically between tens of seconds and several minutes, and key rotation is mostly on the order of minutes, not frequently changing in a very short period of time. In practical applications, the difference in the arrival time of two requests and the slight time fluctuations caused by intermediate layer cache refreshes usually do not exceed a few seconds. Therefore, setting the time phase difference threshold to 20 seconds can effectively accommodate time fluctuations during network transmission and cache refresh, avoiding unnecessary back-to-origin operations and reducing resource consumption. When JWKS only adds new keys without revoking old keys, the common generation difference rate is mostly below 0.35. That is, if the old key set size is n and the new key set size is n+1, then according to the formula for calculating the generation difference rate, the generation difference rate is equal to 1-n / (n+1)=1 / (n+1). When n=2, the corresponding generation difference rate is 0.333, and when n=3, the corresponding generation difference rate is 0.25. Therefore, setting the generation difference rate threshold to 0.35 allows this secure key evolution method and avoids unnecessary back-to-origin operations.
[0031] It should be noted that the coverage indicator is a necessary condition. If a certain perspective does not contain the key identifier required at the moment, signature verification or decryption cannot be completed. Therefore, the cache coverage indicator and the source site coverage indicator must be checked first. Even if the coverage is valid, it is still necessary to confirm that there is no obvious time slice misalignment or significant generational deviation between the two perspectives. Only when both conditions are met simultaneously can the cache perspective be considered an approximate mirror image of the source site in the same generation. The cache perspective should be used first. When the time determination, structure determination, and cache coverage indicator are all valid, choosing the cache perspective can reduce the cost of going back to the source and maintain the generational semantics consistent with the source site. For security fallback, the source site should be selected as long as the time or structure constraints are not valid and the source site coverage indicator is valid, thus eliminating the phase shift risk of different key sets from the same issuer.
[0032] In one embodiment of the present invention, the key identifier list represents the set of all key identifiers in the selected key set. The key identifiers are sorted character by character according to the encoding order of each character. The key identifiers are then concatenated without separators according to the sorting result to obtain a normalized string. A collision-resistant hash function is applied to the normalized string to obtain a generational fingerprint. The issuer identifier, key set address, generational fingerprint, key identifier, and verification time are concatenated in a fixed order. The same collision-resistant hash function used to generate the generational fingerprint is applied to the concatenated string to generate commitment data. This commitment data is then associated with the current session record and stored, and declared as read-only.
[0033] It should be noted that the collision-resistant hash function can be SHA-256, SHA-384, etc., which transforms the original data into a unique and irreversible string for verifying data integrity. The verification time refers to the predetermined time when the selected key set is used for subsequent signature verification or data decryption. That is, when the client is ready to perform signature verification or key verification, the current timestamp is read as the verification time. Associating the commitment data with the current session record and declaring it as read-only can avoid directly exposing key metadata and ensure that the commitment data is not tampered with, providing a traceable basis for subsequent verification and comparison.
[0034] In one embodiment of the present invention, when the response data is in JWS (JSON Web Signature) format, the public key corresponding to the key identifier in the selected key set is used, combined with the signature method in the response data, to perform signature verification on the payload data in the JWS. If the verification is successful, the authorization callback is allowed; otherwise, the authorization callback is rejected. When the response data is in JWE (JSON Web Encryption) format, the private key corresponding to the key identifier in the selected key set and the encryption method are first used to decrypt the JWE to restore the JWS format. Then, the payload data in the JWS is signed and verified using the signature method in the response data. If the verification is successful, the authorization callback is allowed; otherwise, the authorization callback is rejected.
[0035] In one embodiment of the present invention, before initiating token exchange, the latest key set is obtained again through direct connection to the source server. The key identifier list of the latest key set is sorted and concatenated to obtain a normalized string, and then subjected to collision-resistant hashing to obtain the latest generation fingerprint. If the latest generation fingerprint is consistent with the existing generation fingerprint, the authorization callback is allowed; otherwise, the authorization callback is rejected.
[0036] It should be noted that initiating a token exchange refers to the client sending a request to the authorization server after completing the authentication process and successfully signing all necessary authorizations. This request is used to obtain an access token or authorization code. Initiating a token exchange ensures that the client can securely access the server's restricted resources when it has the necessary permissions. If the latest generational fingerprint matches the existing generational fingerprint, it means that the key set has not changed, and it can be confirmed that the authorization request still comes from the same security source. Otherwise, it means that the key set has changed, and there may be key replacement or other tampering. In this case, for security reasons, the callback request is rejected.
[0037] In one embodiment of the present invention, the difference between the current timestamp and the verification time in the commitment data is calculated, and if it is less than or equal to the time tolerance threshold, the authorization callback is allowed; otherwise, the authorization callback is rejected. The time tolerance threshold is a custom parameter, preferably set to 10 seconds.
