Root of trust system for global data right confirmation and authorization and method for global data right confirmation and authorization

Abstract

Disclosed is a root of trust system for global data right confirmation / authorization, said system comprising: a first capture module, for acquiring a plurality of pieces of identity information of a user and a plurality of pieces of enterprise information; a second capture module, for acquiring a plurality of CA certificates provided by a plurality of certificate authorities and a plurality of corresponding keys; an information authentication module, for carrying out entity or digital authentication and generating a plurality of pieces of authenticated identity information and a plurality of pieces of authenticated enterprise information; an electronic private seal / official seal generation module, for generating, on the basis of the plurality of authenticated identity information of the user and the plurality of authenticated enterprise information, an electronic private seal and an electronic official seal of the user; and a data right confirmation / authorization module, for linking to the plurality of certificate authorities when the user proposes a data right confirmation / authorization request for credit activity, performing multi-key verification on the basis of the plurality of CA certificates and the corresponding plurality of keys, and outputting a data right confirmation / authorization result corresponding to the credit activity.

Description

Global data rights confirmation and authorization root information system and global data rights confirmation and authorization method Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a data rights confirmation / authorization system and a data rights confirmation / authorization method. Background Art

[0002] In the current credit system, electronic signatures across provincial and national government systems are not interoperable or mutually recognized. Existing electronic signatures are only used vertically by local businesses and governments, and cannot be applied horizontally across businesses. Furthermore, the existing data ownership confirmation and authorization system is unclear, making it impossible to achieve universal access across the entire network. Furthermore, the centralized deployment of private keys violates the provisions of the "Electronic Signature Law of the People's Republic of China" and is considered an unreliable electronic signature.

[0003] It should be noted that the above technical background is merely provided to provide a clear and complete description of the technical solutions of the present invention and to facilitate understanding by those skilled in the art. Simply because these solutions are described in the technical background section of the present invention, it should not be assumed that the above technical solutions are well known to those skilled in the art.

[0004] Summary of the Invention

[0005] Therefore, those skilled in the art urgently need to develop a global data rights confirmation / authorization root trust system and a global data rights confirmation / authorization method that can effectively solve the problems of non-interoperability and mutual recognition of electronic signatures in government systems of various provinces and countries, and solve the insecurity of centralized deployment of private keys, so as to create an integrated platform from certification, credit enhancement, credit investigation to trust, and realize the full life cycle management of digital assets of governments, enterprises, families and individuals.

[0006] In order to overcome the defects in the prior art, the embodiments of the present invention provide a global data rights confirmation / authorization root information system and a data rights confirmation / authorization method.

[0007] An embodiment of the present application discloses a global data rights confirmation / authorization root information system, including: a first acquisition module, used to obtain multiple identity information and multiple enterprise information of a user; a second acquisition module, used to obtain multiple CA certificates and corresponding multiple keys provided by multiple certificate issuing authorities; an information authentication module, used to perform physical or digital authentication on multiple identity information and multiple enterprise information of the user based on multiple CA certificates, and generate multiple authenticated identity information and multiple authenticated enterprise information; an electronic private seal / official seal generation module, used to generate the user's electronic private seal and electronic official seal based on the user's multiple authenticated identity information and multiple authenticated enterprise information; a data rights confirmation / authorization module, used to link multiple certificate issuing authorities when a user makes a data rights confirmation / authorization request for a credit activity, perform multi-key verification based on multiple CA certificates and corresponding multiple keys, and output the data rights confirmation / authorization result corresponding to the credit activity.

[0008] Furthermore, when the data right confirmation / authorization module determines that multiple CA certificates and corresponding multiple keys match after performing multi-key verification, it outputs a positive data right confirmation / authorization result and allows the data right confirmation / authorization request for the credit activity proposed by the user; and when the data right confirmation / authorization module determines that multiple CA certificates and corresponding multiple keys do not match after performing multi-key verification, it outputs a negative data right confirmation / authorization result and rejects the data right confirmation / authorization request for the credit activity proposed by the user.

[0009] Furthermore, credit activities include electronic contracts, tax payments, social security, patents, and one-click financing, while data rights confirmation / authorization results include secondary rights confirmation and authentication results, authorized transactions, authentication time tracing, and various credit reports.

[0010] Furthermore, multiple certificate issuing authorities are bound to multiple landline telephone numbers, and the multiple landline telephone numbers are digital applications that meet global financial security levels.

