CN114513370A - Universal identification data conversion method and device, storage medium and electronic equipment - Google Patents

Abstract

The embodiment of the disclosure discloses a universal identification data conversion method and device, a storage medium and an electronic device, wherein the method comprises the following steps: receiving a registration request sent by an original data end, sending a first private key request to an encryption database according to the registration request, and receiving a first private key and a first timestamp corresponding to the private key request; based on a first public key corresponding to the first private key, performing encryption and anti-counterfeiting packaging processing on the identification data in the original data end pair to obtain packaged data; sending a second private key and a second timestamp to the client according to a second private key request received from the client; determining whether the client has data parsing authority based on the second private key, the second timestamp, the first public key and the first timestamp; and in response to the client side having the data analysis permission, decrypting the encapsulated data through the second private key to obtain the identification data.

Description

Universal identification data conversion method and device, storage medium, electronic device

technical field

The present disclosure relates to a general identification data conversion method and device, a storage medium, and an electronic device.

Background technique

Currently, a user sends an identification resolution request to an identification resolution node (for example, a server) through an identification resolution client. After receiving the identification resolution request, the identification resolution node directly feeds back the resolution result to the client, and does not control the access of the identification resolution client. , there may be risks such as excessive access control permissions, which may easily lead to data leakage.

SUMMARY OF THE INVENTION

In order to solve the above-mentioned technical problems, the present disclosure is made. Embodiments of the present disclosure provide a general identification data conversion method and apparatus, storage medium, and electronic device.

According to an aspect of the embodiments of the present disclosure, a general identification data conversion method is provided, applied to a third-party server, including:

Receive a registration request sent by the original data terminal, send a first private key request to an encrypted database according to the registration request, and receive a first private key and a first timestamp corresponding to the private key request;

Based on the first public key corresponding to the first private key, encryption and anti-counterfeiting encapsulation processing are performed on the identification data in the original data end pair to obtain encapsulated data;

sending a second private key and a second timestamp to the client according to the second private key request received from the client;

determining, based on the second private key, the second timestamp, the first public key and the first timestamp, whether the client has data parsing authority;

In response to the client having the data parsing authority, decrypt the encapsulated data through the second private key to obtain the identification data.

Optionally, performing encryption and anti-counterfeiting encapsulation processing on the identification data in the original data terminal pair based on the first public key corresponding to the first private key to obtain encapsulated data, including:

determining the corresponding first public key based on the first private key;

sending the first public key to the original data terminal, and encrypting the identification data at the original data terminal by using the first public key to obtain encrypted data and encryption attributes corresponding to the encrypted data; wherein , the encryption attribute includes the correspondence between the first public key and the first private key;

Encapsulate the encrypted data, the encrypted attribute and the anti-counterfeiting code information corresponding to the encrypted data to obtain the encapsulated data.

Optionally, sending the first public key to the original data terminal, and encrypting the identification data at the original data terminal by using the first public key to obtain encrypted data and the encrypted data. Corresponding encryption properties, including:

sending the first public key to the original data terminal;

The identification data is encrypted by the first public key at the original data end to obtain encrypted data;

The corresponding relationship between the first public key and the first private key is encoded based on a preset encoding rule to obtain the encryption attribute.

Optionally, the sending the second private key and the second timestamp to the client according to the second private key request received from the client includes:

Receive the second private key request sent by the client;

Determine the second private key corresponding to the second private key request according to the second private key request and the pre-stored encryption attribute; wherein, the encryption attribute includes the correspondence between the private key and the public key;

The second timestamp is determined according to the time point corresponding to the determination of the second private key.

Optionally, the determining whether the client has data parsing authority based on the second private key, the second timestamp, the first public key and the first timestamp includes:

Based on the time difference value between the second time stamp and the first time stamp, determine the relationship between the time difference value and the key validity period, and determine whether the second private key is valid;

In response to the second private key being valid, it is determined whether the client has data parsing authority according to whether the encryption properties of the second private key and the first public key match.

Optionally, before sending the second private key and the second timestamp to the client according to the second private key request received from the client, the method further includes:

sending the encapsulated data to the encrypted database for storage;

The resolution request sent by the client is received by the identification resolution terminal, the identification service address is obtained based on the resolution request, and the encapsulated data is obtained from the encrypted database based on the identification service address.

Optionally, decrypting the encapsulated data by using the second private key to obtain the identification data includes:

Process the encapsulated data based on the data parsing authority to obtain encrypted data, encrypted attributes and anti-counterfeiting traceability information corresponding to the encrypted data;

Determine the data range corresponding to the second private key based on the encryption attribute; wherein, the encryption attribute further includes determining the data range accessible to different private keys corresponding to a public key;

Decrypt the encrypted data based on the private key to obtain the identification data corresponding to the data range.

According to another aspect of the embodiments of the present disclosure, a general identification data conversion device is provided, which is applied to a third-party server, including:

a private key request module, configured to receive a registration request sent by the original data terminal, send a first private key request to an encrypted database according to the registration request, and receive a first private key and a first timestamp corresponding to the private key request;

a data encapsulation module, configured to perform encryption and anti-counterfeiting encapsulation processing on the identification data in the original data terminal pair based on the first public key corresponding to the first private key to obtain encapsulated data;

a private key sending module, configured to send the second private key and the second timestamp to the client according to the second private key request received from the client;

an authority determination module, configured to determine whether the client has data parsing authority based on the second private key, the second timestamp, the first public key and the first timestamp;

A data conversion module, configured to decrypt the encapsulated data through the second private key in response to the client having the data parsing authority to obtain the identification data.

