TW201812673A - System and method for authorized query on proof of assets - Google Patents

Abstract

The present invention provides a system and method for authorized query on proof of assets. The method and system include a first proof of assets generating module, a first authorization certificate generating module, a first sending module, a first receiving module, a first authentication module, a first proof of assets operation module and a first proof of assets query module. In order to achieve the automation of data transmission, while effectively reducing the risk of data tampering.

Description

Method and system for querying asset certificate authorization

The invention relates to the field of information transmission, in particular to a method and system for querying asset certificate authorization.

In the prior art, asset owners usually need to go to various banks or related institutions to inquire the required information, and the inquired information will be provided by the asset owner to the data demander. In this way, not only the asset owner performs the offline data collection step It is complicated, and because the inquired data is not directly provided by the data provider to the data demander, there will be a risk that the data will be tampered, and the data demander will not be able to obtain the desired data.

In view of the above, it is necessary to provide a method and system for asset certificate authorization inquiry to realize the automation of data transmission and effectively reduce the risk of data tampering.

An asset certificate authorization inquiry system is applied to a data provider. The asset certificate authorization inquiry system communicates with asset owners and data demanders. The asset certificate authorization inquiry system includes a first asset certificate generation module for: After receiving the asset certification application request sent by the asset owner, and the identity of the asset owner is authenticated, the asset provider includes the data provider according to the assets managed by the asset owner at the data provider Digital certificate signed asset certificate, and using the identity of the asset owner to authorize the owner ’s public key to encrypt the asset certificate; the first asset certificate generating module is also used to encrypt the asset certificate Add query conditions; a first authorization certificate generation module is used to generate a first authorization certificate according to the asset certificate application request; a first sending module is used to encrypt the first authorization certificate and the encrypted query conditions Send the asset certificate to the asset certificate database of the data provider; the first sending module also uses Sending the first authorization certificate to the asset owner so that the asset owner provides the first authorization certificate to the data demander; a first receiving module for receiving the asset owner And / or authorization certificate and query conditions provided by the data demander; a first authentication module for authenticating the owner of the asset and / or the encrypted asset certificate after adding the query conditions and / Or whether the authorization certificate and query conditions provided by the data requester are valid; the first asset certificate operation module is used when the authorization certificate and query conditions provided by the asset owner and / or the data requester are valid, Calculate the asset certificate required by the asset owner and / or the data demander according to the authorization certificate provided by the asset owner and / or the data demander; a first asset certificate query module for Obtain the calculated data from the asset certificate database of the data provider or the associated asset certificate database that communicates with the asset certificate database of the data provider Asset certificate; the first sending module is further configured to send the acquired asset certificate to the asset owner and / or the data demander so that the asset owner and / or the data demander Decrypting the acquired asset certificate with the private key of the authorization proof owner.

An asset certificate authorization inquiry method, the method includes: a first asset certificate generating step, after receiving an asset certificate application request sent by the asset owner, and after the identity of the asset owner is authenticated, according to the asset ownership The asset managed by the developer on the data provider generates an asset certificate including the digital certificate signature of the data provider, and authorizes the certificate owner's public key to encrypt the asset certificate with the identity of the asset owner; The first asset certificate generation step adds query conditions to the encrypted asset certificate; the first authorization certificate generation step generates a first authorization certificate according to the asset certificate application request; the first sending step authorizes the first authorization The certificate and the encrypted asset certificate after adding the query conditions are sent to the asset certificate database of the data provider; the first sending step sends the first authorization certificate to the asset owner to make the asset The owner provides the first authorization certificate to the data demander; a first receiving step, Authorization certificate and query conditions provided by the asset owner and / or the data demander; a first authentication step of authenticating the asset owner according to the first authorization certificate and the encrypted asset certificate after adding the query condition And / or whether the authorization certificate and query conditions provided by the data requester are valid; the first asset certificate calculation step, when the authorization certificate and query conditions provided by the asset owner and / or the data requester are valid, according to The authorization certificate provided by the asset owner and / or the data demander calculates the asset certificate required by the asset owner and / or the data demander; the first asset certificate query step is based on the data Obtain the calculated asset certificate from the asset certificate database of the provider or the associated asset certificate database that communicates with the asset certificate database of the data provider; the first sending step sends the acquired asset certificate to The asset owner and / or the data demander causes the asset owner and / or the data demander to use the grant The owner of the private key proof of the acquired assets prove to decrypt.

Compared with the prior art, the asset certificate authorization query method and system provided by the present invention can provide a more convenient, more efficient, more authentic, and more automated data transmission method to make data transmission more intelligent.

Refer to FIG. 1, which is a schematic diagram of an application environment of a preferred embodiment of an asset certificate authorization query method according to the present invention. In this embodiment, the asset certificate authorization inquiry system 10 is applied to a data provider 11, and the data provider 11 communicates with the asset owner 2 and the data demander 3 respectively.

In this embodiment, the data provider 11 is used to manage the assets of the asset owner 2, and the present invention does not limit the identity of the data provider 11.

In this embodiment, the asset owner 2 is the party who owns the asset, and the asset owner 2 may also query the asset certificate.

In this embodiment, the data demander 3 is a party that needs to query asset certificates.

In this embodiment, the data provider 11 is configured to generate an asset certificate based on an asset managed by the asset owner 2 at the data provider 11 for the asset owner 2 and / or the data Demand side 3 makes an inquiry.

