CN109274650A - A kind of management system and method that electron image is had access to - Google Patents

A kind of management system and method that electron image is had access to Download PDF

Info

Publication number
CN109274650A
CN109274650A CN201811003144.7A CN201811003144A CN109274650A CN 109274650 A CN109274650 A CN 109274650A CN 201811003144 A CN201811003144 A CN 201811003144A CN 109274650 A CN109274650 A CN 109274650A
Authority
CN
China
Prior art keywords
image
access
electron image
sent
service sub
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN201811003144.7A
Other languages
Chinese (zh)
Other versions
CN109274650B (en
Inventor
李伟龙
罗辉
刘本熙
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Inspur General Software Co Ltd
Original Assignee
Shandong Inspur Genersoft Information Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Shandong Inspur Genersoft Information Technology Co Ltd filed Critical Shandong Inspur Genersoft Information Technology Co Ltd
Priority to CN201811003144.7A priority Critical patent/CN109274650B/en
Publication of CN109274650A publication Critical patent/CN109274650A/en
Application granted granted Critical
Publication of CN109274650B publication Critical patent/CN109274650B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/10Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/04Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/06Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/062Network architectures or network communication protocols for network security for supporting key management in a packet data network for key distribution, e.g. centrally by trusted party
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/08Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823Network architectures or network communication protocols for network security for authentication of entities using certificates
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/10Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/108Network architectures or network communication protocols for network security for controlling access to devices or network resources when the policy decisions are valid for a limited amount of time
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00Network arrangements or protocols for supporting network services or applications
    • H04L67/01Protocols
    • H04L67/02Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
    • H04L9/3213Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority using tickets or tokens, e.g. Kerberos

Abstract

The present invention provides a kind of management systems and method that electron image is had access to, comprising: at least one service sub-system, authentication center and image subsystem;Service sub-system, for obtaining the user information and image mark of user's input, the ID authentication request for carrying user information and system banner is sent to authentication center, receive the access token that authentication center is sent when determining that ID authentication request passes through verifying, access token and image mark are sent to image subsystem, so that image subsystem is after determining that access token is verified at authentication center, corresponding uniform resource position mark URL is sent, obtains corresponding electron image by receiving the URL that image subsystem is sent.This programme can reduce the maintenance difficulties of electronic image system.