[0038] It should be noted that the setting of the time tolerance threshold usually depends on the tolerance for system latency and network conditions in the actual application scenario. During authentication and token exchange, some short delays are normal, especially between servers in multi-layered network architectures or different geographical locations. If the time threshold is set too high, there may be potential security risks. If it is set too low, legitimate requests may be mistakenly rejected due to delays. In distributed systems, delays may occur during data exchange. The above method can prevent authorization requests from being mistakenly rejected due to network latency and other factors, and ensure that only authorization callback requests that are valid within a short period of time are accepted, preventing expired callback requests from remaining valid. This avoids potential security risks caused by authorization requests that have expired due to system expiration.
[0039] In one embodiment of the present invention, such as Figure 4 As shown, a method for security protection of digital identity data access control includes the following steps: Step S401: Parse the response data returned by the authorization server to the client, and read the target issuer identifier and key set address from the session record; Step S402: For the same key set address, obtain two key sets respectively via the cache path and the direct connection to the source station, and read the cache dwell time field in the two responses, calculate the difference between the two to obtain the time phase shift difference; Step S403: Perform intersection-union comparison on the key identifier sets of the two key sets to obtain the generational difference rate, and use this and the time phase shift difference to determine the selected key set; Step S404: Sort and concatenate the key identifier list of the selected key set to obtain a normalized string, and perform anti-collision hashing on it to obtain the generational fingerprint; Step S405: Complete signature verification based on the public key in the selected key set and the signature and encryption methods of the response data. If the verification fails, the authorization callback is rejected. Step S406: Before initiating the token exchange, obtain the latest key set again through direct connection to the source server, and generate the latest generational fingerprint based on it. Compare the new generational fingerprint with the existing generational fingerprint. If they match, the authorization callback is allowed; otherwise, the authorization callback is rejected.
[0040] It should be noted that the interval and threshold sizes are set for ease of comparison. The size of the threshold depends on the amount of sample data and the base number set by those skilled in the art for each set of sample data, as long as it does not affect the proportional relationship between the parameter and the quantized value. Furthermore, the above formulas are all dimensionless calculations, and the formulas are derived from software simulations using a large amount of collected data to obtain the most recent real-world results. The preset parameters in the formulas are set by those skilled in the art according to the actual situation.
[0041] The embodiments of this example have been described above. However, this example is not limited to the specific implementation methods described above. The specific implementation methods described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms based on the guidance of this example, and all of them are within the protection scope of this example.
Claims
1. A security protection system for access control of digital identity data information, characterized in that, include: The data parsing module is used to parse the response data returned by the authorization server to the client and read the target issuer identifier and key set address from the session record; The response data includes: issuer identifier, key identifier, signature method, and encryption method; The phase shift difference calculation module is used to obtain two key sets for the same key set address via a cache path and a direct connection to the source station, respectively, and read the cache dwell time field in the two responses to calculate the difference between the two to obtain the time phase shift difference; The key set selection module is used to perform intersection-union comparison of the key identifier sets of two key sets to obtain the generational difference rate, and to determine the selected key set based on this and the time phase shift difference. The generational fingerprint calculation module is used to sort and concatenate the key identifier list of the selected key set to obtain a normalized string, and then perform collision-resistant hashing on it to obtain the generational fingerprint. The signature verification module is used to complete the signature verification based on the public key in the selected key set and the signature and encryption methods of the response data. If the verification fails, the authorization callback is rejected. The secondary verification module is used to obtain the latest key set again through direct connection to the source server before initiating token exchange, and generate the latest generation fingerprint and compare it with the existing generation fingerprint. If the two match, authorization callback is allowed; otherwise, authorization callback is rejected. The calculation of the time phase shift difference includes the following steps: Step S201: Associate the key set address with the target issuer identifier; Step S202: Send a request to the key set address via the cache path to obtain the cache perspective key set, and read the cache dwell time field in the HTTP response header as the cache perspective dwell time; Step S203: Send a request to the key set address via direct connection to the origin server to obtain the key set from the origin server's perspective, and read the cache dwell time field in the HTTP response header as the dwell time from the origin server's perspective; Step S204: Calculate the absolute value of the difference between the dwell time of the cache view and the dwell time of the source view as the time phase shift difference; Step S205: Verify that the source of both the cache view key set and the origin view key set is the same key set address and is bound to the target issuer identifier; The selected key set is determined based on the generational difference rate and the time phase shift difference, including the following steps: Step S301: Determine whether the key identifier in the response data exists in the cache view key set and the source site view key set, and obtain the cache coverage indicator and the source site