In this embodiment, the data provider 11 corresponds to an asset certification database 13, the asset owner 2 corresponds to an asset certification database 23, and the data demander 3 corresponds to an asset certification database 33. The asset certificate database 13 of the data provider 11, the asset certificate database 23 of the asset owner 2 and the asset certificate database 33 of the data demander 3 communicate with each other, and the asset certificate data of the data provider 11 The database 13, the asset certification database 23 of the asset owner 2 and the asset certification database 33 of the data demander 3 are a decentralized synchronization mechanism, and the asset certification database 13 of the data provider 11 is used for storage The first authorization certificate and the encrypted asset certificate after adding the query condition, and storing the first authorization certificate and the encrypted asset certificate after adding the query condition in the asset certificate database 23 of the asset owner 2 And the asset certificate database 33 of the data demander 3.

In this embodiment, the asset certificate authorization inquiry system 10 may be run in a computer device, which is a device capable of automatically performing numerical calculation and / or information processing according to an instruction set or stored in advance. These include, but are not limited to, microprocessors, application specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), and embedded devices. The computer device includes, but is not limited to, a single network server, a server group composed of multiple network servers, or a cloud composed of a large number of hosts or network servers based on Cloud Computing.

Refer to FIG. 2, which is a functional block diagram of a first preferred embodiment of the asset certificate authorization query system of the present invention. In this embodiment, the asset certificate authorization inquiry system 10 may be divided into one or more modules. For example, the asset certificate authorization inquiry system 10 is divided into a first asset certificate generation module 101, a first authorization certificate generation module 102, a first sending module 103, a first receiving module 104, and a first authentication module. 105. The first asset certificate calculation module 106 and the first asset certificate query module 107. The detailed functions of each module will be described in detail in FIG. 3 later.

Refer to FIG. 3, which is a flowchart of a first preferred embodiment of an inquiry method for asset certificate authorization according to the present invention. According to different requirements, the order of the steps in the flowchart can be changed, and some steps can be omitted or combined.

In step S10, the first asset certificate generation module 101 receives the asset certificate application request sent by the asset owner 2 and the identity of the asset owner 2 is authenticated, and then the The asset managed by the data provider 11 generates an asset certificate including the digital certificate signed by the data provider 11 and encrypts the asset certificate by using the public key of the asset owner 2 to authorize the owner of the certificate.

In this embodiment, the first asset certificate generating module 101 generates an asset certificate including the digital certificate signature of the data provider 11 according to the assets managed by the data owner 2 at the data provider 11. Previously, the first receiving module 104 received the asset certification application request sent by the asset owner 2.

In this embodiment, the asset certificate application request includes, but is not limited to, one or more of the following combinations:

The identity certificate of the asset owner 2, the name of the asset owner 2, the identity certificate of the data demander 3, the name of the data demander 3, the authorization scope conditions, and the like.

In this embodiment, the first asset certificate generating module 101 generates an asset certificate including the digital certificate signature of the data provider 11 according to the assets managed by the data owner 2 at the data provider 11. Before, the first receiving module 104 is further configured to receive authentication information that the identity of the asset owner 2 is authenticated and send the authentication center, and determine that the identity of the asset owner 2 is authenticated according to the authentication information.

In this embodiment, after determining that the identity of the asset owner 2 is authenticated, the authentication center generates an identity of the authorization certificate owner for the asset owner 2 and generates a Group public and private keys for subsequent encryption and decryption of the generated asset certificate.

In this embodiment, the asset owner 2 provides a public key of the authorization certificate owner and a private key of the authorization certificate owner to the data demander 3.

In this embodiment, the authentication center is a mechanism that provides authentication for the identity of the asset owner 2. The authentication center includes, but is not limited to, one or more of the following combinations:

A certification center of the data provider 11, a certification center in communication with the data provider 11, and the like.

In this embodiment, the type of the asset includes, but is not limited to, one or more of the following combinations:

Bank deposits, foreign currencies, stocks, bonds, funds, etc.

In this embodiment, the asset certificate includes, but is not limited to, one or more of the following combinations:

Transaction date, transaction details, transaction total, account balance, currency, etc.

In this embodiment, the generated asset certificate is signed with the digital certificate signature of the data provider 11 to prove that the generated asset certificate is generated by the data provider 11.

In step S11, the first asset certificate generating module 101 adds a query condition to the encrypted asset certificate.

In this embodiment, the query condition includes, but is not limited to, one or more of the following combinations:

Query password, identity certificate, query time, query content, etc.

In step S12, the first authorization certificate generation module 102 generates a first authorization certificate according to the asset certificate application request.

In this embodiment, the first authorization certificate generation module 102 determines an authorization range according to the asset certificate application request, and generates the first authorization certificate in a hash manner according to the authorization range.

It should be noted that the hash method is a one-way cryptosystem, that is, the encryption by the hash method is an irreversible mapping from plain text to cipher text, which only includes an encryption process and no decryption process. In this way, generating the first authorization certificate by using the hash method will be more secure and reliable, and effectively reduce the risk of being tampered with.

In this embodiment, the first authorization certificate includes, but is not limited to, one or more of the following combinations:

The identity certificate of the data owner 2, the name of the data owner 2, the identity certificate of the data provider 11, the name of the data provider 11, the identity certificate of the data requester 3, the Name of data acquirer 3, authorization scope conditions, etc.

In this embodiment, the authorization scope condition includes, but is not limited to, one or more of the following combinations:

Validity period, maximum number of inquiries, time point of inquiry subject, inquiry subject, etc.