Description

A kind of management system and method that electron image is had access to
Technical field
The present invention relates to field of computer technology, in particular to a kind of management system and method that electron image is had access to.
Background technique
Continuous upgrading with the enhancing and every profession and trade of people's environmental consciousness to office mode demand, modernization, information Change the quickening of pace of construction, the Image Management of traditional paper document has upgraded to electron image management, passed through electron image system System provides the storage of electron image, the service of having access to etc..
Currently, due to the sensibility of company information, electronic image system in addition to providing storage, having access to image data service, It it is also required to provide user identity audit service, mentioned after the identity for confirming user is legal, then by the relevant electron image having access to Supply user.
But with the continuous development of enterprise, the quantity of operation system and employee are being constantly increasing, and pass through electron image System provide simultaneously the storage of electron image data, have access to identity audit etc. service, will increase the maintenance of electronic image system Difficulty.
Summary of the invention
The embodiment of the invention provides a kind of management systems and method that electron image is had access to, and can reduce electron image system The maintenance difficulties of system.
In a first aspect, the embodiment of the invention provides a kind of management systems that electron image is had access to, comprising:
At least one service sub-system, authentication center and image subsystem;
Each described service sub-system, for obtaining the user information and image mark of user's input, to the identity Authentication center sends ID authentication request, when receiving the access token that the authentication center is sent, by the image Mark and the access token are sent to the image subsystem, wherein the ID authentication request carries the user information With the system banner of the service sub-system;The uniform resource position mark URL that the image subsystem is sent is received, by described URL has access to and shows that the image identifies corresponding electron image;
The authentication center is asked for receiving and verifying the authentication that any service sub-system is sent It asks, when the ID authentication request passes through verifying, generates the corresponding access token of the ID authentication request, and by institute It states access token and is sent to the service sub-system for sending the ID authentication request;It receives and verifies the image subsystem The access token sent is sent to the image subsystem by recognizing when the received access token passes through certification Card;
The image subsystem, for receiving the image mark and access order that the service sub-system is sent Board, and the access token is sent to the authentication center;When receive that the authentication center sends passes through When certification, the corresponding URL of the electron image is obtained, and the URL is sent to the service sub-system.
Preferably,
The image subsystem is further used for obtaining the storage location of the electron image, obtain from the storage location The electron image is taken, is encrypted using the electron image that preset key pair obtains, and by the encrypted electronics shadow As storing to preset encrypted location, URL corresponding with the encrypted location is generated;
The service sub-system is further used for having access to the encrypted electron image by the URL, by described Electron image decryption after key pair encryption, the electron image after being decrypted, and by the electronics after decryption Image show gives the user.
Preferably,
The image subsystem is further used for generating the corresponding digital watermark information of the access token, by the number Word watermark information is loaded into the electron image of acquisition, and is loaded the digital watermark information using preset key pair The electron image encryption.
Preferably,
The image subsystem, it is described for being sent to the URL using Secure Hypertext Transfer Protocol HTTPS agreement Service sub-system;
The service sub-system has access to the electron image by the URL, and will for utilizing the HTTPS agreement The electron image having access to shows the user.
Preferably,
The authentication center is further used for the access token that storage generates;And receiving the image It is executed when the access token that subsystem is sent:
D0: it determines in the access token of storage with the presence or absence of the access token sent with the image subsystem Otherwise identical access token, executes D2 if so, executing D1;
D1: whether the access token for determining that the image subsystem is sent is expired, if so, D2 is executed, otherwise, to The image subsystem transmission passes through certification;
D2: authentification failure is sent to the image subsystem;
The image subsystem is further used in the authentification failure for receiving the authentication center transmission When, the authentification failure is sent to the service sub-system, so that the authentification failure is showed institute by the service sub-system State user.
Preferably,
The authentication center is further used for being stored in advance the identity information of at least one user, described in each At least one corresponding system banner of identity information and at least one corresponding image mark;Receive any service sub-system The ID authentication request sent, and execute:
S0: determine storage each identity information in, if exist with the ID authentication request carry described in Otherwise the identical same identity information of user information, executes S3 if so, executing S1;
S1: it determines in the corresponding each system banner of the same identity information, if exist and recognize with the identity Otherwise the identical system banner of the system banner that card request carries, executes S3 if so, executing S2;
S2: it determines in the corresponding each image mark of the same identity information, if exist and recognize with the identity Card requests the image carried to identify identical image mark, if so, executing the generation ID authentication request pair Otherwise the access token answered executes S3;
S3: having no right to access to service sub-system transmission, so that the service sub-system haves no right access displaying for described To the user.
Preferably,
The image subsystem, is further used for being arranged that the URL is corresponding to have access to permission and operating right, according to described Have access to permission and monitor the service sub-system and the electron image is had access to by the URL, when it is described have access to permission failure when, hinder Only the service sub-system executes the corresponding operation of the operating right and has access to the electron image;
Wherein, described to have access to permission, comprising: access duration when the service sub-system accesses the electron image and/ Or access times, the operating right, comprising: check permission, downloading when the service sub-system accesses the electron image It is any one or more in permission and modification authority.
Second aspect, the embodiment of the invention provides a kind of management methods that electron image is had access to, comprising:
The user information and image mark that user's input is obtained by service sub-system described at least one, to the identity Authentication center sends ID authentication request, wherein the ID authentication request carries the user information and service sub-system System banner;
It is received by the authentication center and verifies the authentication that any service sub-system is sent and asked It asks, when the ID authentication request passes through verifying, generates the corresponding access token of the ID authentication request, and by institute It states access token and is sent to the service sub-system for sending the ID authentication request;
It, will through service sub-system described at least one when receiving the access token that the authentication center is sent The image mark and the access token are sent to the image subsystem;
The image mark and the access token that the service sub-system is sent are received by the image subsystem, And the access token is sent to the authentication center;
The access token that the image subsystem is sent is received and verified by the authentication center, works as reception Access token when passing through certification, pass through certification to image subsystem transmission;
By the image subsystem when receiving when passing through certification of the authentication center transmission, the electricity is obtained The corresponding uniform resource position mark URL of sub-image, and the URL is sent to the service sub-system;
The uniform resource locator that the image subsystem is sent is received by least one described described service sub-system URL is had access to by the URL and shows that the image identifies corresponding electron image.
Preferably,
It is described to obtain the corresponding uniform resource position mark URL of the electron image, comprising:
Obtain the storage location of the electron image;
The electron image is obtained from the storage location;
Using preset key pair obtain the electron image encrypt, and by the encrypted electron image store to Preset encrypted location;
Generate URL corresponding with the encrypted location;
It is described to be had access to by the URL and show that the image identifies corresponding electron image, comprising:
The encrypted electron image is had access to by the URL;
The electron image by the electron image decryption after the key pair encryption, after being decrypted;
The electron image after decryption is showed into the user.
Preferably,
It is described obtain the electron image from the storage location after, obtained described using preset key pair Before the electron image encryption, further comprise:
Generate the corresponding digital watermark information of the access token;
The digital watermark information is loaded into the electron image of acquisition;
The electron image obtained using preset key pair is encrypted, comprising:
It is encrypted using the electron image that preset key pair is loaded the digital watermark information.
