CN1277366C - Method of information providing end data protection - Google Patents
Method of information providing end data protection Download PDFInfo
- Publication number
- CN1277366C CN1277366C CN 02145981 CN02145981A CN1277366C CN 1277366 C CN1277366 C CN 1277366C CN 02145981 CN02145981 CN 02145981 CN 02145981 A CN02145981 A CN 02145981A CN 1277366 C CN1277366 C CN 1277366C
- Authority
- CN
- China
- Prior art keywords
- management server
- request
- request end
- data management
- access code
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Expired - Lifetime
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
Abstract
The present invention discloses a method for protecting data at an information providing terminal, which belongs to the field of data security. A data management server is adopted for finishing managing access cipher codes of requesting terminals; the data management server distributes the access cipher codes for every requesting terminal at the information providing terminal and carries out identity verification according to the access cipher codes provided by the requesting terminals. The data management server can also log off and modify the access cipher codes of the requesting terminals according to indication of the information providing terminal. In the process of authorization, the information providing terminal only needs authorizing the requesting terminals on the data management server, and the data management server finishes distributing the access cipher codes for the requesting terminals; the information providing terminal self does not need to distribute the access cipher codes for the requesting terminals so as to realize the improvement of an authorization mechanism. In the process of verification, when the requesting terminals send access requests to the information providing terminal, the data management server finishes checking and verifying the access cipher codes of the requesting terminals so as to improve the efficiency for the requesting terminals to access the data at the information providing terminal.
Description
Technical field
The present invention relates to the data security field, particularly a kind of information provides the method for end data protection.
Background technology
In the communications field, provide the safeguard protection mode of data such as client information, resource to adopt the mode of password authentification usually for information.Need the request end of visit information data all to be assigned an access code to each; before visit information provides end data, will conduct interviews the earlier checking of password of this request end; the access code checking just can be access in visit by the request end, back; the access code checking is not by then refusing the visit of request end; promptly come the control request end to provide the visit of end data, prevent unauthorized access and illegal the access information by access code protection.Here, information provides end to be meant that the interviewee that certain information and resource are provided, request end are the access ends that sensing information provides data such as its information of end request visit, resource.
Location service (LCS specific to mobile communications network, Location Service) in, the request end provides in the process in end geographical position in the information of obtaining, and information provides end to need the request end to provide access code (cordword) to verify whether the request end is authorized to.At third generation partner plan (3GPP, ThirdGeneration Partnership Project) propose two kinds of verification modes to access code in the Rel 6TS2071-610 standard: a kind of mode is that information provides end to be each request end assigns access password, and when position requests, the request end provides access code to mobile communications network, mobile communications network offers information with access code together in company with solicited message end is provided, by the checking that information provides end to conduct interviews password, this verification mode is commonly referred to information end full powers way to manage is provided.Another kind of mode be information provide end in advance on mobile communications network the access code to each request end register, the access code that the request end provides is verified that this verification mode is commonly referred to the password authentification form management server by mobile communications network.
At present, provide under the end full powers way to manage in information, when information provide end to request end A authorize, when verifying, information provides end to be access code of request end A distribution, and will with the corresponding access code notice request of request end A end A; When request end A request visit information provides end data, provide end that the access code of oneself is provided to information; Information provides end when conducting interviews password authentification, is that access code that request end A is provided and the access code of oneself distributing to request end A compare, check, if consistent, then the request of accepting the interview is passed through in the access code checking; Otherwise, the denied access request.
Information provides under the end full powers way to manage, the distribution of access code, comparison, checks and manages all and provide end to finish by information.Like this, for a large amount of request ends, information provides end to distribute a large amount of different access code for the request end, and needs the corresponding relation between each access code of memory and the request end.For the modification and the cancellation work of access code, also need provide end to carry out corresponding access code distribution and management by information, workload is big and need occupied information that the storage resources of end is provided.
Under the password authentification form management server, information provides end to distribute an access code for request end B, and this access code is registered on the password authentification server in advance, information provides end or the password authentification server access code notice request end B with request end B then; When request end B request visit information provides end data, provide the access code of oneself to the password authentification server.The password authentification server is when conducting interviews password authentification, what the access code that the password authentification server provides request end B and information provided that end registers in advance compares, checks with the corresponding access code of request end B, if consistent, then the request of accepting the interview is passed through in the access code checking; Otherwise, the denied access request.
Password authentification server recited above is a kind of different access password that can stored information provide end that different request ends are distributed, and the server that can verify according to the access code that the request end provides.This password authentification server can independently become a physical entity, also can be used as a functional module and is integrated in other entities.