Optionally, the data encapsulation module includes:

a public key determining unit, configured to determine the corresponding first public key based on the first private key;

a data encryption unit, configured to send the first public key to the original data end, and encrypt the identification data at the original data end by using the first public key to obtain encrypted data and the encrypted data Corresponding encryption attributes; wherein, the encryption attributes include the correspondence between the first public key and the first private key;

A data encapsulation unit, configured to encapsulate the encrypted data, the encrypted attribute and the anti-counterfeiting coding information corresponding to the encrypted data to obtain the encapsulated data.

Optionally, the data encryption unit is specifically configured to send the first public key to the original data terminal; encrypt the identification data at the original data terminal by using the first public key to obtain Encrypting data; encoding the correspondence between the first public key and the first private key based on a preset encoding rule to obtain the encryption attribute.

Optionally, the private key sending module is specifically configured to receive the second private key request sent by the client; and determine the first private key request corresponding to the second private key request according to the second private key request and the pre-stored encryption attribute. Two private keys; wherein the encryption attribute includes the correspondence between the private key and the public key; the second timestamp is determined according to the time point corresponding to the determination of the second private key.

Optionally, the authority determination module is specifically configured to determine the relationship between the time difference and the key validity period based on the time difference between the second time stamp and the first time stamp, and determine Whether the second private key is valid; in response to the second private key being valid, determine whether the client has data parsing authority according to whether the encryption attributes of the second private key and the first public key match. .

Optionally, the device further includes:

a storage module, configured to send the encapsulated data to the encrypted database for storage;

A request parsing module, configured to receive a parsing request sent by the client through an identity parsing terminal, obtain an identity service address based on the parsing request, and obtain the encapsulated data from the encrypted database based on the identity service address.

Optionally, the data conversion module is specifically configured to process the encapsulated data based on the data parsing authority to obtain encrypted data, encrypted attributes and anti-counterfeiting traceability information corresponding to the encrypted data; determine the second data based on the encrypted attributes. The data range corresponding to the private key; wherein, the encryption attribute further includes determining the data range accessible to different private keys corresponding to a public key; decrypting the encrypted data based on the private key to obtain the data range corresponding to the data range the identification data.

According to another aspect of the embodiments of the present disclosure, a general identification data conversion system is provided, including:

A third-party server, configured to execute the general identification data conversion method described in any one of the above-mentioned embodiments;

The original data terminal is used to send a registration request to the third-party server, receive the first public key issued by the third-party server, encrypt the identification data and perform anti-counterfeiting encapsulation processing through the first public key, and obtain Encapsulating data, and sending the encapsulating data to an encrypted database;

an encrypted database, configured to issue a first private key to the third-party server according to the private key request sent by the third-party server, and receive the packaged data uploaded by the original data end;

An identification parsing end, configured to receive a parsing request sent by a client, obtain an identification service address based on the parsing request, and obtain the encapsulated data from the encrypted database based on the identification service address;

The client is used to send a second private key request to the third-party server, receive the second private key and the second timestamp returned by the third-party server, and send a parsing request to the identification parsing terminal, from The encrypted database receives the encapsulated data.

According to another aspect of the embodiments of the present disclosure, a computer-readable storage medium is provided, and the storage medium stores a computer program, and the computer program is used to execute the general identification data conversion method described in any of the foregoing embodiments. .

According to another aspect of the embodiments of the present disclosure, there is provided an electronic device, the electronic device comprising:

processor;

a memory for storing the processor-executable instructions;

The processor is configured to read the executable instructions from the memory, and execute the instructions to implement the general identification data conversion method described in any of the foregoing embodiments.

Based on a general identification data conversion method and device, storage medium, and electronic device provided by the above-mentioned embodiments of the present disclosure, a registration request sent by the original data terminal is received, a first private key request is sent to an encrypted database according to the registration request, and receiving a first private key and a first timestamp corresponding to the private key request; performing encryption and anti-counterfeiting encapsulation processing on the identification data in the original data pair based on the first public key corresponding to the first private key, Obtain the encapsulated data; send the second private key and the second timestamp to the client according to the second private key request received from the client; based on the second private key, the second timestamp, the first a public key and the first timestamp to determine whether the client has the data parsing authority; in response to the client having the data parsing authority, decrypt the encapsulated data through the second private key to obtain the In this embodiment, the request and distribution of the public and private keys of the data is realized in the third-party server, which overcomes the problems such as easy data leakage due to excessive access rights to the identification data. Different attributes are assigned to the data, and different keys are assigned to the identity resolution client according to the attributes, and the data owner decides which users can access the data, realizing fine-grained access control.

The technical solutions of the present disclosure will be further described in detail below through the accompanying drawings and embodiments.

Description of drawings

The above and other objects, features and advantages of the present disclosure will become more apparent from the more detailed description of the embodiments of the present disclosure in conjunction with the accompanying drawings. The accompanying drawings are used to provide a further understanding of the embodiments of the present disclosure, and constitute a part of the specification, and are used to explain the present disclosure together with the embodiments of the present disclosure, and do not limit the present disclosure. In the drawings, the same reference numbers generally refer to the same components or steps.

The present disclosure may be more clearly understood from the following detailed description with reference to the accompanying drawings, wherein:

1 is a schematic flowchart of a general identification data conversion method provided by an exemplary embodiment of the present disclosure;

FIG. 2 is a schematic flowchart of step 104 in the embodiment shown in FIG. 1 of the present disclosure;

FIG. 3 is a schematic flowchart of step 106 in the embodiment shown in FIG. 1 of the present disclosure;

4 is a schematic time sequence diagram of a step-by-step analysis of an identification resolution request in a general identification data conversion method provided by an exemplary embodiment of the present disclosure;

5 is a schematic structural diagram of a general identification data conversion device provided by an exemplary embodiment of the present disclosure;

6 is a schematic structural diagram of a general identification data conversion system provided by an exemplary embodiment of the present disclosure;

FIG. 7 is a structural diagram of an electronic device provided by an exemplary embodiment of the present disclosure.