In step S13, the first sending module 103 sends the first authorization certificate and the encrypted asset certificate after adding the query conditions to the asset certificate database 13 of the data provider 11.

In this embodiment, the storage mechanism of the asset certificate database 13 stores the first authorization certificate and the encrypted asset certificate after adding the query conditions in the asset certificate database 23 and the asset owner 2 In the asset certificate database 33 of the data demander 3, in this way, the asset owner 2 or the data demander 3 can query the asset certificate in any of the asset certificate databases that are in communication.

In step S14, the first sending module 103 sends the first authorization certificate to the asset owner 2 so that the asset owner 2 provides the first authorization certificate to the data demander 3.

In this embodiment, after the first sending module 103 sends the first authorization certificate to the asset owner 2, the asset owner 2 provides the first authorization certificate to the data The demander 3, so that both the asset owner 2 and the data demander 3 can use the first authorization certificate as a voucher to query the generated asset certificate.

In this embodiment, the manner in which the asset owner 2 provides the first authorization certificate to the data demander 3 is not limited. For example, the asset owner 2 may provide the first authorization certificate to the data demander 3 by using email, social software, electronic files, and the like.

In step S15, the first receiving module 104 receives the authorization certificate and query conditions provided by the asset owner 2 and / or the data demander 3.

Step S16, the first authentication module 105 authenticates the authorization certificate and query conditions provided by the asset owner 2 and / or the data demander 3 according to the first authorization certificate and the encrypted asset certificate after adding the query conditions. is it effective.

In this embodiment, the first authentication module 105 authenticates the asset owner 2 and / or the data demander 3 according to the first authorization certificate and the encrypted asset certificate after adding the query conditions. Whether the authorization certificate and the query conditions are valid include: the first authentication module 105 matches the authorization certificate provided by the asset owner 2 and / or the data demander 3 with the first authorization certificate, and The query conditions provided by the asset owner 2 and / or the data demander 3 are matched with the query conditions previously added to the generated asset certificate.

In this embodiment, the authentication result includes:

(1) When the authorization certificate provided by the asset owner 2 and / or the data demander 3 matches the first authorization certificate, and the asset owner 2 and / or the data requester 3 provide When both the search conditions and the search conditions added in advance to the generated asset certificate also match, the first authentication module 105 confirms the authorization certificate provided by the asset owner 2 and / or the data demander 3 and The query condition is valid.

(2) When the authorization certificate provided by the asset owner 2 and / or the data demander 3 matches the first authorization certificate, but provided by the asset owner 2 and / or the data requester 3 When the query conditions of and the query conditions previously added to the generated asset certificate do not match, the first authentication module 105 confirms the authorization certificate provided by the asset owner 2 and / or the data demander 3 and The query condition is invalid.

(3) When the authorization certificate provided by the asset owner 2 and / or the data demander 3 does not all match the first authorization certificate, but the asset owner 2 and / or the data requester 3 do not match When the provided search conditions match the search conditions previously added to the generated asset certificate, the first authentication module 105 confirms the authorization certificate provided by the asset owner 2 and / or the data demander 3 and The query condition is invalid.

(4) When the authorization certificate provided by the asset owner 2 and / or the data demander 3 does not match the first authorization certificate, and the asset owner 2 and / or the data requester 3 do not match When the provided search conditions do not match the search conditions previously added to the generated asset certificate, the first authentication module 105 confirms the authorization provided by the asset owner 2 and / or the data demander 3 The certification and inquiry conditions are invalid.

Step S17, when the authorization certificate and the query conditions provided by the asset owner 2 and / or the data demander 3 are valid, the first asset certification operation module 106 is based on the asset owner 2 and / or the data The authorization certificate provided by the demander 3 calculates the asset certificate required by the asset owner 2 and / or the data demander 3.

In this embodiment, the calculated asset certificate is stored in the asset certificate database 13 of the data provider 11 or the associated asset certificate database in communication with the asset certificate database 13 of the data provider 11 The encrypted asset certificate after adding the query condition.

In step S18, the first asset certification query module 107 obtains an operation from the asset certification database 13 of the data provider 11 or the associated asset certification database that communicates with the asset certification database 13 of the data provider 11. Proof of assets.

In this embodiment, the asset owner 2 and the data demander 3 may be members or non-members.

Specifically, when the asset owner 2 and the data demander 3 are members, the asset owner 2 and the data demander 3 may be in the asset certification database 13 of the data provider 11 or with The calculated asset certificate is obtained from any associated asset certificate database communicated with the asset certificate database 13 of the data provider 11. However, when the asset owner 2 and the data demander 3 are non-members, the asset owner 2 and the data demander 3 may pass through a node belonging to the member (such as the data provider 11 The first asset certificate query module 107) is connected to a corresponding asset certificate database to obtain a calculated asset certificate.

In this embodiment, the related asset certificate database includes, but is not limited to, one or more of the following: the asset certificate database 23 of the asset owner 2 and the asset certificate database 33 of the data demander 3 Wait.

Step S19, the first sending module 103 sends the acquired asset certificate to the asset owner 2 and / or the data demander 3 so that the asset owner 2 and / or the data demander 3 3 Decrypt the acquired asset certificate with the private key of the authorization certificate owner.

In this embodiment, after the first sending module 103 sends the acquired asset certificate to the asset owner 2 and / or the data demander 3, the asset owner 2 and / or The data requester 3 decrypts the acquired asset certificate with the private key of the authorized certificate owner, and verifies the acquired asset certificate with the digital certificate signature of the data provider 11, It is confirmed whether the acquired asset certificate is generated by the data provider 11.