The password authentification form management server provides end full powers way to manage to simplify the access code verification portion that information provides end than information, and the access code verification portion is finished by the password authentification server.But the distribution of access code and management work are provided to bring in by information equally and finish, and information provides end equally to need each access code that memory distributed and the corresponding relation between the request end, to avoid causing misuse.For the modification and the cancellation work of access code, also need provide end to carry out corresponding access code distribution and management by information, exist information to provide the end workload big problem equally.
Summary of the invention
In view of this, the object of the present invention is to provide a kind of information that the method for end data protection is provided, distribution, management and the security verification of access code all concentrated in the data management server finish, realized improvement authority checking mechanism.
In order to achieve the above object, the invention provides the method that a kind of information provides the end data protection, it is characterized in that this method comprises:
A, provide in request end and information data management server is set between the end in advance, information provides the request end information of its mandate of end notification data management server, distribute an access code by this data management server for each request end that information provides end to authorize, and notify corresponding request end this access code;
B, when the request end visit information provides when end, its identity is verified according to the access code that the request end provides by the data management server that steps A is set.
Steps A further comprises:
A1, information provide end that the request end sign list of its mandate is provided to data management server;
A2, data management server distribute an access code for each request end, and notify corresponding request end with this access code; Simultaneously, the data management server stored information provides the corresponding relation between end sign, request end sign and access code and the three.
Step B further comprises:
B1, when request end request visit information provides end data, provide the access code of sign, request end sign and this request end that accessed information provides end to data management server;
B2, data management server search the access code that the corresponding request end of end is provided with information in self canned data, the access code that itself and current request end are provided compares to be checked, if it is consistent, then by password authentification, data management server notifies this request end to accept its access request; Otherwise data management server notifies this request end to refuse its access request.
Preferably, this method further comprises: when information provides the access code of end de-registration request end, information provides end to provide the request end that needs to nullify to identify list to data management server, data management server is nullified the original access code of respective request end according to this de-registration request end sign list, and notifies this request end.
This method further comprises: when information provides the access code of end modification request end, information provides end to provide the request end that needs to revise to identify list to data management server, data management server is redistributed access code according to this modification request end sign list for the respective request end, nullify the original access code in this request end simultaneously, and notify this request end amended access code.
Steps A further comprises: provide end to set in advance the data management server that comprises cipher random generator, storage database and password verifier in request end and information.
The present invention concentrates distribution, checking and the bookkeeping of having finished the request end access code by data management server.In whole process, information provides end only to need authorize the request end on data management server, and data management server is automatically to each request end assigns access password, and finishes to the discriminating of request end identity with to the management of access code.Therefore, access code provides to information that to bring in be transparent fully, information provides end not need to be request end assigns access password voluntarily, even the content that information provides end not need to know access code just finished whole licensing process, and the information of having simplified greatly provides the licensing scheme of end.When the request end provides end when sending access request to information, finish checking of request end access code and checking work by data management server, improved the request end provides end data to information access efficiency.
Description of drawings
Fig. 1 is an authority checking system configuration schematic diagram of the present invention;
The flow chart that Fig. 2 realizes for data management server authority checking of the present invention.
Embodiment
In order to make the purpose, technical solutions and advantages of the present invention clearer, the present invention is described in further detail below in conjunction with accompanying drawing.
The present invention is that the method that distribution, checking and the management by access code all finished by data management server is improved authority checking mechanism.
Fig. 1 is an authority checking system configuration schematic diagram of the present invention, and as shown in Figure 1: authority checking of the present invention system mainly provides end 103 to form by request end 101, data management server 102 and information.
Wherein, data management server 102 is meant and a kind ofly can identifies the server that distributes different access code and access code is managed and verifies according to the different request ends that information provide end to authorize.This data management server 102 can independently become a physical entity, also can be used as a functional module and is integrated in other entities.
In the present invention, information provides end to provide the request end of need authorizing sign list to data management server, and this request end sign can be the information that request end title etc. can the unique identification request end, provides end each different request end in order to distinguish this information.Cipher random generator in the data management server is access code of each request end Random assignment according to the preset standard algorithm, as adopt sign to add the algorithm of suffix generation password at random according to the request end, have nothing in common with each other and irregularities with the password that guarantees each request end.Data management server is notified corresponding request end with access code.This information provides the sign of end, this information provides end each request end sign and the password that distributes and three's corresponding relation each other to be stored in the storage database in the data management server.When request end request visit information provided end data, the request end provided the access code of sign, request end sign and this request end that accessed information provides end to data management server.Password verifier in the data management server searches the access code that corresponding this request end of end is provided with this information from the storage database, the access code that provides the request end of end to provide itself and this information compares to be checked, if it is consistent, then by password authentification, data management server notifies this request end to accept its access request; If inconsistent, then data management server notifies this request end to refuse its access request.
When information provides the access code that end need nullify some request ends, only needing provides the request end that needs to nullify to identify list to data management server, data management server is nullified the original access code in this request end automatically according to this de-registration request end sign list, and notifies this request end.This request end uses original access code can't provide end by visit information by password authentification.