Detailed ways

Hereinafter, exemplary embodiments according to the present disclosure will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only some of the embodiments of the present disclosure, not all of the embodiments of the present disclosure, and it should be understood that the present disclosure is not limited by the example embodiments described herein.

It should be noted that the relative arrangement of the components and steps, the numerical expressions and numerical values set forth in these embodiments do not limit the scope of the present disclosure unless specifically stated otherwise.

Those skilled in the art can understand that terms such as "first" and "second" in the embodiments of the present disclosure are only used to distinguish different steps, devices, or modules, etc., and neither represent any specific technical meaning, nor represent any difference between them. the necessary logical order of .

It should also be understood that, in the embodiments of the present disclosure, "a plurality" may refer to two or more, and "at least one" may refer to one, two or more.

It should also be understood that any component, data or structure mentioned in the embodiments of the present disclosure can generally be understood as one or more in the case of no explicit definition or contrary indications given in the context.

In addition, the term "and/or" in the present disclosure is only an association relationship to describe associated objects, indicating that there can be three kinds of relationships, for example, A and/or B, it can mean that A exists alone, and A and B exist at the same time , there are three cases of B alone. In addition, the character "/" in the present disclosure generally indicates that the related objects are an "or" relationship. The data referred to in this disclosure may include unstructured data such as text, images, and videos, or may be structured data.

It should also be understood that the description of the various embodiments in the present disclosure emphasizes the differences between the various embodiments, and the same or similar points can be referred to each other, and for the sake of brevity, they will not be repeated.

Meanwhile, it should be understood that, for the convenience of description, the dimensions of various parts shown in the accompanying drawings are not drawn in an actual proportional relationship.

The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way intended to limit the disclosure, its application or uses in any way.

Techniques, methods, and apparatus known to those of ordinary skill in the relevant art may not be discussed in detail, but where appropriate, such techniques, methods, and apparatus should be considered part of the specification.

It should be noted that like numerals and letters refer to like items in the following figures, so once an item is defined in one figure, it does not require further discussion in subsequent figures.

Embodiments of the present disclosure can be applied to electronic devices such as terminal devices, computer systems, servers, etc., which can operate with numerous other general-purpose or special-purpose computing system environments or configurations. Examples of well-known terminal equipment, computing systems, environments and/or configurations suitable for use with terminal equipment, computer systems, servers, etc. electronic equipment include, but are not limited to: personal computer systems, server computer systems, thin clients, thick clients computer, handheld or laptop devices, microprocessor-based systems, set-top boxes, programmable consumer electronics, network personal computers, minicomputer systems, mainframe computer systems, and distributed cloud computing technology environments including any of the foregoing, among others.

Electronic devices such as terminal devices, computer systems, servers, etc., may be described in the general context of computer system-executable instructions, such as program modules, being executed by the computer system. Generally, program modules may include routines, programs, object programs, components, logic, data structures, etc. that perform particular tasks or implement particular abstract data types. Computer systems/servers may be implemented in distributed cloud computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed cloud computing environment, program modules may be located on local or remote computing system storage media including storage devices.

The industrial Internet identification resolution system is the basic system of the Industrial Internet, an important part of the Industrial Internet, and an important facility for building a comprehensive interconnection of human-machine-objects. DNS). The industrial Internet identification analysis system is mainly composed of an identification distribution management system and an identification analysis system. The identification is the "identity card" of the machine and the item, which is unique and is managed by a hierarchical distribution method. The identification analysis system uses identification to locate and query information on machines and items, which is the premise and foundation for realizing the precise connection between the global supply chain system and the enterprise production system, product life cycle management and intelligent services. By building a complete identification system, it can provide strong support for industrial system interconnection and industrial data transmission and exchange, and truly realize the interconnection of industrial products from design, R&D, production, to sales and service and other industrial elements, and enhance collaboration. efficiency.

In my country, in order to achieve the overall goal of "unified management and interconnection", a top-level node in the country has been built. As a unified export for participating in the development of the global industrial Internet identification analysis system, it is connected with various industrial Internet identification analysis systems and achieves integration with international roots. connection of nodes. Internally, as a hub and bridge for coordinating secondary nodes in various industries, it guides the construction and ecological cultivation and development of the domestic industrial Internet identification analysis system from the perspectives of technical standards and infrastructure construction, and thus creates my country's industrial Internet identification analysis system as a whole. frame.

Exemplary method

FIG. 1 is a schematic flowchart of a general identification data conversion method provided by an exemplary embodiment of the present disclosure. This embodiment can be applied to electronic devices such as third-party servers, as shown in FIG. 1 , and includes the following steps:

Step 102: Receive a registration request sent by the original data terminal, send a first private key request to an encrypted database according to the registration request, and receive a first private key and a first timestamp corresponding to the private key request.

Optionally, the original data terminal is the data owner in this embodiment, for example, the data generation terminal in the identification resolution system, for example, the enterprise node of identification analysis, etc.; the original data terminal generates identification data, in order to ensure data security. , send a registration request to the third-party server; the third-party server requests the private key from the encrypted database according to the registration request, and generates the corresponding public key according to the private key and returns it to the original data terminal; the encrypted database usually belongs to the data generation terminal. The module in the identification resolution system; the encrypted database stores the corresponding relationship between the data and the client that has the right to obtain the data; in addition, when the first private key is obtained in this embodiment, the first private key will also be obtained. The time is recorded as the first time stamp, so as to facilitate the subsequent control of the authority time of the first private key.

