TW202127289A - Method for cross-platform authorizing access to resources and authorization system thereof - Google Patents

Abstract

A method for cross-platform authorizing access to resources and an authorization system thereof are provided. The system provides an agent module that can receive a resource access request from a resource owner and issues an authorization request to an authorization module. The authorization module can therefore obtain an identification code and a resource item requested by the resource owner. After authenticating the resource owner, the authorization module generates an access token associated with the resource item. An authentication code algorithm is performed onto the resource item and the access token for generating an authentication code. The access token, the resource item and the authentication code are transmitted to the agent module and a resource module. The resource module then provides information for accessing the resource item to the resource owner after confirming the authentication code. .

Description

Cross-platform authorized access resource method and authorized access system

The invention relates to an authorization verification system, in particular to a cross-platform authorization access resource method and authorization access system for transferring part of authorization programs to a resource party to transfer the work of an authorization server.

With the maturity of the Internet and information technology, many applications have emerged. At the same time, network information security is one of the most important issues. Security verification generally relies on encryption and decryption technology between devices to prevent data from being compromised. Tampering and relying on the user's own identification data to ensure that the identity of the accessor is correct, such as traditional accounts and passwords, biometric technology, and mechanisms that can provide security authentication through the user's personal device.

As the applications on the Internet become more and more complex, many existing technologies also propose safer verification and authorization procedures based on demand. For example, Internet financial services require more secure transaction procedures, and it is common to propose a fair third-party authorization and authorization process. Authentication technology, such as an open authorization (OAuth, OAuth2) protocol.

Open authorization (OAuth/OAuth2.0) is an open standard that allows users to access specific network resources through a third-party authorization mechanism, which uses certificates or one-time passwords (token), which are different from traditional account and password security measures . Using this type of certificate can also control authorized users to access network resources within a specific range, such as videos, photos, documents, etc. The open authorization (OAuth/OAuth2.0) allows users to authorize third-party websites to save Take the user's specific resources at a specific location (website).

It is worth mentioning that the OAuth2.0 authorization protocol can solve the authorization problem that resources may be scattered on multiple servers. Users can authorize on multiple servers after one authentication. Only after confirming that the access certificate carried in the request information is legal, the device can complete the third-party authorization and grant access to the resource. For example, the authentication mechanisms of Facebook™, Google™, etc. are often used by various applications, which can be called Open ID. These applications rely on the authentication results of Facebook and Google, allowing users to log in to various applications using Facebook, Google, and other accounts. Once the application is authenticated, it can access various network resources.

In view of the current open authorization mechanism that may cause the main authorization server to deal with a large number of authorization requirements, resulting in poor performance or heavy overall load, the disclosure proposes a cross-platform authorization access method and an authorization access system. One of its purposes is to solve the problem that the verifier is responsible for a large number of verification calculations in the conventional cross-platform (such as across multiple units, financial institutions) authorization technology. The disclosed method extends the verification procedure to the part that can be executed by the relevant host of the resource party. Verification procedures.

According to one of the embodiments, the method for cross-platform authorized access to resources runs in an authorized access system. In this authorized access system, a proxy access module is proposed, and the proxy access module receives resources from a resource owner Access request, the request includes the resource item to be requested and the identification code of the resource owner. After that, the proxy access module will generate an authorization request based on the resource access request and send it to the authorization module. The authorization module can obtain the identification code of the resource owner based on the authorization request, and then identify the resource owner verify.

After the identity verification is completed, the authorization module will generate an access code corresponding to the requested resource item, and the resource item and the access code will form a verification data, and then send the verification data to the proxy access module and a resource Module. At this time, the proxy access module also sends a resource access request to the resource module. After the resource module checks that the authentication data received from the authorization module is correct, it can provide resource ownership based on the obtained resource access request A resource to obtain information.

Preferably, the authentication data formed by the authorization module's calculation of the resource item and the access code can be a bet calculation, and then a bet value is formed. This bet value can provide the resource module to verify whether the data has not been tampered with. After confirming that it is correct, the resource owner will be provided with information about the resource item, such as a link to download the resource item or information, according to the resource access request.

Further, when the proxy access module receives the resource access request, it can generate an authorization request after digital signature with a proxy identification code and a key of the proxy access module, and then send it to the authorization module after being encrypted .