When information provides the access code that end need revise some request ends, only needing provides the request end that needs to revise to identify list to data management server, data management server is redistributed access code for this request end automatically according to this modification request end sign list, and simultaneously that this request end is original access code is nullified.Data management server can be notified this request end with amended access code.This request end uses original access code can't provide end by visit information by password authentification, and this request end has only the newly assigned access code of use could be by password authentification, and visit information provides end.
With the location service in the mobile communications network is example, data management server is set in mobile communications network in advance, so, the data management server authorization verification process of request end when the information of obtaining provides the end geographical position comprises the steps: as shown in Figure 2
Step 201～step 203: licensing process.Information provides end that the request end sign list of its mandate is provided to the data management server of mobile communications network; Cipher random generator in the data management server distributes an access code for this information provides each request end of end, and this information of storage data library storage in the data management server provides the sign of end, each request end sign that this information provides end and the access code of distributing and the corresponding each other relation of three; Data management server is notified corresponding request end with the access code of distributing.
Step 204～step 208: proof procedure.The request that visit information provides end position is sent to the data management server of mobile communications network in the request end, and the request end provides the access code of sign, request end sign and this request end that accessed information provides end to data management server; Password verifier in the data management server searches the access code that corresponding this request end of end is provided with this information from the storage database, the access code that provides the request end of end to provide itself and this information compares to be checked, if it is consistent, then by password authentification, data management server notifies this request end to accept its access request; Otherwise data management server notifies this request end to refuse its access request.
In the present embodiment, when information provides the access code that end need nullify some request ends, only needing provides the request end that needs to nullify to identify list to the data management server of mobile communications network, data management server is nullified the original access code in this request end automatically according to this de-registration request end sign list, and notifies this request end.This request end uses original access code can't provide end by visit information by password authentification.
In the present embodiment, when information provides the access code that end need revise some request ends, only needing provides the request end that needs to revise to identify list to the data management server of mobile communications network, data management server is redistributed access code for this request end automatically according to this modification request end sign list, and the access code that this request end is original is nullified.Data management server can be notified this request end with amended access code.This request end uses original access code can't provide end by visit information by password authentification, and this request end has only the newly assigned access code of use could be by password authentification, and visit information provides end.
Certainly, in actual applications, the authority checking mechanism that end data safety is provided for information about that the present invention proposes can also be applied in other plurality of communication systems.
In a word, the above is preferred embodiment of the present invention only, is not to be used to limit protection scope of the present invention.
Claims (6)
1, a kind of information provides the method for end data protection, it is characterized in that this method comprises:
A, provide in request end and information data management server is set between the end in advance, information provides the request end information of its mandate of end notification data management server, distribute an access code by this data management server for each request end that information provides end to authorize, and notify corresponding request end this access code;
B, when the request end visit information provides when end, its identity is verified according to the access code that the request end provides by the data management server that steps A is set.
2, method according to claim 1 is characterized in that steps A further comprises:
A1, information provide end that the request end sign list of its mandate is provided to data management server;
A2, data management server distribute an access code for each request end, and notify corresponding request end with this access code; Simultaneously, the data management server stored information provides the corresponding relation between end sign, request end sign and access code and the three.
3, method according to claim 1 is characterized in that step B further comprises:
B1, when request end request visit information provides end data, provide the access code of sign, request end sign and this request end that accessed information provides end to data management server;
B2, data management server search the access code that the corresponding request end of end is provided with information in self canned data, the access code that itself and current request end are provided compares to be checked, if it is consistent, then by password authentification, data management server notifies this request end to accept its access request; Otherwise data management server notifies this request end to refuse its access request.
4, method according to claim 1, it is characterized in that this method further comprises: when information provides the access code of end de-registration request end, information provides end to provide the request end that needs to nullify to identify list to data management server, data management server is nullified the original access code of respective request end according to this de-registration request end sign list, and notifies this request end.
5, method according to claim 1, it is characterized in that this method further comprises: when information provides the access code of end modification request end, information provides end to provide the request end that needs to revise to identify list to data management server, data management server is redistributed access code according to this modification request end sign list for the respective request end, nullify the original access code in this request end simultaneously, and notify this request end amended access code.
6, method according to claim 1 is characterized in that steps A further comprises: provide in request end and information to set in advance the data management server that comprises cipher random generator, storage database and password verifier between the end.