[0011] Furthermore, the global data rights confirmation / authorization root trust system is the certification and encryption chain operating system for global global digital applications.

[0012] Furthermore, the global data rights confirmation / authorization root letter system is characterized in that it also includes a plurality of modules. The plurality of modules include: a central control module, and a communication module, an identity authentication module, a key module and a storage module connected to the central control module. The communication module is used to realize the communication between the global data rights confirmation / authorization root letter system and the external server; the identity authentication module is used to authenticate the biometric data input by the user to generate authenticated biometric data, and authorize the user after the authentication is passed; the key module is used to store a plurality of keys, and encrypt a plurality of authenticated identity information and a plurality of authenticated enterprise information according to the corresponding keys in the plurality of keys to generate a plurality of encrypted authenticated identity information and a plurality of encrypted authenticated enterprise information; the storage module is used to store authenticated biometric data, a plurality of encrypted authenticated identity information, a plurality of encrypted authenticated enterprise information, an electronic private seal and an electronic official seal; the central control module is used to receive input and control the operation of other modules, and allow the user to call the electronic private seal and the electronic official seal after the user obtains authorization.

[0013] The embodiment of the present application also discloses a global data right confirmation / authorization method, which includes the following steps: providing a global data right confirmation / authorization root letter system, which includes a first capture module, a second capture module, an information authentication module, an electronic private seal / official seal generation module, and a data right confirmation / authorization module; using the first capture module to obtain multiple identity information and multiple corporate information of the user; using the second capture module to obtain multiple CA certificates and corresponding multiple keys provided by multiple certificate issuing authorities; using the information authentication module to authenticate the user according to the multiple CA certificates. The system performs physical or digital authentication on the multiple identity information and multiple corporate information of the user, and generates multiple authenticated identity information and multiple authenticated corporate information; uses the electronic private seal / official seal generation module to generate the user's electronic private seal and electronic official seal based on the user's multiple authenticated identity information and multiple authenticated corporate information; and uses the data right confirmation / authorization module to link multiple certificate issuing authorities when the user makes a data right confirmation / authorization request for a credit activity, performs multi-key verification based on multiple CA certificates and corresponding multiple keys, and outputs the data right confirmation / authorization result corresponding to the credit activity.

[0014] Furthermore, the method also includes: providing a central control module, and a communication module, an identity authentication module, a key module and a storage module connected to the central control module; using the communication module to realize the communication between the global data right confirmation / authorization root system and the external server; using the identity authentication module to authenticate the biometric data input by the user to generate authenticated biometric data, and authorize the user after the authentication is passed; using the key module to store a plurality of keys, and encrypting a plurality of authenticated identity information and a plurality of authenticated enterprise information according to the corresponding keys in the plurality of keys to generate a plurality of encrypted authenticated identity information and a plurality of encrypted authenticated enterprise information; using the storage module to store authenticated biometric data, a plurality of encrypted authenticated identity information, a plurality of encrypted authenticated enterprise information, electronic private seals and electronic official seals; and using the central control module to receive input and control the operation of other modules, and allow the user to call the electronic private seal and electronic official seal after the user is authorized.

[0015] By means of the above technical solution, the beneficial effects of the present invention are as follows: Compared with the prior art, the global data right confirmation / authorization root letter system and the global data right confirmation / authorization method provided by the present invention have the following advantages: (1) It can complete the application and issuance of multiple certificates and multiple keys in one authentication on a single platform; it can write into a variety of secure storage media devices; (2) Through the certificate and key chain management, it innovatively completes the authentication and storage of multiple factors and multiple certificates from the very beginning of the entity's "birth", and establishes a one-master-multiple-duplicate and one-household-multiple-key distribution operation mode through one-number-multiple-use; (3) Relying on the government user systems of various provinces and countries, it serves as a digital bottom layer to uniformly access various government platforms, complete the secondary application, verification, and distribution of multiple keys and multiple certificates of users, and form digital and intelligent electronic official seals and electronic private seals for users. Furthermore, the present invention's global data rights confirmation / authorization root letter system and method utilize multiple certificates in one, with multiple keys distributed on demand. This makes them ideal for private cloud deployments. They are secure and controllable, and are suitable for global data rights confirmation / authorization, enabling co-signature and mutual recognition, thus easily enabling network-wide access. In contrast, traditional license servers utilize a single key, certificate, and platform, making them suitable only for centralized cloud deployments and raising security concerns. Furthermore, electronic signatures across provincial and national government systems are not interoperable or mutually recognized, and they do not support multi-CA authentication, making network-wide access impossible. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] FIG1 is a framework diagram of a global data rights confirmation / authorization root letter system in one embodiment of the present invention.