In this embodiment, the implementation of the asset certificate authorization query system 10 further includes: implementing in a blockchain manner, the asset certificate authorization query system 10 generates a block on the blockchain, and the block The owner of is the asset owner 2, and the block address of the block is the first authorization certificate.

Refer to FIG. 4, which is a functional block diagram of a second preferred embodiment of the asset certificate authorization query system of the present invention. In this embodiment, the asset certificate authorization inquiry system 10 may be divided into one or more modules. For example, the asset certificate authorization inquiry system 10 is divided into a second receiving module 201, a second authentication module 202, a second asset certificate generating module 203, a second authorization certificate generating module 204, and a second sending module. 205. The second asset certificate calculation module 206 and the second asset certificate query module 207. The detailed functions of each module will be described in detail in FIG. 5 later.

Referring to FIG. 5, it is a flowchart of a second preferred embodiment of the asset certificate authorization query method of the present invention. According to different requirements, the order of the steps in the flowchart can be changed, and some steps can be omitted or combined.

In step S200, the second receiving module 201 receives the asset certificate application request and the second authorization certificate sent by the data requester 3.

In this embodiment, the second authorization certificate is generated by the asset owner 2, and the second authorization certificate includes a digital certificate signature of the asset owner 2 to prove that the second authorization certificate is issued by the The asset owner 2 is mentioned.

In this embodiment, the asset certificate application request includes, but is not limited to, one or more of the following combinations:

The identity certificate of the asset owner 2, the name of the asset owner 2, the identity certificate of the data demander 3, the name of the data demander 3, the authorization scope conditions, and the like.

In step S201, the second authentication module 202 authenticates whether the second authorization certificate is generated by the asset owner 2.

In this embodiment, the second authentication module 202 may prove whether the second authorization certificate is generated by the asset owner 2 through the digital certificate signature of the asset owner 2.

In step S202, when the second authorization certificate is generated by the asset owner 2, the second asset certificate generating module 203 generates the asset according to the asset owner 2 that is managed by the data provider 11. The asset certificate signed by the data provider 11 digital certificate, and the asset certificate is encrypted with the public key of the data demand party 3.

In this embodiment, different from the first preferred embodiment, the generated asset certificate is encrypted using the public key of the data requester 3, and the private key of the data requester 3 will also be used for decryption later. In this way, the data demander 3 can directly communicate with the data provider 11 and query the asset certificate without having to go through the asset owner 2, so that the query of the data demander 3 is more convenient.

In this embodiment, the type of the asset includes, but is not limited to, one or more of the following combinations:

Bank deposits, foreign currencies, stocks, bonds, funds, etc.

In this embodiment, the asset certificate includes, but is not limited to, one or more of the following combinations:

Transaction date, transaction details, transaction total, account balance, currency, etc.

In this embodiment, the generated asset certificate is signed with the digital certificate signature of the data provider 11 to prove that the generated asset certificate is generated by the data provider 11.

In step S203, the second asset certificate generating module 203 adds a query condition to the encrypted asset certificate.

In this embodiment, the query condition includes, but is not limited to, one or more of the following combinations:

Query password, identity certificate, query time, query content, etc.

In step S204, the second authorization certificate generation module 204 generates a third authorization certificate according to the asset certificate application request.

In this embodiment, the second authorization certificate generation module 204 determines an authorization range according to the asset certificate application request, and generates the first authorization certificate in a hash manner according to the authorization range.

In this embodiment, the third authorization certificate includes, but is not limited to, one or more of the following combinations:

The identity certificate of the data owner 2, the name of the data owner 2, the identity certificate of the data provider 11, the name of the data provider 11, the identity certificate of the data requester 3, the Name of data acquirer 3, authorization scope conditions, etc.

In this embodiment, the authorization scope condition includes, but is not limited to, one or more of the following combinations:

Validity period, maximum number of inquiries, time point of inquiry subject, inquiry subject, etc.

In step S205, the second sending module 205 sends the third authorization certificate and the encrypted asset certificate after adding the query conditions to the asset certificate database 13 of the data provider 11.

In this embodiment, the storage mechanism of the asset certificate database 13 stores the third authorization certificate and the encrypted asset certificate after adding the query conditions in the asset certificate database 23 and the asset owner 2 In the asset certificate database 33 of the data demander 3, in this way, the asset owner 2 or the data demander 3 can query the asset certificate in any of the asset certificate databases that are in communication.

In step S206, the second sending module 205 sends the third authorization certificate to the data requester 3.

In step S207, the second receiving module 201 receives the authorization certificate and query conditions provided by the data requester 3.

In step S208, the second authentication module 202 verifies whether the authorization certificate and the query condition provided by the data requester 3 are valid according to the third authorization certificate and the encrypted asset certificate after adding the query condition.

In this embodiment, the second authentication module 202 verifies whether the authorization certificate and the query conditions provided by the data requester 3 are valid according to the third authorization certificate and the encrypted asset certificate after adding the query conditions include: The second authentication module 202 matches the authorization certificate provided by the data requester 3 with the third authorization certificate, and matches the query conditions provided by the data requester 3 with the assets added in advance. Prove the query conditions to match.

In this embodiment, the authentication result includes:

(1) When the authorization certificate provided by the data requester 3 matches the third authorization certificate, and the query conditions provided by the data requester 3 and the query conditions added in advance to the generated asset certificate are also When matched, the second authentication module 202 confirms that the authorization certificate and query conditions provided by the data requester 3 are valid.