In embodiments of the present invention, service sub-system is needed when getting user's input user information and image identifies ID authentication request first is sent to authentication center, so that the identity of user is verified at authentication center, so that really Whether the identity for determining user is legal, and the safety that electron image is had access to not only can be improved, and can also pass through authentication center The dependence of service sub-system and electronic image system is reduced, so that service sub-system and image subsystem decoupled, reduce image The difficulty of system maintenance, when user identity is legal, service sub-system can receive the visit of authentication center transmission It asks token, is identified using the image that access token and user input, image can be obtained from image subsystem and identify corresponding electricity URL corresponding to sub-image can obtain the electron image that user is had access to by URL.
Detailed description of the invention
In order to more clearly explain the embodiment of the invention or the technical proposal in the existing technology, to embodiment or will show below There is attached drawing needed in technical description to be briefly described, it should be apparent that, the accompanying drawings in the following description is the present invention Some embodiments for those of ordinary skill in the art without creative efforts, can also basis These attached drawings obtain other attached drawings.
Fig. 1 is the structural schematic diagram for the management system that a kind of electron image that one embodiment of the invention provides is had access to;
Fig. 2 is the structural schematic diagram for the management system that another electron image that one embodiment of the invention provides is had access to;
Fig. 3 is the flow chart for the management method that a kind of electron image that one embodiment of the invention provides is had access to.
Specific embodiment
In order to make the object, technical scheme and advantages of the embodiment of the invention clearer, below in conjunction with the embodiment of the present invention In attached drawing, technical scheme in the embodiment of the invention is clearly and completely described, it is clear that described embodiment is A part of the embodiment of the present invention, instead of all the embodiments, based on the embodiments of the present invention, those of ordinary skill in the art Every other embodiment obtained without making creative work, shall fall within the protection scope of the present invention.
As shown in Figure 1, the embodiment of the invention provides a kind of management systems that electron image is had access to, comprising:
At least one service sub-system 101, authentication center 102 and image subsystem 103;
Each described service sub-system 101, for obtaining the user information and image mark of user's input, to the body Part authentication center 102 sends ID authentication request, will when receiving the access token that the authentication center 102 is sent The image mark and the access token are sent to the image subsystem 103, wherein the ID authentication request carries institute State the system banner of user information and the service sub-system;Receive the unified resource positioning that the image subsystem 103 is sent URL is accorded with, had access to by the URL and shows that the image identifies corresponding electron image;
The authentication center 102, the identity sent for receiving and verifying any service sub-system 101 Certification request generates the corresponding access token of the ID authentication request when the ID authentication request passes through verifying, And the access token is sent to the service sub-system 101 for sending the ID authentication request;It receives and verifies described The access token that image subsystem 103 is sent, when the received access token passes through certification, to the image subsystem System 103, which is sent, passes through certification;
The image subsystem 103, for receiving the image mark and the visit that the service sub-system 101 is sent It asks token, and the access token is sent to the authentication center 102;When receiving the authentication center 102 When passing through certification of transmission, obtains the corresponding URL of the electron image, and the URL is sent to the business subsystem System 101.
In embodiments of the present invention, service sub-system is needed when getting user's input user information and image identifies ID authentication request first is sent to authentication center, so that the identity of user is verified at authentication center, so that really Whether the identity for determining user is legal, and the safety that electron image is had access to not only can be improved, and can also pass through authentication center The dependence of service sub-system and electronic image system is reduced, so that service sub-system and image subsystem decoupled, reduce image The difficulty of system maintenance, when user identity is legal, service sub-system can receive the visit of authentication center transmission It asks token, is identified using the image that access token and user input, image can be obtained from image subsystem and identify corresponding electricity URL corresponding to sub-image can obtain the electron image that user is had access to by URL.
In an embodiment of the present invention, the image subsystem is further used for obtaining the storage position of the electron image It sets, obtains the electron image from the storage location, encrypted using the electron image that preset key pair obtains, and will The encrypted electron image is stored to preset encrypted location, generates URL corresponding with the encrypted location;
The service sub-system is further used for having access to the encrypted electron image by the URL, by described Electron image decryption after key pair encryption, the electron image after being decrypted, and by the electronics after decryption Image show gives the user.
In embodiments of the present invention, image subsystem confirm service sub-system send access token pass through certification when, It needs to identify corresponding electron image using preset key encrypted image, regenerates the corresponding URL of encrypted electron image, Service sub-system can get encrypted electron image by URL, can be solved to encrypted electron image by key Close, after obtaining decryption electron image, and avoid URL from being stolen by third party and obtain corresponding electron image, so as to improve The safety of electron image.
In an embodiment of the present invention, the image subsystem is further used for generating the corresponding number of the access token The digital watermark information is loaded into the electron image of acquisition by word watermark information, and utilizes preset key pair quilt Load the electron image encryption of the digital watermark information.
In embodiments of the present invention, image subsystem needs after the access token for determining service sub-system is by verifying Digital watermark information is generated, which is loaded into image and is identified in corresponding electron image, it can be to avoid electronics It is distorted when image is stolen by third party.
It is understood that digital watermark information may include the system banner and user information of service sub-system.
For example, the digital watermark information of generation may include the system banner 002 and user information of service sub-system Xiao Zhang.
In an embodiment of the present invention, the image subsystem, for utilizing Secure Hypertext Transfer Protocol HTTPS agreement The URL is sent to the service sub-system;
The service sub-system has access to the electron image by the URL, and will for utilizing the HTTPS agreement The electron image having access to shows the user.
In embodiments of the present invention, image subsystem and service sub-system need to pass through when transmitting URL and electron image The transmission of HTTPS agreement can substantially reduce third party's steal information, the risk of identity is pretended to be in falsification.
In an embodiment of the present invention, the authentication center is further used for the access token that storage generates; And the execution when receiving the access token that the image subsystem is sent:
D0: it determines in the access token of storage with the presence or absence of the access token sent with the image subsystem Otherwise identical access token, executes D2 if so, executing D1;
D1: whether the access token for determining that the image subsystem is sent is expired, if so, D2 is executed, otherwise, to The image subsystem transmission passes through certification;
D2: authentification failure is sent to the image subsystem;
The image subsystem is further used in the authentification failure for receiving the authentication center transmission When, the authentification failure is sent to the service sub-system, so that the authentification failure is showed institute by the service sub-system State user.
In embodiments of the present invention, authentication center needs to store each access token generated, so that according to depositing Whether the access token that each access token of storage determines that image subsystem is sent is legal, effective, improves electronics shadow to realize As the safety having access to.
In an embodiment of the present invention, the authentication center, is further used for being stored in advance at least one user's Identity information, at least one corresponding system banner of each described identity information and at least one corresponding image mark;It connects The ID authentication request that any service sub-system is sent is received, and is executed:
S0: determine storage each identity information in, if exist with the ID authentication request carry described in Otherwise the identical same identity information of user information, executes S3 if so, executing S1;
S1: it determines in the corresponding each system banner of the same identity information, if exist and recognize with the identity Otherwise the identical system banner of the system banner that card request carries, executes S3 if so, executing S2;
S2: it determines in the corresponding each image mark of the same identity information, if exist and recognize with the identity Card requests the image carried to identify identical image mark, if so, executing the generation ID authentication request pair Otherwise the access token answered executes S3;
S3: having no right to access to service sub-system transmission, so that the service sub-system haves no right access displaying for described To the user.