Step 104 , based on the first public key corresponding to the first private key, perform encryption and anti-counterfeiting encapsulation processing on the identification data in the original data end pair to obtain encapsulated data.

In this embodiment, the third-party server implements the generation of the corresponding public key based on the private key. At this time, the corresponding relationship between the public key and the private key is used as the attribute information of the data encrypted by the public key; the public key is delivered to the original At the data end, the original data end encrypts the identification data and performs anti-counterfeiting encapsulation processing through the public key to obtain the encapsulated data; in this embodiment, the encapsulated data can be stored in the encrypted database, so as to facilitate subsequent identification analysis by the authorized client. Request to get.

Step 106: Send the second private key and the second timestamp to the client according to the second private key request received from the client.

In this embodiment, when the client requests identification data, it can simultaneously or successively send an identification data acquisition request and a private key request to the identification resolution system and the third-party server, and the third-party server sends the second private key to the client according to the request. At the same time, the second timestamp of the sending time is sent, and the valid time limit of the second private key is controlled, which further improves the security of the identification data.

Step 108, based on the second private key, the second timestamp, the first public key and the first timestamp, determine whether the client has the data parsing authority.

In this embodiment, whether there is a correspondence between the second private key and the first public key, and the time difference between the second timestamp and the first timestamp, determine whether the client corresponding to the second private key has data Parsing authority, only when there is a corresponding relationship and the time difference meets the preset time difference, the client has the data analysis authority, which further ensures the security of the identification data.

Step 110, in response to the client having the data parsing authority, decrypt the encapsulated data through the second private key to obtain identification data.

It may also include the case where the client does not have the data parsing authority, and at this time the client cannot decrypt the encapsulated data and cannot obtain the identification data.

A general identification data conversion method provided by the above embodiments of the present disclosure includes receiving a registration request sent by an original data terminal, sending a first private key request to an encrypted database according to the registration request, and receiving a first private key request corresponding to the private key request. a private key and a first timestamp; based on the first public key corresponding to the first private key, perform encryption and anti-counterfeiting encapsulation processing on the identification data in the original data end pair to obtain encapsulated data; send the second private key and the second timestamp to the client; based on the second private key, the second timestamp, the first public key and the first time to determine whether the client has the data parsing authority; in response to the client having the data parsing authority, decrypt the encapsulated data through the second private key to obtain the identification data; The third-party server implements the request and distribution of the data public key and private key, which overcomes the problem of easy data leakage due to excessive access rights to the identification data. In this embodiment, different attributes are assigned to the data, and Assign different keys to identity resolution clients according to attributes, and the data owner decides which users can access the data, enabling fine-grained access control.

As shown in FIG. 2, on the basis of the above-mentioned embodiment shown in FIG. 1, step 104 may include the following steps:

Step 1041: Determine the corresponding first public key based on the first private key.

Optionally, the corresponding relationship between each key pair (private key and public key) can be encoded through multiple encoding rules, and the corresponding first key pair can be determined for the first private key according to the corresponding relationship determined by any encoding rule. The public key is assigned to different key pairs with different version numbers, and the correspondence between the public key and the private key is stored in the third-party server.

Step 1042: Send the first public key to the original data end, and encrypt the identification data at the original data end by using the first public key to obtain the encrypted data and the encryption attributes corresponding to the encrypted data.

The encryption attribute includes the correspondence between the first public key and the first private key.

In this embodiment, when the encrypted data is obtained, the encryption attribute corresponding to the encrypted data is also recorded, so as to determine the private key corresponding to the encrypted data encrypted with the public key.

Step 1043: Encapsulate the encrypted data, the encrypted attributes, and the anti-counterfeiting code information corresponding to the encrypted data to obtain encapsulated data.

In this embodiment, before encapsulating the encrypted data, anti-counterfeiting coding information is also added to the encrypted data. Optionally, the corresponding anti-counterfeiting coding information can be determined for the encrypted data based on any anti-counterfeiting coding method in the prior art, for example, Encoding methods such as MD5 code, etc.; by encapsulating the anti-counterfeiting encoded information into the encapsulated data, the traceable technical effect of the encrypted data can be achieved, and the problem of tampering of the encrypted data during transmission can be solved; the security of the encrypted data can be improved. .

Optionally, on the basis of the foregoing embodiment, step 1042 may further include:

sending the first public key to the original data end;

The identification data is encrypted by the first public key at the original data end to obtain encrypted data;

The corresponding relationship between the first public key and the first private key is encoded based on a preset encoding rule to obtain an encryption attribute.

In this embodiment, the original data terminal encrypts the identification data based on the first public key. At this time, since the original data terminal only has the first public key, if only the encrypted encrypted data is sent to the encrypted database, the following will occur. Therefore, in this embodiment, the corresponding relationship between the first public key and the first private key is encoded to obtain the encryption attribute, and the private key corresponding to the encrypted data can be determined through the encryption attribute, which overcomes the problem of inability to decrypt, wherein , the encoding method may be any method in the prior art that can implement encoding of the corresponding relationship, and this embodiment does not limit the specific encoding method.

As shown in FIG. 3 , on the basis of the above-mentioned embodiment shown in FIG. 1 , step 106 may include the following steps:

Step 1061: Receive a second private key request sent by the client.

In this embodiment, the client sends an identification data analysis request to the identification resolution system, and the obtained identification data is packaged data, and the identification data included in the packaged data cannot be viewed.