[0017] FIG2 is a framework diagram of the multiple modules in FIG1 .

[0018] FIG3 is a schematic diagram of an embodiment of a global data rights confirmation / authorization platform of the present invention.

[0019] FIG4 is a flow chart of a global data rights confirmation / authorization method in the first embodiment of the present invention.

[0020] FIG5 is a flow chart of a global data rights confirmation / authorization method in a second embodiment of the present invention.

[0021] Figure numbers of the above drawings: 10 Global data right confirmation / authorization root letter system 110 First capture module 120 Second capture module 130 Information authentication module 140 Electronic private seal / official seal generation module 150 Data right confirmation / authorization module 200 Multiple modules 20A-20N Certificate issuing authority 210 Central control module 220 Communication module 230 Identity authentication module 240 Key module 250 Storage module ID1-IDn Identity information aID1-aIDn Authenticated identity information eaID1-eaIDn Encrypted authenticated identity information CI1-CIm Enterprise information aCI1-aCIm Authenticated enterprise information eaCI1-eaCIm Encrypted authenticated enterprise information CAC1-CACp CA certificate KEY1-KEYq Key EPS Electronic private seal ECS Electronic official seal REQ Data right confirmation / authorization request RESULT Data right confirmation / authorization result BID Biometric data aBID Authenticated biometric data S610-S660, S710-S770 steps DETAILED DESCRIPTION

[0022] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0023] The following is a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0024] In order to make the above and other objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings.

[0025] It should be noted that, in the description of the present invention, the terms "first," "second," etc., are used solely for descriptive purposes and to distinguish similar objects. There is no order of precedence between the two, nor should they be construed as indicating or implying relative importance. Furthermore, in the description of the present invention, unless otherwise specified, "plurality" means two or more.

[0026] Please refer to Figure 1, which is a framework diagram of a global data rights confirmation / authorization root letter system 10 in one embodiment of the present invention. As shown in Figure 1, the global data rights confirmation / authorization root letter system 10 includes a first acquisition module 110, a second acquisition module 120, an information authentication module 130, an electronic private seal / official seal generation module 140, a data rights confirmation / authorization module 150, and multiple modules 200. The first acquisition module 110 is used to obtain a user's multiple identity information ID1-IDn and multiple enterprise information CI1-CIm. The second acquisition module 120 is used to obtain a plurality of CA certificates CAC1-CACp and corresponding multiple keys KEY1-KEYq provided by a plurality of certificate authorities (Certificate Authorities) 20A-20N. The information authentication module 130 is coupled to the first capture module 110 and the second capture module 120 and is used to perform physical or digital authentication of the user's multiple identity information ID1-IDn and multiple corporate information CI1-CIm based on the multiple CA certificates CAC1-CACp, and generate multiple authenticated identity information aID1-aIDn and multiple authenticated corporate information aCI1-aCIm. The electronic personal seal / official seal generation module 140 is coupled to the information authentication module 130 and is used to generate the user's electronic personal seal (EPS) and electronic official seal (ECS) based on the user's multiple authenticated identity information aID1-aIDn and multiple authenticated corporate information aCI1-aCIm. The data confirmation / authorization module 150 is coupled to the information authentication module 130. When a user submits a data confirmation / authorization request REQ for a credit activity, the module links to multiple certificate authorities 20A-20N, performs multi-key verification based on multiple CA certificates CAC1-CACp and corresponding multiple keys KEY1-KEYq, and outputs a data confirmation / authorization result RESULT corresponding to the credit activity.

[0027] It is worth noting that when the data confirmation / authorization module 150 performs multi-key verification and determines that the multiple CA certificates CAC1-CACp and the corresponding multiple keys KEY1-KEYq match, it outputs a positive data confirmation / authorization result RESULT_P and allows the data confirmation / authorization request REQ for the credit activity proposed by the user; and when the data confirmation / authorization module 150 performs multi-key verification and determines that the multiple CA certificates CAC1-CACp and the corresponding multiple keys KEY1-KEYq do not match, it outputs a negative data confirmation / authorization result RESULT_N and rejects the data confirmation / authorization request REQ for the credit activity proposed by the user.