Further, the authorization module can query and obtain the communication method of the resource owner according to the identification code of the resource owner, so as to complete identity verification with the resource owner according to the communication method.

According to the embodiment of the authorization access system, the main component of the system is the resource module, which can provide the resource owner or authorize others to access various resource items through the network. There is an authorization module that can provide access through the network. User authentication and authorization services for various resource items in the resource module, as well as a proxy access module, can provide proxy services for resource owners themselves or authorized others to access various resource items in the resource module through the network.

Further, the proxy access module may be a proxy server that provides users requesting access to resource items; the authorization module may be an authorization server that is responsible for authorizing access to resources; and the resource module may provide various resource items Resource server.

In order to further understand the features and technical content of the present invention, please refer to the following detailed description and drawings about the present invention. However, the provided drawings are only for reference and description, and are not used to limit the present invention.

The following are specific specific examples to illustrate the implementation of the present invention. Those skilled in the art can understand the advantages and effects of the present invention from the content disclosed in this specification. The present invention can be implemented or applied through other different specific embodiments, and various details in this specification can also be based on different viewpoints and applications, and various modifications and changes can be made without departing from the concept of the present invention. In addition, the drawings of the present invention are merely schematic illustrations, and are not drawn according to actual dimensions, and are stated in advance. The following embodiments will further describe the related technical content of the present invention in detail, but the disclosed content is not intended to limit the protection scope of the present invention.

It should be understood that although terms such as "first", "second", and "third" may be used herein to describe various elements or signals, these elements or signals should not be limited by these terms. These terms are mainly used to distinguish one element from another, or one signal from another signal. In addition, the term "or" used in this document may include any one or a combination of more of the associated listed items depending on the actual situation.

The disclosure discloses a cross-platform authorized access resource method and authorized access system. One of the problems that the proposed method and system must solve is that in the conventional cross-platform (such as across multiple units, financial institutions) authorization technology, The party responsible for the authorization is responsible for multi-party verification, and therefore is also responsible for a large number of verification calculations. This will cause the system to be affected by the heavy calculation burden. One of the purposes of the cross-platform authorization access to resources method proposed in the disclosure is Extend the verification procedure to other units, for example, the verification procedure can be executed by the relevant host that provides the resources.

In the authorization access system running the cross-platform authorization access resource method, according to the embodiment described in the specification, the system architecture of the authorization access system is shown in FIG. 1, which shows the main proxy server 10, authorization server 12, and The resource server 14 can be independent and network-connected server hosts, or functional modules in various hosts, and the running functions can also be functional modules running in various current server systems, for example, To operate as a module in various servers in financial institutions, government agencies, or private enterprises, the actual implementation is not limited to a specific method.

Under this authorized access system architecture, the user can operate the web browser, specific applications running on the user device 101, or the mobile applications running on the personal mobile device (such as APP) to connect to a proxy server (Agent/client server) 10. The proxy server 10 can provide one or more resource owners themselves or authorized others to access various resource items in the resource server 14 through the Internet. This is a third party proposed by the system. The service server (or a software module running on a specific server) allows users to use a web page or a user interface in a specific application to input the resource items to be obtained from the resource server 14 to form a Resource access request. The resource server 14 provides services for one or more resource owners to access various resource items by themselves (or authorized by others) through the network. A resource database 140 is provided in which various accessible resources are stored. They are all associated with a specific user's identification code (user ID), such as some resource items such as personal privacy, sensitive information, and some files with high security levels.

After that, the proxy server 10 forms an authorization request according to the items recorded in the resource access request, such as the resource item to be obtained and the identification code of the resource owner, and then transmits the authorization request to the authorization server 12. The authorization server 12 can also be a software module running in a specific server host, and can provide user authentication and authorization services for users to access various resource items in the resource server 14 through the network. The authorization server 12 is provided with a user database 120. Therefore, the resource owner’s communication method can be obtained by querying the resource owner’s identification code recorded in the resource access request. Therefore, the resource owner’s communication method can be verified through this communication method. Resource owner.

For example, the authorization server 12 (or related functional modules) sends an identity confirmation request to the resource owner through the communication method obtained by the query, requesting the resource owner to verify the identity through the website, application, or specific communication information. Request, the specified authentication data such as password, device information of user device 101 (such as mobile device), biometrics of the resource owner, one-time password generated by user device 101, or SMS or SMS generated by the authorization module The one-time password (OTP) sent to the user device 101 is pushed, and the authorization server 12 verifies the one-time password generated by the user device 101 of the resource owner.