Step 1062: Determine a second private key corresponding to the second private key request according to the second private key request and the pre-stored encryption attribute.

The encryption attribute includes the correspondence between the private key and the public key.

Optionally, the third-party server requests the corresponding encrypted attribute pre-stored in the client according to the second private key (after the encrypted attribute is generated in the encrypted database, the encrypted attribute will be delivered to the authorized client for storage) , and the corresponding second private key can be obtained from the third-party server based on the encryption attribute.

Step 1063: Determine the second timestamp according to the time point corresponding to the determination of the second private key.

In this embodiment, when the second private key is delivered to the client, the delivery time point is also recorded as the second timestamp, so as to clarify the time between the generation of the private key in the encrypted database and the request for the private key. Time difference, if the time difference exceeds the time difference threshold set in the encrypted database (which can be set according to specific application scenarios), the private key can be determined to be invalid according to the rules set in the encrypted database. If you need to obtain the private key for decrypted data, you need to request again. By setting the private key time limit, the security of the identification data is further improved.

Optionally, on the basis of the foregoing embodiment, step 108 may further include:

Based on the time difference between the second time stamp and the first time stamp, determine the relationship between the time difference and the validity period of the key, and determine whether the second private key is valid;

In response to the second private key being valid, it is determined whether the client has the data parsing authority according to whether the encryption properties of the second private key and the first public key match.

In this embodiment, the judgment of the time difference is performed first, and the second private key is valid only when the time difference is less than the validity period of the key. When the second private key is valid, the second private key and the first public key are determined according to the encryption attribute. Whether the keys match, for example, whether the second private key is the first private key, and if it is the first private key, there is a corresponding relationship with the first public key, and the client has the data parsing authority.

In some optional embodiments, before step 106, it may further include:

Send encapsulated data to an encrypted database for storage;

The resolution request sent by the client is received by the identification resolution terminal, the identification service address is obtained based on the resolution request, and the encapsulated data is obtained from the encrypted database based on the identification service address.

In this embodiment, the identification resolution end belongs to the external receiving request port in the identification resolution system, the client submits a resolution request to the identification resolution end, and the identification resolution system returns the identification service address to the client after step-by-step analysis, wherein the step-by-step resolution It is the process of transmitting parsing requests in multi-level nodes in the industrial Internet. Optionally, the sequence diagram of the process of parsing step by step is shown in Figure 4, including the following processes: (1) The client sends an identification parsing request to the recursive node; (2) The recursive node checks the local cache. When there is no cached result, the recursive node sends the parsing request to the top-level node of the country; (3) The top-level node of the country returns the resolution address of the secondary node to the recursive node; (4) The recursive node sends the secondary node to the secondary node (5) The secondary node returns the resolution address of the enterprise node to the recursive node; (6) The recursive node sends a resolution request to the enterprise node; (7) The enterprise node returns the address of the identification resolution service to the recursive node; (8) The recursive node will The identification service address is returned to the identification resolution client; (9) the identification resolution client sends a query request to the enterprise information system; (10) the enterprise information system returns the identification object information to the identification resolution client.

In some optional embodiments, on the basis of any of the foregoing embodiments, step 110 may include:

Process the encapsulated data based on the data parsing authority, and obtain encrypted data, encrypted attributes and anti-counterfeiting traceability information corresponding to the encrypted data;

Determine the data range corresponding to the second private key based on the encryption attribute;

Wherein, the encryption attribute also includes determining the range of data accessible by different private keys corresponding to a public key;

Decrypt the encrypted data based on the private key to obtain identification data corresponding to the data range.

Optionally, when the client has the authority, it first decapsulates the encapsulated data to obtain the encrypted data, encrypted attributes and anti-counterfeiting traceability information contained therein. The encrypted attributes in this embodiment may also be refined attribute information, for example, With attribute condition 1, you can access the first half of the data, with attribute condition 2, you can access some fine-grained rules such as the second half of the data, etc., set different attribute conditions for different data ranges through fine-grained rules, and divide the identification data into multiple different The attribute part realizes the personalized management of data and improves the security and flexibility of data.

This embodiment builds an access control system based on CP-ABE, deploys the access policy in the encrypted data, makes the encrypted data in the data collection library have different attributes, and assigns different keys to the identification parsing client according to the attributes. The encrypted data can be decrypted only when the attribute set of the identity parsing client satisfies the access policy, so that the data owner can decide which users can access the data and implement fine-grained access control. Effectively avoid the risk of data leakage caused by excessive access rights of the parsing client, and improve the overall security protection capability of the identity parsing system.

Any of the general identification data conversion methods provided by the embodiments of the present disclosure may be executed by any appropriate device with data processing capabilities, including but not limited to: terminal devices and servers. Alternatively, any of the general identification data conversion methods provided in the embodiments of the present disclosure may be executed by a processor. For example, the processor executes any of the general identification data conversion methods mentioned in the embodiments of the present disclosure by invoking corresponding instructions stored in the memory. method. No further description will be given below.

Exemplary device

FIG. 5 is a schematic structural diagram of a general identification data conversion apparatus provided by an exemplary embodiment of the present disclosure. As shown in FIG. 5 , the device provided in this embodiment is applied to a third-party server, including:

The private key request module 51 is configured to receive the registration request sent by the original data terminal, send the first private key request to the encrypted database according to the registration request, and receive the first private key and the first timestamp corresponding to the private key request.

The data encapsulation module 52 is configured to perform encryption and anti-counterfeiting encapsulation processing on the identification data in the original data terminal pair based on the first public key corresponding to the first private key to obtain encapsulated data.