[0028] The above-mentioned credit activities include electronic contracts, tax payments, social security, patents, one-click financing, etc., and the data rights confirmation / authorization results RESULT include secondary rights confirmation authentication results, authorized transactions, authentication time traceability, various credit reports, etc., but this is only an example and the present invention is not limited to this.

[0029] Please note that the multiple identity information ID1-IDn may include the ID card, address, email address, telephone number and / or video number of the user's company founder, and the multiple corporate information CI1-CIm may include the bound bank account, electronic business license, tax control information, official seal number, legal person ID number, telephone number, social credit code and / or electronic certificate number of the corporate user authorized by the banking system and / or government system, but this is only an example and the present invention is not limited to this.

[0030] Please refer to Figures 1 and 2 together. The global data rights confirmation / authorization root letter system 10 in Figure 1 also includes multiple modules 200. As shown in Figure 2, the multiple modules 200 include a central control module 210, and a communication module 220, an identity authentication module 230, a key module 240 and a storage module 250 connected to the central control module 210. The communication module 220 is used to realize the communication between the global data rights confirmation / authorization root letter system 10 and an external server. The identity authentication module 230 is used to authenticate the biometric data BID input by the user to generate authenticated biometric data aBID, and authorize the user after the authentication is passed. The key module 240 is used to store a plurality of keys KEY1-KEYq and encrypt a plurality of authenticated identity information aID1-aIDn and a plurality of authenticated enterprise information aCI1-aCIm according to the corresponding keys in the plurality of keys KEY1-KEYq to generate a plurality of encrypted authenticated identity information eaID1-eaIDn and a plurality of encrypted authenticated enterprise information eaCI1-eaCIm. The storage module 250 is used to store authenticated biometric data aBID, a plurality of encrypted authenticated identity information eaID1-eaIDn, a plurality of encrypted authenticated enterprise information eaCI1-eaCIm, an electronic private seal EPS, and an electronic official seal ECS. The central control module 210 is used to receive input and control the operation of other modules 220-250, and after the user obtains authorization, allow the user to call the electronic private seal EPS and electronic official seal ECS.

[0031] Furthermore, the communication module 220 may include: at least one of: a 3G communication module, a 4G communication module, a 5G communication module, a WIFI module, a NBIoT module, a Bluetooth module, an NFC module and an infrared module; the communication module 220 supports IPV4 and IPV6 protocols.

[0032] Please note that the aforementioned biometric data may include fingerprint information, palm print information, iris information, and / or facial feature recognition data, or any other user biometric data that can be used for identification. In actual applications, one or a combination of these may be used for security identification.

[0033] The following is an embodiment of the data rights confirmation / authorization of existing users of the present invention. In this embodiment, the data rights confirmation / authorization of existing users includes three stages: (1) the existing data starts the data rights confirmation; (2) the one-number multi-use runs through the rights confirmation process; (3) the output of the data rights confirmation / authorization results. First, the rights confirmation of existing data elements is carried out through two channels: Channel 1 is to provide the information of the enterprises under its jurisdiction in batches to the global data rights confirmation / authorization root system 10 for data rights confirmation through various government platforms (such as "Zheliban"); Channel 2 is to manually apply for the use of the "certificate-crypto chain" through various government platforms or data authentication platforms by simply filling in the enterprise name and unified social credit code. Then, after registration, the enterprise or individual can use the one-number multi-use collection certificate of the global data rights confirmation / authorization root system 10 to start the data rights confirmation / authorization request REQ for credit activities such as electronic contracts, tax payment, social security, patents, and one-click financing. Then, the global data rights confirmation / authorization root letter system 10 will perform multi-key verification based on the certificates of each government platform and output the data rights confirmation / authorization result RESULT corresponding to the credit activity. The data rights confirmation / authorization result RESULT includes the secondary rights confirmation authentication result, authorized transaction, authentication time traceability, various credit reports, etc. In this embodiment, the global data rights confirmation / authorization platform of the present invention can be linked with multiple government platforms, multiple CA platforms, and multiple application platforms at the same time, and can perform global / global data rights confirmation / authorization with multiple certificates, multiple keys, multiple factors, and multiple platforms, thereby solving the problem of electronic signatures not being interoperable and mutually recognized between government systems of various countries / provinces.