In embodiments of the present invention, authentication center receive service sub-system transmission ID authentication request when, The corresponding relationship between user information according to the pre-stored data, system banner and image mark is needed, the conjunction of user identity is verified Method when determining that user identity is legal, generates corresponding access and enables to improve the safety that electron image is had access to Board, so that user has access to electron image.
In an embodiment of the present invention, the image subsystem, is further used for being arranged that the URL is corresponding to have access to permission And operating right, according to it is described have access to permission and monitor the service sub-system electron image is had access to by the URL, work as institute It states when having access to permission failure, the service sub-system is prevented to execute the operating right corresponding operation acquisition electronics shadow Picture;
Wherein, described to have access to permission, comprising: access duration when the service sub-system accesses the electron image and/ Or access times, the operating right, comprising: check permission, downloading when the service sub-system accesses the electron image It is any one or more in permission and modification authority.
In embodiments of the present invention, image subsystem is after generating URL, needs to be arranged that URL is corresponding has access to permission and behaviour Make permission, so that according to the operation behavior of permission and operating right monitoring business subsystem when having access to electron image is had access to, it is real Now improve the purpose of the safety of electron image.
To sum up, electron image is had access to by service sub-system, authentication center, image management subsystem user, Can not only make service sub-system and image subsystem full decoupled, it is also possible that have access to process it is safer efficiently, that is, pass through Authentication center provides intermediary's secure interactive, and image subsystem internal has access to from authentication, authorization identifying to electronics shadow As the control for storing access and showing the encryption of electron image, digital watermarking integrality of physics, the peace of electron image is improved Quan Xing, and from reliability guarantee electron image integrity degree.
As shown in Fig. 2, in order to more clearly illustrate technical solution of the present invention and advantage, below service sub-system For b201, authentication center 202 and image subsystem 203, to a kind of management that electron image is had access to provided by the invention System is described in detail, comprising:
Service sub-system b201, for obtaining the user information and image mark of user's input, to authentication center 202 Send ID authentication request, wherein the system banner of ID authentication request carrying user information and service sub-system b201.
Specifically, service sub-system is not to believe user when the user information and image for getting user's input identify Breath and image mark are transmitted directly to image subsystem, but need to first pass through the verification at authentication center, to determine user Identity it is whether legal.
For example, service sub-system obtains the user information little Cui of user's input, image is identified as electrocardio image, and to Authentication center sends the ID authentication request for carrying the system banner b and user information little Cui of service sub-system b.
Authentication center 202, identity information, each identity information at least one user to be stored in advance are corresponding At least one system banner and at least one corresponding image mark;The identity that any service sub-system b201 is sent is received to recognize Card request, and execute:
S0: in each identity information for determining storage, if exist identical as the user information that ID authentication request carries Same identity information, if so, execute S1, otherwise, execute S3.
Specifically, authentication center is by being stored in advance the corresponding system banner of identity information, identity information of user It is identified with corresponding image, the corresponding relationship between identity information and system banner and image mark can be determined, according to correspondence Relationship can determine whether the user information carried in ID authentication request is legal.
S1: it determines in the corresponding each system banner of same identity information, if exist and ID authentication request carrying Otherwise the identical system banner of system banner, executes S3 if so, executing S2.
Specifically, there is in each identity information for determining storage the use sent with service sub-system in authentication center When the identical same identity information of family information, it can determine that the identity of user is verified for the first time, still, it is also necessary to according to correspondence Relationship determines whether service sub-system has the permission of access image subsystem, avoids user from obtaining enterprise using external system and believes Breath.
S2: it determines in the corresponding each image mark of same identity information, if exist and ID authentication request carrying Image identifies identical image mark, if so, generating and storing the corresponding access token of ID authentication request, and will access Token is sent to service sub-system b201, otherwise, executes S3.
Specifically, authentication center is legal in the identity for determining user, and service sub-system has access image subsystem After the permission of system, it is also necessary to according to corresponding relationship, the image mark whether user has access ID authentication request to carry determined Permission avoids company information from revealing, so as to improve the safety of electronic image data.
S3: having no right to access to service sub-system b201 transmission, so that service sub-system b201, which will have no right access, shows use Family.
Specifically, authentication center is the identity for determining user is illegal or service sub-system does not have access image When the permission of subsystem or user do not have the permission for the image mark that access ID authentication request carries, need to business System transmission haves no right to access, so as to inform that user can not access corresponding electron image by service sub-system.
Service sub-system b201, for when receiving the access token of the transmission of authentication center 202, image to be identified Image subsystem is sent to access token.
Specifically, service sub-system needs to enable the access when getting the access token of authentication center transmission The corresponding image mark of the electron image to be had access to of board and user is sent to image subsystem, so that image subsystem is to access The validity of token is verified.
Image subsystem 203, for receiving the image mark and access token of service sub-system b201 transmission, and will access Token is sent to authentication center 202.
Specifically, image subsystem is not straight when the access token and image for receiving service sub-system transmission identify It connects and image is identified into corresponding electron image is sent to service sub-system, but need the authenticity and effectively of authentication-access token Property, so as to determine whether the permission for identifying corresponding electron image by accessing transmitted image.
Authentication center 202, for executing when receiving the access token of the transmission of image subsystem 203:
D0: it determines and whether there is visit identical with the access token that image subsystem 203 is sent in the access token of storage It asks token, if so, executing D1, otherwise, executes D2;
D1: whether the access token for determining that image subsystem 203 is sent is expired, if so, D2 is executed, otherwise, to image The transmission of subsystem 203 passes through certification;
D2: authentification failure is sent to image subsystem 203.
Specifically, authentication center needs to store each access token generated, so that receiving image subsystem When the access token that system is sent, its authenticity is determined according to each access token of storage, is determining what image subsystem was sent Access token be legal token when, determining its validity, that is, determine whether it is expired, and if only if access token i.e. effectively again It in the case where legal, sends to image subsystem through certification, so that image subsystem executes electronics shadow needed for having access to user Picture.
When the legitimacy or effective sexual abnormality of the access token that image subsystem is sent, need to send to service sub-system Authentification failure, so that user has access to situation by service sub-system understanding electron image.
Image subsystem 203, for obtaining electronics shadow when receiving when passing through certification of the transmission of authentication center 202 The storage location of picture obtains electron image from storage location, the corresponding digital watermark information of access token is generated, by digital watermarking Information is loaded into the electron image of acquisition, and is added using the electron image that preset key pair is loaded digital watermark information It is close, encrypted electron image is stored to preset encrypted location, URL corresponding with encrypted location is generated, it is super using safety URL is sent to service sub-system b201 by text transfer protocol HTTPS agreement.
Specifically, image subsystem needs to obtain use after the access token for determining service sub-system transmission is authentic and valid The image to be had access to of family identifies the storage location of corresponding electron image, so as to obtain electron image from storage location.? Also need to generate the corresponding digital watermark information of access token after getting corresponding electron image, i.e., according to the electronics shadow of acquisition The pictorial information of picture, the user information of user and system banner generate digital watermark information, and digital watermark information is loaded into and is obtained In the electron image taken, and it is encrypted, the safety of electron image can be improved, can also utmostly guarantee electron image Integrity degree.The corresponding URL of encrypted electron image is regenerated, calls electronics shadow for service sub-system using HTTPS agreement Picture can also further increase the safety of electron image.