The private key sending module 53 is configured to send the second private key and the second timestamp to the client according to the second private key request received from the client.

The authority determination module 54 is configured to determine whether the client has the data parsing authority based on the second private key, the second timestamp, the first public key and the first timestamp.

The data conversion module 55 is configured to decrypt the encapsulated data through the second private key in response to the client having the data parsing authority to obtain identification data.

A general identification data conversion device provided by the above embodiments of the present disclosure receives a registration request sent by an original data terminal, sends a first private key request to an encrypted database according to the registration request, and receives a first private key request corresponding to the private key request. a private key and a first timestamp; based on the first public key corresponding to the first private key, perform encryption and anti-counterfeiting encapsulation processing on the identification data in the original data end pair to obtain encapsulated data; send the second private key and the second timestamp to the client; based on the second private key, the second timestamp, the first public key and the first time to determine whether the client has the data parsing authority; in response to the client having the data parsing authority, the encapsulated data is decrypted by the second private key to obtain the identification data; in this embodiment, the The third-party server implements the request and distribution of the data public key and private key, which overcomes the problem of easy data leakage due to excessive access rights to the identification data. In this embodiment, different attributes are allocated to the data, and Assign different keys to identity resolution clients according to attributes, and the data owner decides which users can access the data, enabling fine-grained access control.

In some optional embodiments, the data encapsulation module 52 includes:

a public key determination unit, configured to determine a corresponding first public key based on the first private key;

A data encryption unit, configured to send the first public key to the original data terminal, and encrypt the identification data at the original data terminal by using the first public key to obtain the encrypted data and the encryption attributes corresponding to the encrypted data; wherein, the encryption attributes include the first the correspondence between the public key and the first private key;

The data encapsulation unit is used for encapsulating the encrypted data, the encrypted attributes and the anti-counterfeiting coding information corresponding to the encrypted data to obtain encapsulated data.

Optionally, the data encryption unit is specifically configured to send the first public key to the original data end; encrypt the identification data at the original data end by using the first public key to obtain encrypted data; The corresponding relationship between the key and the first private key is encoded to obtain the encryption attribute.

Optionally, the private key sending module 53 is specifically configured to receive the second private key request sent by the client; according to the second private key request and the pre-stored encryption attribute, determine the second private key corresponding to the second private key request; wherein , the encryption attribute includes the correspondence between the private key and the public key; the second timestamp is determined according to the time point corresponding to the determination of the second private key.

Optionally, the authority determination module 54 is specifically configured to determine the relationship between the time difference and the key validity period based on the time difference between the second time stamp and the first time stamp, and determine whether the second private key is valid; In response to the second private key being valid, it is determined whether the client has the data parsing authority according to whether the encryption properties of the second private key and the first public key match.

In some optional embodiments, the apparatus provided in this embodiment further includes:

The storage module is used to send the encapsulated data to the encrypted database for storage;

The request parsing module is used for receiving the parsing request sent by the client through the identity parsing terminal, obtaining the identity service address based on the parsing request, and obtaining the encapsulated data from the encrypted database based on the identity service address.

In some optional embodiments, the data conversion module 55 is specifically configured to process the encapsulated data based on the data parsing authority to obtain encrypted data, encrypted attributes and anti-counterfeiting traceability information corresponding to the encrypted data; determine the second private key based on the encrypted attributes The corresponding data range; wherein, the encryption attribute further includes determining the data range accessible to different private keys corresponding to a public key; decrypting the encrypted data based on the private key to obtain identification data corresponding to the data range.

FIG. 6 is a schematic structural diagram of a general identification data conversion system provided by an exemplary embodiment of the present disclosure. As shown in Figure 6, the system provided by this embodiment includes:

The third-party server 61 is configured to execute the general identification data conversion method provided by any of the foregoing embodiments.

The original data terminal 62 is used for sending a registration request to the third-party server, receiving the first public key issued by the third-party server, encrypting the identification data and anti-counterfeiting encapsulation through the first public key, obtaining encapsulated data, and encapsulating the encapsulated data. Data is sent to an encrypted database.

The encrypted database 63 is configured to issue the first private key to the third-party server according to the private key request sent by the third-party server, and receive the packaged data uploaded by the original data end.

The identification resolution terminal 64 is configured to receive the resolution request sent by the client, obtain the identification service address based on the resolution request, and obtain the encapsulated data from the encrypted database based on the identification service address.

The client 65 is configured to send a second private key request to the third-party server, receive the second private key and the second timestamp returned by the third-party server, send a parsing request to the identification parsing client, and receive the encapsulated data from the encrypted database .

Among them, the original data terminal 62, the encrypted database 63 and the identification analysis client 64 constitute an identification analysis system, and the client 65 is the user terminal that initiates the identification analysis request, which can be any terminal device, such as a mobile phone, a computer, etc.; the identification analysis system is responsible for According to the system device for querying the network location or related information of the target object according to the identification code, the unique positioning and information query of the machines and items are carried out;

The third-party server 61 is responsible for the generation, distribution and management of keys, and is trusted by default;

The starting point of this application is to expand the application of industrial Internet identification, to give full play to the value of identification in the field of industrial Internet, and to solve the risks of excessive access rights of identification analysis clients, which may easily lead to data being shared and used indiscriminately, by constructing an access control system based on CP-ABE. , deploy the access policy in the encrypted data, make the encrypted data in the data collection library have different attributes, and assign different keys to the identification parsing client according to the attributes, only when the attribute set of the identification parsing client satisfies the access policy Decrypt encrypted data so the data owner can decide which users can access the data, enabling fine-grained access control. In this way, the risk of data leakage caused by excessive access rights of the parsing client is avoided, the overall security protection capability of the identification parsing system is improved, and the healthy, stable and safe development of the identification system is facilitated.