After completing the identity verification of the resource owner, the authorization server 12 will generate an access code corresponding to the requested resource item, and the resource item and the access code will form a verification data to provide the resource server 14 for verification After the data is correct, a link to the requested resource can be generated. This link is a link to the address of a specific resource item in the resource database 140, which is provided to the requesting resource owner or authorized others.

According to the embodiment of the authorization access system, the proxy server 10, the authorization server 12, and the resource server 14 can be independently running servers, software modules running on specific servers, or as required They are software modules running on a specific server host or independent servers. Under the system architecture, users can implement cross-platform authorization to access resource items in a specific resource server 14 through the authorization server 12. The proxy server 10 is to provide multiple end users with this authorization access service. Relay server.

Figure 2 shows a flow chart of an embodiment of a cross-platform authorization access resource method running in an authorization access system. The proxy access module, authorization module, and resource module described in the process can be software running on a specific server The module can also be a stand-alone server.

Initially, in step S201, the proxy access module receives the resource access request sent by the user, and the proxy access module can obtain the request content from the resource access request, including the resource item and the identification code of the resource owner ( user ID), and then sign the authentication code (client ID) of the proxy access module and the key exchanged with the authorization module in advance to generate an authorization request, and continue to use the public key provided by the authorization module Encryption is performed, and the authorization request is sent to the authorization module (step S203).

After the authorization module receives the authorization request, in step S205, the authorization module compares the user database according to the identification code of the resource owner to obtain the communication method of the resource owner, and can communicate with the resource owner according to this method. Perform authentication. Once the identity of the resource owner is confirmed, in step S207, the authorization module generates an access code corresponding to the requested resource item. This is one of the information to be verified. The authorization module can associate the resource item with this After the access code is calculated, a verification data is formed.

According to an embodiment, one of the methods for generating authentication data is to perform an authentication code algorithm. This authentication code algorithm is a process of disassembling and calculating the resource item and the access code in plain text to obtain an authentication code algorithm. Betting value. The purpose of the described code calculation technique is to provide a mechanism that the transmitted data will not be tampered with or destroyed by an unauthorized third party, for example, calculation of a message authentication code (MAC) proposed in the financial industry , Or can use hash algorithm (hash algorithm) to calculate the hash value, encryption or digital signature (digital signature) and other technologies, used for the verification of the information between the exchanges, to protect the correctness of the financial information.

Then, in step S209, the authorization module transmits the access code, resource item, and pledge value to the proxy access module and the resource module. At this time, in step S211, the resource module obtains the resource owner's information. The proxy access module sends a resource access request including the resource owner information to the resource module, or obtains it from the authorization module, as in step S213. Once the resource module checks that the pledged value is correct, it means that the authorization module sends The content is correct, and can provide the resource owner with a resource to obtain information.

For the identity verification procedure in the flow, refer to the flowchart of the embodiment of performing identity verification in the cross-platform authorization access to resources method shown in FIG. 3.

Before the authorization module performs identity verification, similarly, the process is still started by the proxy access module receiving the resource access request generated by the resource owner or authorized others (step S301), and the proxy access module uses its proxy to identify After the code and key are digitally signed, an authorization request is generated (step S303), and the authorization request is encrypted and sent to the authorization module (step S305), and the authorization module verifies the authorization request according to the digital signature (step S305). S307), the authorized module decrypts and obtains the identification code of the resource owner based on the digital signature (step S309). At the same time, the communication method of the resource owner can be obtained by querying the user database to execute with the resource owner Identity verification (step S311), for example, identity verification through a traditional password or a one-time password.

After that, once the authorization module successfully verifies the identity of the resource owner, an access code is generated. The resource item and the access code can be calculated to form a verification data, and the verification data is sent to the resource module. When the resource module checks from After the authentication data received by the authorization module is correct, it can verify the resource access request from the proxy access module according to the resource access request sent by the proxy access module, and finally provide the resource owner with resource acquisition information.

FIG. 4 shows a flowchart of an embodiment of a method for cross-platform authorization to access resources running between multiple parties (user device 41, proxy access module 42, authorization module 43, and resource module 44).

The process starts by sending a resource access request from the user device 41 to the proxy access module 42 (step S401). The resource access request mainly records the identification code of the resource owner entered by the user through the web page or application and the desired access Resource items.