(2) When the authorization certificate provided by the data requester 3 and the third authorization certificate match, but the query conditions provided by the data requester 3 and the query conditions added in advance to the generated asset certificate are not all When matched, the second authentication module 202 confirms that the authorization certificate and query conditions provided by the data requester 3 are invalid.

(3) When the authorization certificate provided by the data requester 3 does not match the third authorization certificate, but the query conditions provided by the data requester 3 and the query conditions added in advance to the generated asset certificate are both When matched, the second authentication module 202 confirms that the authorization certificate and query conditions provided by the data requester 3 are invalid.

(4) When the authorization certificate provided by the data requester 3 does not match the third authorization certificate, and the query conditions provided by the data requester 3 and the query conditions added in advance to the generated asset certificate are also When they do not match, the second authentication module 202 confirms that the authorization certificate and query conditions provided by the data requester 3 are invalid.

Step S209, when the authorization certificate and query conditions provided by the data requester 3 are valid, the second asset certification operation module 206 calculates the data requester 3 required according to the authorization certificate provided by the data requester 3. Proof of assets.

In this embodiment, the calculated asset certificate is stored in the asset certificate database 13 of the data provider 11 or the associated asset certificate database in communication with the asset certificate database 13 of the data provider 11 The encrypted asset certificate after adding the query condition.

Step S210: The second asset certification query module 207 obtains an operation from the asset certification database 13 of the data provider 11 or an associated asset certification database that communicates with the asset certification database 13 of the data provider 11. Proof of assets.

In this embodiment, the data demander 3 may be a member or a non-member.

Specifically, when the data demander 3 is a member, the data demander 3 may communicate with the asset certification database 13 of the data provider 11 or communicate with the asset certification database 13 of the data provider 11 To obtain the calculated asset certificate from any of the associated asset certificate databases. However, when the data demander 3 is a non-member, the data demander 3 may be connected to the corresponding node through a node belonging to the member (such as the second asset certification query module 207 of the data provider 11). Obtain the calculated asset certificate from the asset certificate database.

In this embodiment, the related asset certificate database includes, but is not limited to, one or more of the following: the asset certificate database 23 of the asset owner 2 and the asset certificate database 33 of the data demander 3 Wait.

Step S211, the second sending module 205 sends the acquired asset certificate to the data demander 3 so that the data demander 3 uses the data demander 3's private key to pair the acquired assets Proof is decrypted.

In this embodiment, after the second sending module 205 sends the acquired asset certificate to the data requester 3, the data requester 3 pairs the data requester 3 with the private key of the data requester 3. The acquired asset certificate is decrypted, and the acquired asset certificate is verified with the digital certificate signature of the data provider 11 to confirm whether the acquired asset certificate is generated by the data provider 11 .

In this embodiment, the implementation of the asset certificate authorization query system 10 further includes: implementing in a blockchain manner, the asset certificate authorization query system 10 generates a block on the blockchain, and the block The owner of is the data demander 3, and the block address of the block is the third authorization certificate.

The above embodiments are only used to illustrate the technical solution of the present invention and are not limiting. Although the present invention has been described in detail with reference to the above preferred embodiments, those skilled in the art should understand that the technical solution of the present invention may be modified or equivalently replaced. All should not depart from the spirit and scope of the technical solution of the present invention.

In the several embodiments provided by the present invention, it should be understood that the disclosed systems, devices, and methods may be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the modules is only a logical function division, and there may be another division manner in actual implementation.

The modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical units, which may be located in one place, or may be distributed to multiple networks. On the unit. Some or all of the modules may be selected according to actual needs to achieve the objective of the solution of this embodiment.

In addition, each functional module in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist separately physically, or two or more units may be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of hardware plus software function modules.

The integrated unit implemented in the form of a software functional module may be stored in a computer-readable storage medium. The above software function module is stored in a storage medium, and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device) or a processor to execute the embodiments of the present invention. Part of the method is described.

Some computer program product requests in the scope of subsequent patent applications are all based on the computer program flow, which corresponds to the content of the computer program flow in the aforementioned flowchart. Therefore, these computer program product request items should be understood as the functional module structure of the aforementioned solution mainly realized by the computer program described in the description, and should not be understood as the physical device that implements the solution mainly by hardware.

It is obvious to a person skilled in the art that the present invention is not limited to the details of the above-mentioned exemplary embodiments, and the present invention can be implemented in other specific forms without departing from the spirit or basic features of the present invention. Therefore, regardless of the point of view, the embodiments should be regarded as exemplary and non-limiting. The scope of the present invention is defined by the scope of the attached patent application rather than the above description. The meaning of the equivalent scope of the patent scope and all changes within the scope are included in the present invention. Any associated figure mark in the scope of patent application should not be regarded as limiting the scope of patent application involved. In addition, it is clear that the word "comprising" does not exclude other units or steps, and that the singular does not exclude the plural. Multiple units or devices stated in the scope of the system application patent can also be implemented by one unit or device through software or hardware. Words such as "first", "second" (if present) are used to indicate names, and do not indicate any particular order.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention and are not limiting. Although the present invention is described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solution of the present invention Modifications or equivalent substitutions can be made without departing from the spirit and scope of the technical solution of the present invention.