Exemplary Electronics

Hereinafter, an electronic device according to an embodiment of the present disclosure will be described with reference to FIG. 7 . The electronic device can be either or both of the first device 100 and the second device 200, or a stand-alone device independent of them that can communicate with the first device and the second device to receive data from them The acquired input signal.

7 illustrates a block diagram of an electronic device according to an embodiment of the present disclosure.

As shown in FIG. 7 , electronic device 70 includes one or more processors 71 and memory 72 .

Processor 71 may be a central processing unit (CPU) or other form of processing unit having data processing capabilities and/or instruction execution capabilities, and may control other components in electronic device 70 to perform desired functions.

Memory 72 may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and/or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and/or cache memory (cache). The non-volatile memory may include, for example, a read only memory (ROM), a hard disk, a flash memory, and the like. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 71 may execute the program instructions to implement the general identification data conversion method of the various embodiments of the present disclosure described above and / or other desired functionality. Various contents such as input signals, signal components, noise components, etc. may also be stored in the computer-readable storage medium.

In one example, the electronic device 70 may also include an input device 73 and an output device 74 interconnected by a bus system and/or other form of connection mechanism (not shown).

For example, when the electronic device is the first device 100 or the second device 200, the input device 73 may be the above-mentioned microphone or microphone array for capturing the input signal of the sound source. When the electronic device is a stand-alone device, the input device 73 may be a communication network connector for receiving the collected input signals from the first device 100 and the second device 200 .

In addition, the input device 73 may also include, for example, a keyboard, a mouse, and the like.

The output device 74 can output various information to the outside, including the determined distance information, direction information, and the like. The output devices 74 may include, for example, displays, speakers, printers, and communication networks and their connected remote output devices, among others.

Of course, for simplicity, only some of the components in the electronic device 70 related to the present disclosure are shown in FIG. 7 , and components such as buses, input/output interfaces, and the like are omitted. Besides, the electronic device 70 may also include any other suitable components according to the specific application.

Exemplary computer program product and computer readable storage medium

In addition to the methods and apparatus described above, embodiments of the present disclosure may also be computer program products comprising computer program instructions that, when executed by a processor, cause the processor to perform the "exemplary method" described above in this specification Sections describe steps in a general identification data conversion method according to various embodiments of the present disclosure.

The computer program product may write program code for performing operations of embodiments of the present disclosure in any combination of one or more programming languages, including object-oriented programming languages, such as Java, C++, etc. , also includes conventional procedural programming languages, such as "C" language or similar programming languages. The program code may execute entirely on the user computing device, partly on the user device, as a stand-alone software package, partly on the user computing device and partly on a remote computing device, or entirely on the remote computing device or server execute on.

In addition, embodiments of the present disclosure may also be computer-readable storage media having computer program instructions stored thereon that, when executed by a processor, cause the processor to perform the above-described "Example Method" section of this specification Steps in a general identification data conversion method according to various embodiments of the present disclosure described in .

The computer-readable storage medium may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may include, for example, but not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatuses or devices, or a combination of any of the above. More specific examples (non-exhaustive list) of readable storage media include: electrical connections with one or more wires, portable disks, hard disks, random access memory (RAM), read only memory (ROM), erasable programmable read only memory (EPROM or flash memory), optical fiber, portable compact disk read only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

The basic principles of the present disclosure have been described above with reference to specific embodiments. However, it should be pointed out that the advantages, advantages, effects, etc. mentioned in the present disclosure are only examples rather than limitations, and these advantages, advantages, effects, etc. should not be considered to be A must-have for each embodiment of the present disclosure. In addition, the specific details disclosed above are only for the purpose of example and easy understanding, but not for limitation, and the above details do not limit the present disclosure to be implemented by using the above specific details.

The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments may be referred to each other. As for the system embodiment, since it basically corresponds to the method embodiment, the description is relatively simple, and for related parts, please refer to the partial description of the method embodiment.

The block diagrams of devices, apparatuses, apparatuses, and systems referred to in this disclosure are merely illustrative examples and are not intended to require or imply that the connections, arrangements, or configurations must be in the manner shown in the block diagrams. As those skilled in the art will appreciate, these means, apparatuses, apparatuses, systems may be connected, arranged, configured in any manner. Words such as "including", "including", "having" and the like are open-ended words meaning "including but not limited to" and are used interchangeably therewith. As used herein, the words "or" and "and" refer to and are used interchangeably with the word "and/or" unless the context clearly dictates otherwise. As used herein, the word "such as" refers to and is used interchangeably with the phrase "such as but not limited to".

The methods and apparatus of the present disclosure may be implemented in many ways. For example, the methods and apparatus of the present disclosure may be implemented in software, hardware, firmware, or any combination of software, hardware, and firmware. The above-described order of steps for the method is for illustration only, and the steps of the method of the present disclosure are not limited to the order specifically described above unless specifically stated otherwise. Furthermore, in some embodiments, the present disclosure can also be implemented as programs recorded in a recording medium, the programs including machine-readable instructions for implementing methods according to the present disclosure. Thus, the present disclosure also covers a recording medium storing a program for executing the method according to the present disclosure.

It should also be noted that, in the apparatus, device and method of the present disclosure, each component or each step may be decomposed and/or recombined. These disaggregations and/or recombinations should be considered equivalents of the present disclosure.