coverage indicator respectively; If the key identifier in the response data exists in the cache view key set, then the cache overwrite indicator is set to 1; otherwise, it is set to 0. If the key identifier in the response data exists in the source station's view key set, then the source station coverage indicator is set to 1; otherwise, it is set to 0. Step S302: Obtain the time determination quantity based on the time phase shift difference, and obtain the structure determination quantity based on the intergenerational difference rate; If the time phase difference is less than the time phase difference threshold, the time determination value is set to 1; otherwise, it is set to 0. The time phase difference threshold is a user-defined parameter. If the intergenerational difference rate is less than the intergenerational difference rate threshold, the structural determination value is set to 1; otherwise, it is set to 0. The intergenerational difference rate threshold is a user-defined parameter. Step S303: Determine the selected key set according to preset rules based on the cache coverage indicator, source server coverage indicator, time determination indicator, and structure determination indicator; When both the time determination quantity and the structure determination quantity are 1 and the cache coverage indicator quantity is 1, the selected key set is the cache perspective key set; When the time determination quantity or structure determination quantity is 0 and the source station coverage indication quantity is 1, the selected key set is the source station perspective key set; If both the cache coverage indicator and the origin server coverage indicator are 0, then the authorization callback is rejected. The key identifier list represents the set of all key identifiers in the selected key set. The key identifiers are sorted character by character according to their encoding order. The key identifiers are then concatenated without separators to obtain a normalized string. A collision-resistant hash function is applied to the normalized string to obtain the generational fingerprint. The issuer identifier, key set address, generational fingerprint, key identifier, and verification time are concatenated in a fixed order. The same collision-resistant hash function used to generate the generational fingerprint is applied to the concatenated string to generate commitment data. This commitment data is then associated with the current session record and stored, and declared as read-only. Calculate the difference between the current timestamp and the verification time in the commitment data. If the difference is less than or equal to the time tolerance threshold, the authorization callback is allowed; otherwise, the authorization callback is rejected. The time tolerance threshold is a custom parameter.
2. The digital identity data information access control security protection system according to claim 1, characterized in that, If the target issuer identifier read from the session record and the issuer identifier in the response data are completely equal byte-by-byte, the authorization callback is allowed; otherwise, the authorization callback is rejected.
3. The digital identity data information access control security protection system according to claim 1, characterized in that, intergenerational difference rate The calculation formula is as follows: ,in Indicates the cached view key set. This represents the key set from the source server's perspective. Indicates intersection, Represents the union, Indicates the number of elements.
4. The digital identity data information access control security protection system according to claim 1, characterized in that, When the response data is in JWS format, the public key corresponding to the key identifier in the selected key set is used to verify the signature of the payload data in the JWS using the signature method in the response data. If the verification is successful, the authorization callback is allowed; otherwise, the authorization callback is rejected. When the response data is in JWE format, the private key corresponding to the key identifier in the selected key set and the encryption method are first used to decrypt the JWE to restore the JWS format. Then, the payload data in the JWS is verified by verifying the signature using the signature method in the response data. If the verification is successful, the authorization callback is allowed; otherwise, the authorization callback is rejected.
5. A digital identity data information access control security protection system according to claim 1, characterized in that, Before initiating a token exchange, the latest key set is obtained again via direct connection to the origin server. The key identifier list of the latest key set is sorted and concatenated to obtain a normalized string. Collision-resistant hashing is then performed on it to obtain the latest generational fingerprint. If the latest generational fingerprint matches the existing generational fingerprint, authorization callback is allowed; otherwise, authorization callback is rejected.
6. A method for security protection of digital identity data access control, characterized in that, Implementing a digital identity data information access control security protection system as described in any one of claims 1 to 5 includes the following steps: Step S401: Parse the response data returned by the authorization server to the client, and read the target issuer identifier and key set address from the session record; Step S402: For the same key set address, obtain two key sets respectively via the cache path and the direct connection to the source station, and read the cache dwell time field in the two responses, calculate the difference between the two to obtain the time phase shift difference; Step S403: Perform intersection-union comparison on the key identifier sets of the two key sets to obtain the generational difference rate, and use this and the time phase shift difference to determine the selected key set; Step S404: Sort and concatenate the key identifier list of the selected key set to obtain a normalized string, and perform anti-collision hashing on it to obtain the generational fingerprint; Step S405: Complete signature verification based on the public key in the selected key set and the signature and encryption methods of the response data. If the verification fails, the authorization callback is rejected. Step S406: Before initiating the token exchange, obtain the latest key set again through direct connection to the source server, and generate the latest generational fingerprint based on it. Compare the new generational fingerprint with the existing generational fingerprint. If they match, the authorization callback is allowed; otherwise, the authorization callback is rejected.