Service sub-system b201 passes through URL tune for receiving the uniform resource position mark URL of the transmission of image subsystem 203 Encrypted electron image is read, is decrypted by the electron image after key pair encryption, the electron image after being decrypted, and will solution Electron image after close shows user.
Image subsystem, being further used for setting, URL is corresponding has access to permission and operating right, according to having access to permission monitoring Service sub-system has access to electron image by URL, when having access to permission failure, prevents service sub-system from executing operating right corresponding Operation have access to electron image;
Wherein, permission is had access to, comprising: service sub-system accesses the access duration and/or access times when electron image, behaviour Make permission, comprising: service sub-system accesses any one checked in permission, download permission and modification authority when electron image Or it is multiple.
Specifically, image subsystem needs that each URL is corresponding has access to permission and operating right according to setting, so that root According to the operation for having access to permission and when operating right monitoring business subsystem has access to electron image, electronics is had access to when service sub-system It when image when operation exception, needs that it is prevented to have access to electron image, to improve the safety of electron image.
To sum up, service sub-system is inverted by authentication center to rely on the certification of image subsystem, then pass through Digital watermark processing, encryption to electron image, and the URL generated by the transmission of HTTPS agreement, service sub-system are logical Crossing URL can be completed having access to for electron image, ensure that the safety of electron image ensure that from reliability to the greatest extent The integrity degree of electron image, and utmostly reduce the probability that electron image is tampered.
As shown in figure 3, the embodiment of the invention provides a kind of management methods that electron image is had access to, comprising:
Step 301: the user information of user's input is obtained by service sub-system described at least one and image identifies, to The authentication center sends ID authentication request, wherein the ID authentication request carries the user information and business The system banner of subsystem;
Step 302: the body that any service sub-system is sent is received and verified by the authentication center Part certification request generates the corresponding access of the ID authentication request and enables when the ID authentication request passes through verifying Board, and the access token is sent to the service sub-system for sending the ID authentication request;
Step 303: by service sub-system described at least one when the access for receiving the authentication center transmission When token, image mark and the access token are sent to the image subsystem;
Step 304: being identified by the image that the image subsystem receives the service sub-system transmission and described Access token, and the access token is sent to the authentication center;
Step 305: the access order that the image subsystem is sent is received and verified by the authentication center Board passes through certification to image subsystem transmission when the received access token passes through certification;
Step 306: by the image subsystem when receiving when passing through certification of the authentication center transmission, obtaining The corresponding uniform resource position mark URL of the electron image is taken, and the URL is sent to the service sub-system;
Step 307: the unified money that the image subsystem is sent is received by least one described described service sub-system Source finger URL URL is had access to by the URL and shows that the image identifies corresponding electron image.
In embodiments of the present invention, through service sub-system when getting user's input user information and image identifies, It needs first to send ID authentication request to authentication center, so as to test by identity of the authentication center to user Card, so as to determine whether the identity of user is legal, and the safety that electron image is had access to not only can be improved, can also pass through identity Authentication center reduces the dependence of service sub-system and electronic image system, so that service sub-system and image subsystem decoupled, drop The difficulty of low image subsystem maintenance can receive authentication by service sub-system when user identity is legal The access token that center is sent is identified using the image that access token and user input, and can obtain image from image subsystem URL corresponding to corresponding electron image is identified, the electron image that user is had access to can be obtained by URL.
It is in an embodiment of the present invention, described to obtain the corresponding uniform resource position mark URL of the electron image, comprising:
Obtain the storage location of the electron image;
The electron image is obtained from the storage location;
Using preset key pair obtain the electron image encrypt, and by the encrypted electron image store to Preset encrypted location;
Generate URL corresponding with the encrypted location;
It is described to be had access to by the URL and show that the image identifies corresponding electron image, comprising:
The encrypted electron image is had access to by the URL;
The electron image by the electron image decryption after the key pair encryption, after being decrypted;
The electron image after decryption is showed into the user.
In an embodiment of the present invention, after the electron image from storage location acquisition, in the benefit Before being encrypted with the electron image that preset key pair obtains, further comprise:
Generate the corresponding digital watermark information of the access token;
The digital watermark information is loaded into the electron image of acquisition;
The electron image obtained using preset key pair is encrypted, comprising:
It is encrypted using the electron image that preset key pair is loaded the digital watermark information.
The each embodiment of the present invention at least has the following beneficial effects:
1, in an embodiment of the present invention, service sub-system is when getting user and inputting user information and image and identify, It needs first to send ID authentication request to authentication center, so that the identity of user is verified at authentication center, with Make to determine whether the identity of user is legal, and the safety that electron image is had access to not only can be improved, can also pass through authentication Center reduces the dependence of service sub-system and electronic image system, so that service sub-system and image subsystem decoupled, reduce shadow As the difficulty of subsystem maintenance, when user identity is legal, service sub-system can receive the transmission of authentication center Access token, identified using the image that access token and user input, image mark can be obtained from image subsystem and is corresponded to Electron image corresponding to URL, the electron image that user is had access to can be obtained by URL.
2, in an embodiment of the present invention, image subsystem passes through certification in the access token that confirmation service sub-system is sent When, it needs to identify corresponding electron image using preset key encrypted image, it is corresponding to regenerate encrypted electron image URL, service sub-system can get encrypted electron image by URL, by key can to encrypted electron image into Row decryption, the electron image after obtaining decryption, and avoid URL from being stolen by third party and obtain corresponding electron image, so as to Improve the safety of electron image.
3, in an embodiment of the present invention, image subsystem the access token for determining service sub-system by verifying after, It needs to generate digital watermark information, which is loaded into image and is identified in corresponding electron image, it can be to avoid It is distorted when electron image is stolen by third party.
4, in an embodiment of the present invention, image subsystem and service sub-system are needed when transmitting URL and electron image It is transmitted by HTTPS agreement, third party's steal information can be substantially reduced, the risk of identity is pretended to be in falsification.
5, in an embodiment of the present invention, authentication center needs to store each access token generated, so that root Whether the access token for determining that image subsystem is sent according to each access token of storage is legal, effective, to realize raising electricity The safety that sub-image is had access to.
6, in an embodiment of the present invention, authentication center is in the ID authentication request for receiving service sub-system transmission When, the corresponding relationship between user information according to the pre-stored data, system banner and image mark is needed, user identity is verified Legitimacy when determining that user identity is legal, generates corresponding access and enables to improve the safety that electron image is had access to Board, so that user has access to electron image.
It should be noted that, in this document, such as first and second etc relational terms are used merely to an entity Or operation is distinguished with another entity or operation, is existed without necessarily requiring or implying between these entities or operation Any actual relationship or order.Moreover, the terms "include", "comprise" or its any other variant be intended to it is non- It is exclusive to include, so that the process, method, article or equipment for including a series of elements not only includes those elements, It but also including other elements that are not explicitly listed, or further include solid by this process, method, article or equipment Some elements.In the absence of more restrictions, the element limited by sentence " including one ", is not arranged Except there is also other identical factors in the process, method, article or apparatus that includes the element.
Finally, it should be noted that the foregoing is merely presently preferred embodiments of the present invention, it is merely to illustrate skill of the invention Art scheme, is not intended to limit the scope of the present invention.Any modification for being made all within the spirits and principles of the present invention, Equivalent replacement, improvement etc., are included within the scope of protection of the present invention.