11‧‧‧ Data Provider

13, 23, 33‧‧‧ Asset Certificate Database

2‧‧‧ Asset Owner

3‧‧‧ Data Requester

10‧‧‧ Asset Certificate Authorization Inquiry System

101‧‧‧First Asset Proof Generation Module

102‧‧‧First authorization certificate generation module

103‧‧‧First sending module

104‧‧‧First receiving module

105‧‧‧First certification module

106‧‧‧First Asset Proof Operation Module

107‧‧‧The first asset certification inquiry module

201‧‧‧Second receiving module

202‧‧‧Second Certification Module

203‧‧‧Second asset certificate generation module

204‧‧‧Second authorization certificate generation module

205‧‧‧Second sending module

206‧‧‧Second Asset Proof Operation Module

207‧‧‧Second Asset Certificate Query Module

FIG. 1 is a schematic diagram of an application environment of a preferred embodiment of an asset certificate authorization query method according to the present invention. FIG. 2 is a functional block diagram of the first preferred embodiment of the asset certificate authorization inquiry system of the present invention. FIG. 3 is a flowchart of a first preferred embodiment of a query method for asset certificate authorization according to the present invention. FIG. 4 is a functional block diagram of a second preferred embodiment of the asset certificate authorization query system of the present invention. FIG. 5 is a flowchart of a second preferred implementation method of the asset certificate authorization query method of the present invention.

no.

Claims (35)