[0034] Please refer to Figure 3, which is a schematic diagram of an embodiment of the global data rights confirmation / authorization platform of the present invention. As shown in Figure 3, the global data rights confirmation / authorization platform of the present invention is an integrated platform that performs multiple authentication and rights confirmation of various data elements and application authorization based on a Jizhengtong multi-key encryption card (smart security chip) and a Jizhengtong server. First, the user submits a data rights confirmation / authorization request REQ for a credit activity to various data centers (such as public cloud data centers, private cloud data centers, government cloud data centers, and foreign cloud data centers) through the data trading platform. Next, the global data rights confirmation / authorization platform transmits the data rights confirmation / authorization request REQ to various certificate authorities (such as ** National CA, Shanghai CA, Guangdong CA, Beijing CA, Zhejiang CA, etc.). The global data rights confirmation / authorization platform then connects to each certificate authority and performs multi-key verification based on the certificates of each certificate authority to verify whether the keys match. Next, each certificate authority returns the data rights confirmation / authorization result RESULT corresponding to the credit activity to the global data rights confirmation / authorization platform. Finally, the global data rights confirmation / authorization platform outputs the data rights confirmation / authorization result RESULT corresponding to the credit activity.

[0035] As can be seen from the above, the global data right confirmation / authorization root letter system 10 of the present invention is a multi-certificate, multi-key, multi-factor, multi-platform root letter system, which can use multiple certificates, multiple keys, multiple factors, and multiple platforms to perform global / global data right confirmation / authorization, thus solving the problem of electronic signatures not being interoperable and mutually recognized between government systems of various provinces and countries. Furthermore, the global data right confirmation / authorization root letter system 10 of the present invention is privately deployed with an integrated physical and electronic application, and each smart terminal is an edge cloud with integrated computing power and storage. The smart terminal includes a Jizhengtong credit reporting server, a smart seal, a Jizhengtong set-top box, a Jizhengtong router, a Jizheng U-shield, etc., thus solving the problem of insecurity in the centralized deployment of private keys. In addition, the global data right confirmation / authorization root letter system 10 of the present invention is bound to a fixed telephone number and / or a mobile phone number, which can realize the expansion of the digital space by using one number for multiple uses, create an integrated platform from certification, credit enhancement, credit reporting to trust, and realize the full life cycle management of digital assets of governments, enterprises, families, and individuals.

[0036] The following is an embodiment of a global, global digital application certificate chain operating system. In this embodiment, the above-mentioned multiple certificate issuing authorities 20A-20N can correspond to multiple provincial government platforms respectively, and the multiple certificate issuing authorities of the multiple provincial government platforms are all bound to multiple fixed telephone numbers. For example, the certificate issuing authority of the Beijing government platform corresponds to a fixed telephone number starting with 010, the certificate issuing authority of the Shanghai government platform corresponds to a fixed telephone number starting with 021, the certificate issuing authority of the Zhejiang provincial government platform corresponds to a fixed telephone number starting with 0571, and the certificate issuing authority of the Guangdong provincial government platform corresponds to a fixed telephone number starting with 020, and so on. Here, 010 represents the telephone area code of Beijing, 021 represents the telephone area code of Shanghai, 0571 represents the telephone area code of Zhejiang Province, and 020 represents the telephone area code of Guangdong Province.

[0037] Please note that the aforementioned multiple certificate authorities 20A-20N can also correspond to multiple national government platforms, and the multiple certificate authorities of multiple national government platforms are also bound to multiple landline telephone numbers. For example, the certificate authority of the Chinese government platform corresponds to a landline telephone number starting with +86, the certificate authority of the Korean government platform corresponds to a landline telephone number starting with +82, the certificate authority of the Japanese government platform corresponds to a landline telephone number starting with +81, the certificate authority of the US government platform corresponds to a landline telephone number starting with +1, and so on. Here, +86 represents the country code for China, +82 represents the country code for South Korea, +81 represents the country code for Japan, and +1 represents the country code for the United States.

[0038] It is worth noting that the aforementioned multiple landline phone numbers are digital applications that meet global financial security standards. Therefore, the global data rights confirmation / authorization root trust system 10 of the present invention is a global digital application authentication and encryption chain operating system.

[0039] The global data rights confirmation / authorization root system of the present invention can be a trusted authentication server system or a third-party authentication platform system. This terminal device includes the authentication, storage, management, and application of various certificate keys such as electronic seals. It corresponds to any social and economic department or platform system, including government, enterprises, and individual families.

[0040] The global data rights confirmation / authorization root letter system of the present invention can be realized by a chip of an integrated physical and electronic smart electronic seal. The chip of the integrated physical and electronic smart electronic seal stores various certificates and keys, and all certificates and keys can be remotely distributed, downloaded, stored and applied.