Claims (10)

1. a kind of management system that electron image is had access to characterized by comprising
At least one service sub-system, authentication center and image subsystem;
Each described service sub-system, for obtaining the user information and image mark of user's input, to the authentication Center sends ID authentication request, and when receiving the access token that the authentication center is sent, the image is identified The image subsystem is sent to the access token, wherein the ID authentication request carries the user information and institute State the system banner of service sub-system;The uniform resource position mark URL that the image subsystem is sent is received, the URL is passed through It has access to and shows that the image identifies corresponding electron image;
The authentication center, the ID authentication request sent for receiving and verifying any service sub-system, When the ID authentication request passes through verifying, the corresponding access token of the ID authentication request is generated, and will be described Access token is sent to the service sub-system for sending the ID authentication request;It receives and verifies the image subsystem hair The access token sent passes through certification to image subsystem transmission when the received access token passes through certification;
The image subsystem, for receiving the image mark and the access token that the service sub-system is sent, and The access token is sent to the authentication center;When receive that the authentication center sends passes through certification When, the corresponding URL of the electron image is obtained, and the URL is sent to the service sub-system.
2. management system according to claim 1, which is characterized in that
The image subsystem is further used for obtaining the storage location of the electron image, obtains institute from the storage location Electron image is stated, is encrypted using the electron image that preset key pair obtains, and the encrypted electron image is deposited Storage generates URL corresponding with the encrypted location to preset encrypted location;
The service sub-system is further used for having access to the encrypted electron image by the URL, passes through the key The encrypted electron image is decrypted, the electron image after being decrypted, and by the electron image after decryption Show the user.
3. management system according to claim 2, which is characterized in that
The image subsystem is further used for generating the corresponding digital watermark information of the access token, by the digital water Official seal breath is loaded into the electron image of acquisition, and the institute of the digital watermark information is loaded using preset key pair State electron image encryption.
4. management system according to claim 1, which is characterized in that
The image subsystem, for the URL to be sent to the business using Secure Hypertext Transfer Protocol HTTPS agreement Subsystem;
The service sub-system has access to the electron image by the URL, and will have access to for utilizing the HTTPS agreement The electron image show the user.
5. management system according to claim 1, which is characterized in that
The authentication center is further used for the access token that storage generates;And receiving the image subsystem It is executed when the access token that system is sent:
D0: it determines in the access token of storage with the presence or absence of identical as the access token that the image subsystem is sent Access token, if so, execute D1, otherwise, execute D2;
D1: whether the access token for determining that the image subsystem is sent is expired, if so, execute D2, otherwise, to described The transmission of image subsystem passes through certification;
D2: authentification failure is sent to the image subsystem;
The image subsystem is further used for when receiving the authentification failure that the authentication center is sent, to The service sub-system sends the authentification failure, so that the authentification failure is showed the use by the service sub-system Family.
6. management system according to claim 1, which is characterized in that
The authentication center is further used for that the identity information of at least one user, each described identity is stored in advance At least one corresponding system banner of information and at least one corresponding image mark;Any service sub-system is received to send The ID authentication request, and execute:
S0: in each identity information for determining storage, if there is the user carried with the ID authentication request Otherwise the identical same identity information of information, executes S3 if so, executing S1;
S1: it determines in the corresponding each system banner of the same identity information, if exist and asked with the authentication The identical system banner of the system banner of carrying is sought, if so, executing S2, otherwise, executes S3;
S2: it determines in the corresponding each image mark of the same identity information, if exist and asked with the authentication The image of carrying is asked to identify identical image mark, if so, it is corresponding to execute the generation ID authentication request Otherwise the access token executes S3;
S3: to the service sub-system transmission have no right to access so that the service sub-system by it is described have no right access show institute State user.
7. according to claim 1 to any management system in 6, which is characterized in that
The image subsystem, is further used for being arranged that the URL is corresponding to have access to permission and operating right, is had access to according to described Permission monitors the service sub-system and has access to the electron image by the URL, when it is described have access to permission failure when, prevention institute It states the corresponding operation of the service sub-system execution operating right and has access to the electron image;
Wherein, described to have access to permission, comprising: the service sub-system accesses the access duration and/or visit when the electron image Ask number, the operating right, comprising: check permission, download permission when the service sub-system accesses the electron image With it is any one or more in modification authority.
8. a kind of management method that electron image is had access to characterized by comprising
The user information and image mark that user's input is obtained by service sub-system described at least one, to the authentication Center sends ID authentication request, wherein the system that the ID authentication request carries the user information and service sub-system Mark;
The ID authentication request that any service sub-system is sent is received and verified by the authentication center, when When the ID authentication request passes through verifying, the corresponding access token of the ID authentication request is generated, and by the visit Ask that token is sent to the service sub-system for sending the ID authentication request;
It, will be described through service sub-system described at least one when receiving the access token that the authentication center is sent Image mark and the access token are sent to the image subsystem;
The image mark and the access token that the service sub-system is sent are received by the image subsystem, and will The access token is sent to the authentication center;
The access token that the image subsystem is sent is received and verified by the authentication center, when received institute When stating access token and passing through certification, pass through certification to image subsystem transmission;
By the image subsystem when receiving when passing through certification of the authentication center transmission, the electronics shadow is obtained The service sub-system is sent to as corresponding uniform resource position mark URL, and by the URL;
The uniform resource position mark URL that the image subsystem is sent is received by least one described described service sub-system, It is had access to by the URL and shows that the image identifies corresponding electron image.
9. management method according to claim 8, which is characterized in that
It is described to obtain the corresponding uniform resource position mark URL of the electron image, comprising:
Obtain the storage location of the electron image;
The electron image is obtained from the storage location;
It is encrypted using the electron image that preset key pair obtains, and the encrypted electron image is stored to default Encrypted location;
Generate URL corresponding with the encrypted location;
It is described to be had access to by the URL and show that the image identifies corresponding electron image, comprising:
The encrypted electron image is had access to by the URL;
The electron image by the electron image decryption after the key pair encryption, after being decrypted;
The electron image after decryption is showed into the user.
10. management method according to claim 9, which is characterized in that
After the electron image from storage location acquisition, described using described in the acquisition of preset key pair Before electron image encryption, further comprise:
Generate the corresponding digital watermark information of the access token;
The digital watermark information is loaded into the electron image of acquisition;
The electron image obtained using preset key pair is encrypted, comprising:
It is encrypted using the electron image that preset key pair is loaded the digital watermark information.
CN201811003144.7A 2018-08-30 2018-08-30 Electronic image retrieval management system and method Active CN109274650B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201811003144.7A CN109274650B (en) 2018-08-30 2018-08-30 Electronic image retrieval management system and method