An asset certificate authorization inquiry system is applied to a data provider. The asset certificate authorization inquiry system communicates with asset owners and data demanders. The asset certificate authorization inquiry system includes: a first asset certificate generation module, After receiving the asset certification application request sent by the asset owner, and the identity of the asset owner is authenticated, the asset is generated according to the assets managed by the asset owner at the data provider and includes the data. Provide the asset certificate signed by the digital certificate of the provider, and use the identity of the asset owner to authorize the public key of the certificate owner to encrypt the asset certificate; the first asset certificate generating module is also used to encrypt the encrypted Adding asset certificate to query conditions; a first authorization certificate generating module for generating a first authorization certificate according to the asset certificate application request; a first sending module for adding the first authorization certificate and adding the query conditions The encrypted asset certificate is sent to the asset certificate database of the data provider; the first sending A group, further configured to send the first authorization certificate to the asset owner so that the asset owner provides the first authorization certificate to the data demander; a first receiving module for receiving Authorization certificate and query conditions provided by the asset owner and / or the data demander; a first authentication module for authenticating the certificate according to the first authorization certificate and the encrypted asset certificate after adding the query conditions; Whether the authorization certificate and query conditions provided by the asset owner and / or the data demander are valid; the first asset certificate operation module is used for the authorization certificate provided by the asset owner and / or the data demander and When the query conditions are valid, calculate the asset certificate required by the asset owner and / or the data demander according to the authorization certificate provided by the asset owner and / or the data demander; A module for use in an asset certificate database of the data provider or an associated asset certificate database that communicates with the asset certificate database of the data provider Obtaining a calculated asset certificate; the first sending module is further configured to send the acquired asset certificate to the asset owner and / or the data demander so that the asset owner and / or The data demander uses the private key of the authorized certificate owner to decrypt the acquired asset certificate. The asset certification authorization inquiry system according to item 1 of the scope of patent application, wherein before generating an asset certificate including a digital certificate signature of the data provider based on the assets managed by the asset owner at the data provider The first receiving module is further configured to: receive authentication information that the identity of the asset owner passes the authentication and sends the authentication center, and determine that the identity of the asset owner passes the authentication according to the authentication information; the authentication center After determining that the identity of the asset owner is authenticated, generating an identity of the authorization certificate owner for the asset owner, and generating a set of public and private keys for the authorization certificate owner, the certification center includes A combination of one or more of the following: a certification center of the data provider, and a certification center in communication with the data provider. The asset certificate authorization query system according to item 1 of the scope of patent application, wherein the first authorization certificate generation module is specifically configured to: determine an authorization scope according to the asset certificate application request, and determine the authorization scope according to the authorization scope. Hope to generate the first authorization certificate. The asset certification authorization query system according to item 1 of the scope of patent application, wherein the first authentication module authenticates the owner of the asset and the encrypted asset certificate after adding the query condition. Whether the authorization certificate and query conditions provided by the data requester are valid include: matching the authorization certificate provided by the asset owner and / or the data requester with the first authorization certificate, and The query conditions provided by the asset owner and / or the data demander are matched with the query conditions previously added to the generated asset certificate; when the authorization certificate provided by the asset owner and / or the data demander matches When the first authorization certificate is matched, and the query conditions provided by the asset owner and / or the data demander also match the query conditions previously added to the generated asset certificate, the asset ownership is confirmed The authorisation certificate and inquiry conditions provided by the person and / or the data requester are valid; or when the asset owner and / or the asset owner The authorization certificate provided by the demander matches both the first authorization certificate, but the query conditions provided by the asset owner and / or the data demander do not all match the query conditions previously added to the generated asset certificate When the authorization certificate and query conditions provided by the asset owner and / or the data demander are confirmed to be invalid; or when the authorization certificate provided by the asset owner and / or the data demander and the first authorization are invalid The certificates do not all match, but when the query conditions provided by the asset owner and / or the data demander match the query conditions previously added to the generated asset certificate, the asset owner and / or The authorization certificate and query conditions provided by the data requester are invalid; or when the authorization certificate provided by the asset owner and / or the data requester does not match the first authorization certificate, and the asset owner and / Or when the query conditions provided by the data demander do not match the query conditions previously added to the generated asset certificate, confirm The authorization certificate and inquiry conditions provided by the owner of the asset and / or the data demander are considered invalid. The asset certification authorization inquiry system according to any one of the claims 1 to 4, wherein: the type of the asset includes one or more of the following combinations: bank deposits, foreign currencies, stocks, bonds, funds; said The asset certificate includes one or more of the following combinations: transaction date, transaction details, total transaction amount, account balance, and currency. The asset certificate authorization query system according to any one of the claims 1 to 4, wherein the first authorization certificate includes one or more of the following: the identity certificate of the owner of the data, the data The name of the owner, the identity certificate of the data provider, the name of the data provider, the identity certificate of the data demander, the name of the data demander, and the authorization scope condition; wherein the authorization scope condition It includes one or more of the following combinations: Validity period, maximum number of queries, time point of query subject, query subject. The asset certification authorization query system according to any one of claims 1 to 4, wherein the query conditions include one or more of the following combinations: query password, identity certificate, queryable time, and queryable content. The asset certification authorization inquiry system according to any one of claims 1 to 4, wherein the data provider corresponds to an asset certification database, the asset owner corresponds to an asset certification database, and the data The demand party corresponds to an asset certification database, the data provider's asset certification database, the asset owner's asset certification database, and the data demand party's asset certification database communicate with each other, and the data provider The asset certificate database of the asset owner, the asset certificate database of the asset owner, and the asset certificate database of the data demander are decentralized synchronization mechanisms, and the asset certificate database of the data provider is used to store the first An authorization certificate and an encrypted asset certificate after adding the query conditions, and synchronously storing the first authorization certificate and the encrypted asset certificate after adding the query conditions in the asset certificate database of the asset owner and the data requirements Party's asset certificate database. The asset certificate authorization query system according to any one of the claims 1 to 4, wherein the implementation of the asset certificate authorization query system further includes: implementing in a blockchain manner to generate a block in the area On the blockchain, the owner of the block is the owner of the asset, and the block address of the block is the first authorization certificate. An asset certificate authorization inquiry system is applied to a data provider. The asset certificate authorization inquiry system communicates with a data demander, and the data demand party communicates with an asset owner. The asset certificate authorization inquiry system includes: A second receiving module for receiving an asset certificate application request and a second authorization certificate sent by the data demander; a second authentication module for authenticating whether the second authorization certificate is generated by the owner of the asset; A second asset certificate generating module, configured to generate the data of the data provider according to the asset that the asset owner manages at the data provider when the second authorization certificate is generated by the asset owner Certificate-signed asset certificate and encrypting the asset certificate with the public key of the data demander; the second asset certificate generating module is further used to add query conditions to the encrypted asset certificate; second authorization A certificate generation module is configured to generate a third authorization certificate according to the asset certificate application request; a second sending module is used Sending the third authorization certificate and the encrypted asset certificate added to the query condition to the asset certificate database of the data provider; the second sending module is further configured to send the third authorization certificate to The data demander; the second receiving module is further configured to receive the authorization certificate and query conditions provided by the data demander; the second authentication module is further configured to receive the third authorization certificate and The encrypted asset certificate after adding the query conditions verifies whether the authorization certificate and query conditions provided by the data requester are valid; the second asset certificate operation module is used when the authorization certificate and query conditions provided by the data requester are valid At the time, according to the authorization certificate provided by the data requester, calculate the asset certificate required by the data requester; a second asset certificate query