After that, the proxy access module 42 adds the identification code of the proxy access module 42 and the key exchanged with the authorization module 43 in advance to sign according to the resource access request, and generates an authorization request (step S403), and It is sent to the authorization module 43, and the authorization module obtains the identification code of the resource owner from it (step S405). Therefore, the communication method that was originally registered and logged in, such as email, phone number, or push information, can be queried to This can perform identity verification with the resource owner, including sending an identity confirmation request to the user device 41 (or forwarding to a specific device) (step S407), and the user device 41 (or a specific device) receiving identity confirmation data (step S409) ) To verify the identity of the resource owner (step S411). If the identity verification fails, the authorization module 43 will send a verification failure message to the requesting user device 41 (step S413).

After the authorization module 43 and the resource owner have completed identity verification, it generates an access code corresponding to the requested resource item, and performs a code calculation on the resource item and the access code to generate a bet value (step S411), so The pledge code value, resource item (associated resource owner) and access code form verification data.

After that, the verification data (access code, resource item, bet value) is sent to the resource module 44 (step S415), and at the same time, the verification data is also sent to the proxy access module 42 (step S417).

After receiving the authentication data, the proxy access module 42 can send the resource access request initially received to the resource module 44, so that the resource module 44 obtains the information of the resource owner, or the resource module 44 can still be authorized by the module The information of the resource owner is obtained from the data (such as verification data) sent by 43 (step S419). At this time, the pledge value in the verification data sent by the authorization module 43 is verified (step S421). In the technology of betting verification, it is mainly because the two parties (authorization module 43 and resource module 44) agree to use a betting function. When one of the parties establishes the information and inputs the information and the related key into the betting function to obtain the betting value, then the information and the associated betting value are transmitted to the other party, and the other party can use the key of the agreement after receiving it It also calculates a bet value with the bet function of the information input itself, and compares it with the received bet value. If it matches, it means that the received information has not been tampered with.

Once the information is confirmed to be correct, the user device 41 (or a specific device) is provided with a resource acquisition information (step S423), so that the user can obtain a data item based on the information (step S425). This item can be a list of data files. The resource acquisition information provided by the resource module 44 includes a link to download a data file or a link to specific information.

To sum up, according to the description of the cross-platform authorization access to resources method and the system embodiment for implementing this method, it is possible to provide users with cross-platform access to resources. The resource modules such as traditional banks, government units, etc. can be used The personal privacy data of the user (resource owner) and sensitive data with security requirements. When the user needs to obtain this information for other purposes, or wants to take the data to another location, the method can allow a third party to Obtaining authorization to obtain user data under safe and secure conditions, without being restricted to the platform holding its own data. Such services are, for example, open banking third-party services. The method can provide third-party access to financial information, such as personal account details, balance, transaction history, etc.; for example, if a third-party system requires identity verification, you can Through this method, third-party services are authorized to obtain personally identifiable information. In this way, a third party can use the method and authorized access system to achieve cross-platform access to personal sensitive data and achieve data portability.

The content disclosed above is only the preferred and feasible embodiments of the present invention, and does not limit the scope of the patent application of the present invention. Therefore, all equivalent technical changes made using the description and schematic content of the present invention are included in the application of the present invention. Within the scope of the patent.

101: User device 10: Proxy server 12: License server 120: User database 14: Resource server 140: Resource Database 41: User device 42: Proxy access module 43: Authorized Module 44: Resource Module Steps S201～S213: Cross-platform authorization access to resources method process Steps S301～S311: Identity verification process in the method of cross-platform authorization access to resources Steps S401～S425: Cross-platform authorization access to resources method process

Figure 1 shows an embodiment diagram of the system architecture of an authorized access system running a cross-platform authorized access resource method;

Figure 2 shows a flowchart of an embodiment of running a cross-platform authorization access to resources method;

Figure 3 shows a flowchart of an embodiment of performing identity verification in a method for authorizing access to resources across platforms; and

Figure 4 shows a flow chart of an embodiment of a method for cross-platform authorization to access resources running on multiple parties.