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201811003144.7A CN109274650B (en) 2018-08-30 2018-08-30 Electronic image retrieval management system and method

Publications (2)

Publication Number Publication Date
CN109274650A true CN109274650A (en) 2019-01-25
CN109274650B CN109274650B (en) 2020-12-08

Family

ID=65154942

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201811003144.7A Active CN109274650B (en) 2018-08-30 2018-08-30 Electronic image retrieval management system and method

Country Status (1)

Country Link
CN (1) CN109274650B (en)

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112003702A (en) * 2020-07-08 2020-11-27 武汉旷视金智科技有限公司 Authentication method, authentication device, electronic equipment, computer storage medium and authentication system
CN112052434A (en) * 2020-07-30 2020-12-08 中国建设银行股份有限公司 Electronic file verification method and device, electronic equipment and readable storage medium
CN112582045A (en) * 2020-12-22 2021-03-30 无锡慧方科技有限公司 Electronic medical report sheet transmission system
CN112905986A (en) * 2021-04-16 2021-06-04 杭州海康威视数字技术股份有限公司 Authority authentication method, device, system and computer readable storage medium
CN113836331A (en) * 2021-09-24 2021-12-24 中国联合网络通信集团有限公司 Image query method, device and storage medium
CN116504365A (en) * 2023-06-25 2023-07-28 安徽影联云享医疗科技有限公司 Medical image information sharing method and related device