The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use the present disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the generic principles defined herein may be applied to other aspects without departing from the scope of the present disclosure. Thus, the present disclosure is not intended to be limited to the aspects shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

The foregoing description has been presented for the purposes of illustration and description. Furthermore, this description is not intended to limit embodiments of the present disclosure to the forms disclosed herein. Although a number of example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, changes, additions and sub-combinations thereof.

Claims (11)

1. A universal identification data conversion method is applied to a third-party server and comprises the following steps:

receiving a registration request sent by an original data end, sending a first private key request to an encryption database according to the registration request, and receiving a first private key and a first timestamp corresponding to the private key request;

based on a first public key corresponding to the first private key, performing encryption and anti-counterfeiting packaging processing on the identification data in the original data end pair to obtain packaged data;

sending a second private key and a second timestamp to the client according to a second private key request received from the client;

determining whether the client has data parsing permission based on the second private key, the second timestamp, the first public key and the first timestamp;

and in response to the client side having the data analysis permission, decrypting the encapsulated data through the second private key to obtain the identification data.

2. The method according to claim 1, wherein the encrypting and anti-counterfeit packaging the identification data in the original data end pair based on the first public key corresponding to the first private key to obtain packaged data comprises:

determining the corresponding first public key based on the first private key;

sending the first public key to the original data end, and encrypting the identification data at the original data end through the first public key to obtain encrypted data and an encryption attribute corresponding to the encrypted data; wherein the encryption attribute comprises a correspondence between the first public key and the first private key;

and packaging the encrypted data, the encryption attribute and the anti-counterfeiting code information corresponding to the encrypted data to obtain the packaged data.

3. The method according to claim 2, wherein the sending the first public key to the original data end, and encrypting the identification data at the original data end through the first public key to obtain encrypted data and an encryption attribute corresponding to the encrypted data comprises:

sending the first public key to the original data terminal;

encrypting the identification data at the original data end through the first public key to obtain encrypted data;

and coding the corresponding relation between the first public key and the first private key based on a preset coding rule to obtain the encryption attribute.

4. The method according to any one of claims 1-3, wherein sending the second private key and the second timestamp to the client based on a second private key request received from the client comprises:

receiving a second private key request sent by the client;

determining a second private key corresponding to the second private key request according to the second private key request and pre-stored encryption attributes; wherein the encryption attribute comprises a corresponding relation between a private key and a public key;

and determining the second time stamp according to the determined time point corresponding to the second private key.

5. The method of any of claims 1-3, wherein determining whether the client has data parsing authority based on the second private key, the second timestamp, the first public key, and the first timestamp comprises:

determining a relationship between the time difference and a key validity period based on the time difference between the second timestamp and the first timestamp, and determining whether the second private key is valid;

and responding to the validity of the second private key, and determining whether the client has the data analysis permission according to whether the encryption attributes of the second private key and the first public key are matched.

6. The method according to any one of claims 1-3, wherein before sending the second private key and the second timestamp to the client according to the second private key request received from the client, further comprising:

sending the packaged data to the encryption database for storage;

and receiving an analysis request sent by the client through an identification analysis end, acquiring an identification service address based on the analysis request, and acquiring the packaging data from the encryption database based on the identification service address.

7. The method according to any one of claims 1-3, wherein said decrypting the encapsulated data with the second private key to obtain the identification data comprises:

processing the encapsulated data based on the data analysis authority to obtain encrypted data, and encryption attributes and anti-counterfeiting tracing information corresponding to the encrypted data;

determining a data range corresponding to the second private key based on the encryption attribute; wherein, the encryption attribute also comprises determining a data range which can be accessed by different private keys corresponding to a public key;

and decrypting the encrypted data based on the private key to obtain the identification data corresponding to the data range.

8. A universal identification data conversion device is applied to a third-party server and comprises:

the private key request module is used for receiving a registration request sent by an original data end, sending a first private key request to an encryption database according to the registration request, and receiving a first private key and a first timestamp corresponding to the private key request;

the data encapsulation module is used for carrying out encryption and anti-counterfeiting encapsulation processing on the identification data in the original data end pair based on a first public key corresponding to the first private key to obtain encapsulated data;

the private key sending module is used for sending a second private key and a second timestamp to the client according to a second private key request received from the client;

the authority determining module is used for determining whether the client has data analysis authority or not based on the second private key, the second timestamp, the first public key and the first timestamp;

and the data conversion module is used for responding to the fact that the client side has the data analysis permission, and decrypting the encapsulated data through the second private key to obtain the identification data.

9. A universal identification data conversion system, comprising:

a third party server for executing the universal identification data conversion method of any one of the above claims 1-7;

the original data end is used for sending a registration request to the third-party server end, receiving a first public key issued by the third-party server end, encrypting and anti-counterfeiting packaging identification data through the first public key to obtain packaged data, and sending the packaged data to an encryption database;

the encryption database is used for issuing a first private key to the third-party server according to a private key request sent by the third-party server and receiving the packaging data uploaded by the original data terminal;

the identification analysis end is used for receiving an analysis request sent by a client, obtaining an identification service address based on the analysis request and obtaining the packaging data from the encryption database based on the identification service address;

and the client is used for sending a second private key request to the third-party server, receiving a second private key and a second timestamp returned by the third-party server, sending an analysis request to the identifier analysis terminal, and receiving the packaged data from the encrypted database.

10. A computer-readable storage medium, characterized in that the storage medium stores a computer program for executing the general identification data conversion method of any one of claims 1 to 7.

11. An electronic device, characterized in that the electronic device comprises:

a processor;

a memory for storing the processor-executable instructions;

the processor is used for reading the executable instructions from the memory and executing the instructions to realize the general identification data conversion method of any one of the claims 1 to 7.

Images