[0041] Please refer to Figure 1 and Figure 4 together. Figure 4 is a flow chart of a global data rights confirmation / authorization method in the first embodiment of the present invention. The global data rights confirmation / authorization method in Figure 4 includes the following steps:

[0042] Step S610: Providing a global data rights confirmation / authorization root letter system, which includes a first capture module, a second capture module, an information authentication module, an electronic private seal / official seal generation module, and a data rights confirmation / authorization module;

[0043] Step S620: Utilize the first capture module to obtain the user's multiple identity information and multiple company information;

[0044] Step S630: Utilize a second retrieval module to obtain a plurality of CA certificates and corresponding keys provided by a plurality of certificate authorities;

[0045] Step S640: Utilizing the information authentication module to perform physical or digital authentication on the user's multiple identity information and multiple enterprise information based on the multiple CA certificates, and generating multiple authenticated identity information and multiple authenticated enterprise information;

[0046] Step S650: using the electronic private seal / official seal generation module to generate the user's electronic private seal and electronic official seal according to the user's multiple authenticated identity information and multiple authenticated corporate information; and

[0047] Step S660: When a user submits a data rights confirmation / authorization request for a credit activity, the data rights confirmation / authorization module is used to link to multiple certificate authorities, perform multi-key verification based on multiple CA certificates and corresponding multiple keys, and output the data rights confirmation / authorization result corresponding to the credit activity.

[0048] Please note that step S620 is executed by the first capture module 110, step S630 is executed by the second capture module 120, step S640 is executed by the information authentication module 130, step S650 is executed by the electronic private seal / official seal generation module 140, and step S660 is executed by the data right confirmation / authorization module 150.

[0049] Please refer to Figure 2 and Figure 5 together. Figure 5 is a flow chart of a global data rights confirmation / authorization method in the second embodiment of the present invention. The data rights confirmation / authorization method in Figure 5 includes the following steps:

[0050] Step S710: providing a central control module, and a communication module, an identity authentication module, a key module, and a storage module connected to the central control module;

[0051] Step S720: Using the communication module to realize the communication between the global data rights confirmation / authorization root information system and the external server;

[0052] Step S730: Utilizing the identity authentication module to authenticate the biometric data input by the user to generate authenticated biometric data, and authorizing the user after the authentication is successful;

[0053] Step S740: Using a key module to store a plurality of keys, and encrypting the plurality of authenticated identity information and the plurality of authenticated enterprise information according to corresponding keys among the plurality of keys to generate a plurality of encrypted authenticated identity information and a plurality of encrypted authenticated enterprise information;

[0054] Step S750: Using a storage module to store authenticated biometric data, a plurality of encrypted authenticated identity information, a plurality of encrypted authenticated enterprise information, an electronic private seal, and an electronic official seal; and

[0055] Step S760: Utilize the central control module to receive input and control the operation of other modules, and allow the user to call the electronic private seal and electronic official seal after the user obtains authorization.

[0056] Please note that step S720 is executed by the communication module 220 , step S730 is executed by the identity authentication module 230 , step S740 is executed by the key module 240 , step S750 is executed by the storage module 250 , and step S760 is executed by the central control module 210 .

[0057] The specific embodiment of the present invention provides a global data right confirmation / authorization root letter system and a global data right confirmation / authorization method, which can perform global / global data right confirmation / authorization with multiple certificates, multiple keys, multiple factors, and multiple platforms, thereby solving the problem of electronic signatures not being interoperable and mutually recognized between government systems of various provinces and countries. Furthermore, the global data right confirmation / authorization root letter system of the present invention is privately deployed with an integrated physical and electrical application, and each smart terminal is an edge cloud with integrated computing power and storage. The smart terminal includes a Jizhengtong credit reporting server, a smart seal, a Jizhengtong set-top box, a Jizhengtong router, a Jizheng U-shield, etc., thereby solving the problem of insecurity in the centralized deployment of private keys. In addition, the global data right confirmation / authorization root letter system of the present invention is bound to a fixed telephone number and / or a mobile phone number, which can realize the expansion of the digital space by using one number for multiple uses, create an integrated platform from certification, credit enhancement, credit reporting to trust, and realize the full life cycle management of digital assets of governments, enterprises, families, and individuals.