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101729541A (en) * 2009-11-26 2010-06-09 广东宇天信通通信科技有限公司 Method and system for accessing resources of multi-service platform
CN102333353A (en) * 2011-10-29 2012-01-25 华为技术有限公司 Media content accessing method and device
CN102685086A (en) * 2011-04-14 2012-09-19 天脉聚源(北京)传媒科技有限公司 File access method and system
US8997198B1 (en) * 2012-12-31 2015-03-31 Emc Corporation Techniques for securing a centralized metadata distributed filesystem
CN105704139A (en) * 2016-03-16 2016-06-22 杭州狮说教育科技有限公司 RTMP protocol-based streaming media service user authentication method
CN106713367A (en) * 2017-03-02 2017-05-24 山东浪潮云服务信息科技有限公司 Authentication method, authentication platform, business system and authentication system

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101729541A (en) * 2009-11-26 2010-06-09 广东宇天信通通信科技有限公司 Method and system for accessing resources of multi-service platform
CN102685086A (en) * 2011-04-14 2012-09-19 天脉聚源(北京)传媒科技有限公司 File access method and system
CN102333353A (en) * 2011-10-29 2012-01-25 华为技术有限公司 Media content accessing method and device
US8997198B1 (en) * 2012-12-31 2015-03-31 Emc Corporation Techniques for securing a centralized metadata distributed filesystem
CN105704139A (en) * 2016-03-16 2016-06-22 杭州狮说教育科技有限公司 RTMP protocol-based streaming media service user authentication method
CN106713367A (en) * 2017-03-02 2017-05-24 山东浪潮云服务信息科技有限公司 Authentication method, authentication platform, business system and authentication system

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112003702A (en) * 2020-07-08 2020-11-27 武汉旷视金智科技有限公司 Authentication method, authentication device, electronic equipment, computer storage medium and authentication system
CN112003702B (en) * 2020-07-08 2023-12-26 武汉旷视金智科技有限公司 Authentication method, authentication device, electronic equipment, computer storage medium and authentication system
CN112052434A (en) * 2020-07-30 2020-12-08 中国建设银行股份有限公司 Electronic file verification method and device, electronic equipment and readable storage medium
CN112582045A (en) * 2020-12-22 2021-03-30 无锡慧方科技有限公司 Electronic medical report sheet transmission system
CN112905986A (en) * 2021-04-16 2021-06-04 杭州海康威视数字技术股份有限公司 Authority authentication method, device, system and computer readable storage medium
CN112905986B (en) * 2021-04-16 2023-10-20 杭州海康威视数字技术股份有限公司 Authority authentication method, device and system and computer readable storage medium
CN113836331A (en) * 2021-09-24 2021-12-24 中国联合网络通信集团有限公司 Image query method, device and storage medium
CN116504365A (en) * 2023-06-25 2023-07-28 安徽影联云享医疗科技有限公司 Medical image information sharing method and related device

Also Published As

Publication number Publication date
CN109274650B (en) 2020-12-08

Similar Documents

Publication Publication Date Title
CN109274650A (en) A kind of management system and method that electron image is had access to
JP6719079B2 (en) Information equipment, data processing system, data processing method and computer program
CN103685138B (en) The authentication method of the Android platform application software that mobile interchange is online and system
US10841102B2 (en) Method and system for creating and checking the validity of device certificates
US7484246B2 (en) Content distribution system, content distribution method, information processing apparatus, and program providing medium
US7243238B2 (en) Person authentication system, person authentication method, information processing apparatus, and program providing medium
US7310732B2 (en) Content distribution system authenticating a user based on an identification certificate identified in a secure container
CN102438013B (en) Hardware based credential distribution
US7059516B2 (en) Person authentication system, person authentication method, information processing apparatus, and program providing medium
US8291238B2 (en) Systems and methods for secure transaction management and electronic rights protection
US7096363B2 (en) Person identification certificate link system, information processing apparatus, information processing method, and program providing medium
US6990684B2 (en) Person authentication system, person authentication method and program providing medium
CN110162936A (en) A kind of use authorization method of software content
US20020042884A1 (en) Remote printing of secure and/or authenticated documents
CN111027028A (en) Copyright data processing method and device based on intelligent contract
US8631486B1 (en) Adaptive identity classification
US20110289318A1 (en) System and Method for Online Digital Signature and Verification
CN103051451A (en) Encryption authentication of security service execution environment
CN106571951A (en) Audit log obtaining, generating and verifying method and system and device
CN107622210B (en) The data query method and system of authentication and authorisation verification
US20230412400A1 (en) Method for suspending protection of an object achieved by a protection device
CN113869901B (en) Key generation method, key generation device, computer-readable storage medium and computer equipment
CN107566410A (en) A kind of data save message request treating method and apparatus from damage
CN114969714A (en) User login authentication method, device and equipment based on block chain
CN109672526A (en) A kind of method and system for managing executable program

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
TA01 Transfer of patent application right

Effective date of registration: 20201113

Address after: 250100 Ji'nan high tech Zone, Shandong, No. 1036 wave road

Applicant after: INSPUR GENERAL SOFTWARE Co.,Ltd.

Address before: 250100, No. 2877, fairway, Sun Town, Ji'nan hi tech Zone, Shandong

Applicant before: SHANDONG INSPUR GENESOFT INFORMATION TECHNOLOGY Co.,Ltd.

TA01 Transfer of patent application right
GR01 Patent grant
GR01 Patent grant