Priority Applications (3)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN 02145981 CN1277366C (en) | 2002-10-31 | 2002-10-31 | Method of information providing end data protection |
| AU2003272873A AU2003272873A1 (en) | 2002-10-31 | 2003-10-17 | A method of data protection for information provider |
| PCT/CN2003/000871 WO2004054172A1 (en) | 2002-10-31 | 2003-10-17 | A method of data protection for information provider |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN 02145981 CN1277366C (en) | 2002-10-31 | 2002-10-31 | Method of information providing end data protection |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN1494253A CN1494253A (en) | 2004-05-05 |
| CN1277366C true CN1277366C (en) | 2006-09-27 |
Family
ID=32477212
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN 02145981 Expired - Lifetime CN1277366C (en) | 2002-10-31 | 2002-10-31 | Method of information providing end data protection |
Country Status (3)
| Country | Link |
|---|---|
| CN (1) | CN1277366C (en) |
| AU (1) | AU2003272873A1 (en) |
| WO (1) | WO2004054172A1 (en) |
Families Citing this family (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2007051430A1 (en) * | 2005-11-07 | 2007-05-10 | Huawei Technologies Co., Ltd. | Authentication password modification method, user agent server and user agent client based on sip |
| CN101047964B (en) * | 2006-03-29 | 2010-10-27 | 华为技术有限公司 | Method for detecting ICR data configuration consistent |
| CN100483988C (en) * | 2006-07-17 | 2009-04-29 | 华为技术有限公司 | Information propagating network and method for transmission information verification in network |
| CN108011858A (en) * | 2016-11-02 | 2018-05-08 | 深圳中电长城信息安全系统有限公司 | A kind of client-side management method and system, client, server |
Family Cites Families (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| FI109254B (en) * | 1998-04-29 | 2002-06-14 | Ericsson Telefon Ab L M | Method, system and device for verification |
| US6507907B1 (en) * | 1999-02-26 | 2003-01-14 | Intel Corporation | Protecting information in a system |
| JP3973010B2 (en) * | 2000-04-21 | 2007-09-05 | 富士通株式会社 | Authentication apparatus and authentication method for multiple services |
-
2002
- 2002-10-31 CN CN 02145981 patent/CN1277366C/en not_active Expired - Lifetime
-
2003
- 2003-10-17 WO PCT/CN2003/000871 patent/WO2004054172A1/en not_active Application Discontinuation
- 2003-10-17 AU AU2003272873A patent/AU2003272873A1/en not_active Abandoned
Also Published As
| Publication number | Publication date |
|---|---|
| CN1494253A (en) | 2004-05-05 |
| AU2003272873A1 (en) | 2004-06-30 |
| WO2004054172A1 (en) | 2004-06-24 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US20200285978A1 (en) | Model training system and method, and storage medium | |
| CN108200050B (en) | Single sign-on server, method and computer readable storage medium | |
| CN107342992B (en) | System authority management method and device and computer readable storage medium | |
| CN103078859B (en) | Operation system right management method, equipment and system | |
| CN101310286B (en) | Improved single sign on | |
| US7356838B2 (en) | System and method for controlling access to digital content, including streaming media | |
| CN1235379C (en) | Anomynous access to service | |
| US7490347B1 (en) | Hierarchical security domain model | |
| CN1507203A (en) | Method and system for conducting user verification to sub position of network position | |
| CN1992596A (en) | User authentication device and method | |
| CN1666171A (en) | Managing secure resources in web resources that are accessed by multiple portals | |
| CN102710640A (en) | Authorization requesting method, device and system | |
| JP2000057045A (en) | Permission for controlling access to service in protected memory system | |
| CN109756446A (en) | A kind of access method and system of mobile unit | |
| CN101064609A (en) | Method and apparatus for controlling access of information system | |
| CN104735091A (en) | Linux system-based user access control method and device | |
| CN111797418B (en) | Online service control method and device, service terminal, server and storage medium | |
| US20080163191A1 (en) | System and method for file transfer management | |
| CN105262780A (en) | Authority control method and system | |
| CN112637163B (en) | Authentication and authorization method and system based on API gateway | |
| CN1279551A (en) | Communication network and management for immigration of mobile agents | |
| CN111984949B (en) | Authentication method, device, electronic equipment and storage medium | |
| CN111031074B (en) | Authentication method, server and client | |
| CN1277366C (en) | Method of information providing end data protection | |
| CN111083142A (en) | Data access method, system and equipment applied to Internet of things |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| REG | Reference to a national code |
Ref country code: HK Ref legal event code: DE Ref document number: 1064538 Country of ref document: HK |
|
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| EE01 | Entry into force of recordation of patent licensing contract |
Application publication date: 20040505 Assignee: APPLE Inc. Assignor: HUAWEI TECHNOLOGIES Co.,Ltd. Contract record no.: 2015990000755 Denomination of invention: Method of information providing end data protection Granted publication date: 20060927 License type: Common License Record date: 20150827 |
|
| LICC | Enforcement, change and cancellation of record of contracts on the licence for exploitation of a patent or utility model | ||
| CX01 | Expiry of patent term | ||
| CX01 | Expiry of patent term |
Granted publication date: 20060927 |