101: User device

10: Proxy server

12: License server

120: User database

14: Resource server

140: Resource Database

Claims (14)

A method for cross-platform authorization to access resources, including: A proxy access module is proposed. The proxy access module receives a resource access request from a resource owner, which includes the request for a resource item and an identification code of the resource owner; The proxy access module generates an authorization request according to the resource access request, and sends it to an authorization module; The authorization module obtains the identification code of the resource owner according to the authorization request, and after completing identity verification with the resource owner, generates an access code corresponding to the requested resource item, and combines the resource item with the resource item The access code forms a verification data; The authorization module transmits the verification data to the proxy access module and a resource module; and After the resource module checks that the verification data received from the authorization module is correct, provide the resource owner with resource acquisition information according to the resource access request. The method for authorizing access to resources across platforms according to claim 1, wherein the step of forming the verification data includes performing a bet calculation on the resource item and the access code to form a bet value, and the bet The code value, the resource item, and the access code form the verification data, and the resource module then verifies the bet value. The method for authorizing access to resources across platforms as described in claim 2, wherein the betting calculation is calculating a message verification code, hash value, encryption or digital signature. The cross-platform authorization resource access method according to claim 3, wherein when the proxy access module receives the resource access request, the proxy access module uses a proxy identification code and a key to perform the The authorization request is generated after the digital signature, and the authorization request is encrypted and sent to the authorization module. The method for cross-platform authorization access to resources according to claim 4, wherein the authorization module receives the encrypted authorization request, verifies the authorization request according to the digital signature, and then obtains information about the resource access request The identification code of the resource owner is compared with a user database to obtain a communication method of the resource owner, so as to complete identity verification with the resource owner according to the communication method. The cross-platform authorization method for accessing resources according to claim 5, wherein the authorization module sends an identity confirmation request to the resource owner through the communication method, in order to request the resource owner to use a website, an application or an Information is a request for identity verification. The agreed verification data includes a password, a device information, a biometric feature, a one-time password generated by a user device, or generated by the authorization module and sent to the resource via a text message or push broadcast One-time password generated by the owner's user device. For example, the cross-platform authorization access resource method described in any one of request items 1 to 6, wherein the resource item is a list of data files, and the resource acquisition information provided by the resource module includes downloading data files or a list of information link. An authorized access system, including: A resource module, which provides services for one or more resource owners or authorized others to access various resource items through the network; An authorization module that provides user authentication and authorization services for accessing various resource items in the resource module through the network; A proxy access module, which provides proxy services for the one or more resource owners themselves or authorized others to access various resource items in the resource module through the network; The authorized access system executes a cross-platform authorized access resource method, including: The proxy access module receives a resource access request from one of the resource owners, which includes the requested resource item and an identification code of the resource owner; The proxy access module generates an authorization request according to the resource access request; The proxy access module transmits the authorization request to the authorization module; The authorization module obtains the identification code of the resource owner according to the authorization request, and after completing identity verification with the resource owner, generates an access code corresponding to the requested resource item, and combines the resource item with the resource item The access code forms a verification data; The authorization module transmits the verification data to the proxy access module and the resource module; and After the resource module checks that the verification data received from the authorization module is correct, provide the resource owner with resource acquisition information according to the resource access request. The authorized access system according to claim 8, wherein the step of forming the verification data includes performing a betting calculation on the resource item and the access code to form a betting value, the betting value, The resource item and the access code form the verification data, and the resource module then verifies the bet value. The authorization access system according to claim 9, wherein the bet code calculation is calculated as a message verification code, hash value, encryption or digital signature. The authorization access system according to claim 10, wherein the proxy access module is a proxy server that provides the user requesting access to the resource item; the authorization module is a proxy server responsible for authorizing access to the resource Authorization server; and the resource module is a resource server that provides various resource items. The authorized access system according to claim 10, wherein the encrypted authorization request is received in the authorization module, the authorization request is verified according to the digital signature, and the resource related to the resource access request is obtained therefrom The identification code of the owner is compared with a user database to obtain a communication method of the resource owner, so as to complete identity verification with the resource owner according to the communication method. The authorization access system according to claim 12, wherein the authorization module sends an identity confirmation request to the resource owner through the communication method, in order to request the resource owner to identify through a website, an application or a message A request for verification. The agreed verification data includes a password, a device information, a biometric feature, a one-time password generated by a user device, or a message generated by the authorization module and sent to the resource owner via a text message or push broadcast The one-time password generated by the user device. For example, the authorized access system according to any one of request items 8 to 13, wherein the resource item is a data file list, and the resource acquisition information provided by the resource module includes a link to download the data file or information.

Images