[0058] The above-described embodiments of the present invention may be implemented in various hardware, software encodings, or a combination thereof. For example, embodiments of the present invention may also be program code that performs the above-described methods in a digital signal processor (DSP). The present invention may also relate to various functions performed by a computer processor, a digital signal processor, a microprocessor, or a field programmable gate array (FPGA). The above-described processors may be configured according to the present invention to perform specific tasks by executing machine-readable software code or firmware code that defines the specific methods disclosed herein. The software code or firmware code may be developed in different programming languages ​​and in different formats or forms. The software code may also be compiled for different target platforms. However, the different code styles, types, and languages ​​of the software code that performs tasks according to the present invention and other types of configuration code do not depart from the spirit and scope of the present invention.

[0059] By means of the above technical solution, the beneficial effects of the present invention are as follows: Compared with the prior art, the global data right confirmation / authorization root letter system and global data right confirmation / authorization method provided by the present invention have the following advantages: (1) It can complete the application and issuance of multiple certificates and multiple keys in one authentication on a single platform; it can write into a variety of the most secure storage media devices; (2) Through the certificate and key chain management, it innovatively completes the authentication and storage of multiple factors and multiple certificates from the very beginning of the entity's "birth", and establishes a one-master-multiple-duplicate and one-household-multiple-key distribution operation mode through one-number-multiple-use; (3) Relying on the government user system of each province, it serves as the digital bottom layer to uniformly access various government platforms, complete the secondary application, verification, and distribution of multiple keys and multiple certificates of users, and form the user's digital and intelligent security electronic official seal and electronic private seal. Furthermore, the present invention's global data rights confirmation / authorization root letter system and method utilize multiple certificates in one, with multiple keys distributed on demand. This makes them ideal for private cloud deployments. They are secure and controllable, and are suitable for global data rights confirmation / authorization, enabling co-signature and mutual recognition, thus easily enabling network-wide access. In contrast, traditional license servers utilize a single key, certificate, and platform, making them suitable only for centralized cloud deployments and raising security concerns. Furthermore, electronic signatures across provincial and national government systems are not interoperable or mutually recognized, and they do not support multi-CA authentication, making network-wide access impossible.

[0060] Specific embodiments are used in the present invention to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core ideas. At the same time, for those skilled in the art, according to the ideas of the present invention, there may be changes in the specific implementation methods and application scopes. In summary, the contents of this specification should not be understood as limiting the present invention.

Claims

1. A global data rights confirmation / authorization root letter system, characterized in that: include: A first acquisition module, used to obtain multiple identity information and multiple enterprise information of the user; a second acquisition module, used to obtain a plurality of CA certificates and corresponding plurality of keys provided by a plurality of certificate issuing authorities; an information authentication module, coupled to the first acquisition module and the second acquisition module, for performing physical or digital authentication on the plurality of identity information and the plurality of enterprise information of the user according to the plurality of CA certificates, and generating a plurality of authenticated identity information and a plurality of authenticated enterprise information; an electronic private seal / official seal generation module, coupled to the information authentication module, for generating the user's electronic private seal and electronic official seal according to the plurality of authenticated identity information and the plurality of authenticated enterprise information of the user; as well as A data confirmation / authorization module is coupled to the information authentication module, and is used to link the multiple certificate issuing authorities when the user makes a data confirmation / authorization request for a credit activity, perform multi-key verification based on the multiple CA certificates and the corresponding multiple keys, and output a data confirmation / authorization result corresponding to the credit activity.

2. The global data rights confirmation / authorization root letter system as claimed in claim 1, characterized in that: When the data confirmation / authorization module determines that the plurality of CA certificates and the corresponding plurality of keys match after multi-key verification, it outputs a positive data confirmation / authorization result and allows the data confirmation / authorization request for the credit activity proposed by the user; When the data confirmation / authorization module determines that the multiple CA certificates and the corresponding multiple keys do not match after performing multi-key verification, it outputs a negative data confirmation / authorization result and rejects the data confirmation / authorization request for the credit activity proposed by the user.

3. The global data rights confirmation / authorization root letter system as claimed in claim 1, characterized in that: The credit activities include electronic contracts, taxation, social security, patents, and one-click financing; the data confirmation / authorization results include secondary confirmation authentication results, authorized transactions, authentication time tracing, and various credit reports.

4. The global data rights confirmation / authorization root letter system as claimed in claim 1, characterized in that: The plurality of certificate issuing authorities are all bound to a plurality of landline telephone numbers, and the plurality of landline telephone numbers are digital applications that comply with global financial security levels.

5. The global data rights confirmation / authorization root letter system as claimed in claim 1, characterized in that: The global data rights confirmation / authorization root letter system is a global digital application certification and encryption chain operating system.

6. The global data rights confirmation / authorization root letter system as claimed in claim 1, characterized in that: It also includes a multi-module coupled to the data authentication / authorization module, the multi-module including: A central control module, and a communication module, an identity authentication module, a key module and a storage module connected to the central control module; The communication module is used to realize the communication between the global data rights confirmation / authorization root information system and the external server; The identity authentication module is used to authenticate the biometric data input by the user to generate authenticated biometric data, and authorize the user after the authentication is passed; The key module is used to store the plurality of keys, and encrypt the plurality of authenticated identity information and the plurality of authenticated enterprise information according to corresponding keys among the plurality of keys to generate a plurality of encrypted authenticated identity information and a plurality of encrypted authenticated enterprise information; The storage module is used to store the authenticated biometric data, the plurality of encrypted authenticated identity information, the plurality of encrypted authenticated enterprise information, the electronic private seal and the electronic official seal; and The central control module is used to receive input and control the operation of other modules, and allows the user to call the electronic private seal and the electronic official seal after the user is authorized.

7. A global data rights confirmation / authorization method, applied to a global data rights confirmation / authorization root letter system, characterized in that: The method comprises the following steps: A global data rights confirmation / authorization root letter system is provided, the global data rights confirmation / authorization root letter system comprising a first acquisition module, a second acquisition module, an information authentication module, an electronic private seal / official seal generation module and a data rights confirmation / authorization module; Using the first acquisition module to obtain multiple identity information and multiple corporate information of the user; Utilizing the second acquisition module to obtain a plurality of CA certificates and a plurality of corresponding keys provided by a plurality of certificate issuing authorities; Using the information authentication module to perform physical or digital authentication on the plurality of identity information and the plurality of enterprise information of the user according to the plurality of CA certificates, and generate a plurality of authenticated identity information and a plurality of authenticated enterprise information; Using the electronic private seal / official seal generation module to generate the user's electronic private seal and electronic official seal according to the plurality of authenticated identity information and the plurality of authenticated enterprise information of the user; and The data confirmation / authorization module is used to link the multiple certificate issuing authorities when the user makes a data confirmation / authorization request for a credit activity, perform multi-key verification based on the multiple CA certificates and the corresponding multiple keys, and output the data confirmation / authorization result corresponding to the credit activity.

8. The global data rights confirmation / authorization method according to claim 7, characterized in that: When the data confirmation / authorization module determines that the plurality of CA certificates and the corresponding plurality of keys match after multi-key verification, it outputs a positive data confirmation / authorization result and allows the data confirmation / authorization request for the credit activity proposed by the user; When the data confirmation / authorization module determines that the multiple CA certificates and the corresponding multiple keys do not match after performing multi-key verification, it outputs a negative data confirmation / authorization result and rejects the data confirmation / authorization request for the credit activity proposed by the user.

9. The global data rights confirmation / authorization method according to claim 7, characterized in that: The credit activities include electronic contracts, taxation, social security, patents, and one-click financing; the data confirmation / authorization results include secondary confirmation authentication results, authorized transactions, authentication time tracing, and various credit reports.

10. The global data rights confirmation / authorization method according to claim 7, characterized in that: The plurality of certificate issuing authorities are all bound to a plurality of landline telephone numbers, and the plurality of landline telephone numbers are digital applications that comply with global financial security levels.

11. The global data rights confirmation / authorization method according to claim 7, characterized in that: Also includes: Providing a central control module, and a communication module, an identity authentication module, a key module and a storage module connected to the central control module; The communication module is used to realize the communication between the global data right confirmation / authorization root information system and the external server; Utilizing the identity authentication module to authenticate the biometric data input by the user to generate authenticated biometric data, and authorizing the user after the authentication is passed; Using the key module to store the plurality of keys, and encrypting the plurality of authenticated identity information and the plurality of authenticated enterprise information according to corresponding keys among the plurality of keys to generate a plurality of encrypted authenticated identity information and a plurality of encrypted authenticated enterprise information; Using the storage module to store the authenticated biometric data, the plurality of encrypted authenticated identity information, the plurality of encrypted authenticated enterprise information, the electronic private seal and the electronic official seal; as well as The central control module is used to receive input and control the operation of other modules, and after the user is authorized, the user is allowed to call the electronic private seal and the electronic official seal.

Images