module is used to obtain the asset certificate database from the data provider or with the Obtaining the calculated asset certificate from the associated asset certificate database communicated with the asset certificate database of the data provider; the second sending module is further configured to: Evidence of assets acquired data is sent to the demand side so that the information on the demand side to the demand side of private information for the acquired assets prove to decrypt. The asset certificate authorization query system according to item 10 of the scope of patent application, wherein the second authorization certificate generation module is specifically configured to: determine the authorization scope according to the asset certificate application request, and determine the authorization scope according to the authorization scope. Hope to generate the third authorization certificate. The asset certification authorization query system according to item 10 of the scope of patent application, wherein the second authentication module authenticates the data requester to provide according to the third authorization certificate and the encrypted asset certificate after adding the query conditions. Whether the authorization certificate and the query conditions of the certificate are valid include: matching the authorization certificate provided by the data demander with the third authorization certificate, and matching the query conditions provided by the data demander with the assets added in advance to the generated assets The query conditions of the certificate are matched; when the authorization certificate provided by the data demander matches the third authorization certificate, and the query conditions provided by the data demander are matched with the query conditions previously added to the generated asset certificate When both match, confirm that the authorization certificate and query conditions provided by the data requester are valid; or when the authorization certificate provided by the data requester matches the third authorization certificate, but the query provided by the data requester When the conditions do not match the search conditions previously added to the generated asset certificate, confirm the data The authorization certificate and query conditions provided by the requestor are invalid; or when the authorization certificate provided by the data requester does not match the third authorization certificate, but the query conditions provided by the data requester are pre-added in the generation When the query conditions of the asset certificate match, confirm that the authorization certificate and query conditions provided by the data demander are invalid; or when the authorization certificate provided by the data demander does not match the third authorization certificate, and the When the search conditions provided by the data requester do not match the search conditions previously added to the generated asset certificate, it is confirmed that the authorization certificate and search conditions provided by the data requester are invalid. The asset certificate authorization query system according to any one of the claims 10 to 12, wherein: the type of the asset includes one or more of the following combinations: bank deposits, foreign currencies, stocks, bonds, funds; said The asset certificate includes one or more of the following combinations: transaction date, transaction details, total transaction amount, account balance, and currency. The asset certificate authorization inquiry system according to any one of the claims 10 to 12, wherein the third authorization certificate includes one or more of the following: the identity certificate of the owner of the data, the data The name of the owner, the identity certificate of the data provider, the name of the data provider, the identity certificate of the data demander, the name of the data demander, and the authorization scope condition; wherein the authorization scope condition It includes one or more of the following combinations: Validity period, maximum number of queries, time point of query subject, query subject. The asset certification authorization query system according to any one of the claims 10 to 12, wherein the query conditions include one or more of the following combinations: query password, identity certificate, queryable time, and queryable content. The asset certification authorization inquiry system according to any one of claims 10 to 12, wherein the data provider corresponds to an asset certification database, and the asset owner corresponds to an asset certification database. The demand party corresponds to an asset certification database, the data provider's asset certification database, the asset owner's asset certification database, and the data demand party's asset certification database communicate with each other, and the data provider The asset certificate database of the asset owner, the asset certificate database of the asset owner, and the asset certificate database of the data demander are decentralized synchronization mechanisms, and the asset certificate database of the data provider is used to store the first Three authorization certificates and encrypted asset certificates after adding the query conditions, and synchronously storing the third authorization certificate and encrypted asset certificates after adding the query conditions in the asset certificate database of the asset owner and the data requirements Party's asset certificate database. The asset certificate authorization query system according to any one of the claims 10 to 12, wherein the implementation of the asset certificate authorization query system further includes: implementation in a blockchain manner to generate a block in the area On the blockchain, the owner of the block is the data demander, and the block address of the block is the third authorization certificate. An asset certificate authorization inquiry method, wherein the asset certificate authorization inquiry method includes: a first asset certificate generation step, upon receiving an asset certificate application request sent by the asset owner, and the identity of the asset owner is authenticated Then, generate an asset certificate containing the digital certificate signature of the data provider based on the assets managed by the asset owner at the data provider, and authorize the public key pair of the certificate owner as the asset owner The asset certificate is encrypted; the first asset certificate generating step adds query conditions to the encrypted asset certificate; the first authorization certificate generating step generates a first authorization certificate according to the asset certificate application request; the first sending step Sending the first authorization certificate and the encrypted asset certificate after adding the query condition to the asset certificate database of the data provider; the first sending step sends the first authorization certificate to the asset The owner so that the owner of the asset provides the first authorization certificate to the owner Material requesting party; a first receiving step, receiving authorization certificates and query conditions provided by the asset owner and / or the data requesting party; a first authentication step, according to the first authorization certificate and encryption after adding the query conditions The asset certificate, which verifies whether the authorization certificate and query conditions provided by the asset owner and / or the data demander are valid; the first asset certificate calculation step, when the asset owner and / or the data demander provide When the authorization certificate and query conditions are valid, calculate the asset certificate required by the asset owner and / or the data demander according to the authorization certificate provided by the asset owner and / or the data demander; An asset certificate query step, obtaining the calculated asset certificate from the asset certificate database of the data provider or the associated asset certificate database communicating with the asset certificate database of the data provider; the first sending Step: Send the acquired asset certificate to the asset owner and / or the data demander to make the asset owned Persons and / or demand-side data to prove possession of the private key of the authorized person of the acquired assets prove to be decrypted. The asset certificate authorization inquiry method according to item 18 of the scope of application for a patent, wherein before generating an asset certificate including a digital certificate signature of the data provider according to assets managed by the asset owner at the data provider The first receiving step further includes: receiving authentication information that the identity of the asset owner is authenticated and sending the authentication center, and determining that the identity of the asset owner is authenticated according to the authentication information; the authentication center is determining After the identity of the asset owner is authenticated, an identity of the authorization certificate owner is generated for the asset owner, and a set of public and private keys is generated for the authorization certificate owner. The certification center includes the following: Item or a combination of multiple items: a certification center of the data provider, a certification center in communication with the data provider. The asset certificate authorization query method according to item 18 of the scope of patent application, wherein the step of generating the first authorization certificate specifically includes: determining an authorization scope according to the asset certificate application request, and hashing the authorization scope according to the authorization scope. Generating the first authorization certificate. The asset certificate authorization query method according to item 18 of the scope of the patent application, wherein the first authentication step authenticates the owner of the asset and / or the encrypted asset certificate after adding the query conditions. Or whether the authorization certificate and query conditions provided by the data demander are valid include: matching the authorization certificate provided by the asset owner and / or the data demander with the first authorization certificate, and matching the asset The search conditions provided by the owner and / or the data demander match the search conditions previously added to the generated asset certificate; when the authorization certificate provided by the asset owner and / or the data requester matches with the When the first authorization certificate is matched, and the query conditions provided by the asset owner and / or the data demander also match the query conditions previously added to the generated asset certificate, the asset owner is confirmed. And / or the authorization certificate and inquiry conditions provided by the data requester are valid; or when the asset owner and / or the asset owner The authorization certificate provided by the demander matches both the first authorization certificate, but the query conditions provided by the asset owner and / or the data demander do not all match the query conditions previously added to the generated asset certificate When the authorization certificate and query conditions provided by the asset owner and / or the data demander are confirmed to be invalid; or when the authorization certificate provided by the asset owner and / or the data demander and the first authorization are invalid The certificates do not all match, but when the query conditions provided by the asset owner and / or the data demander match the query conditions previously added to the generated asset certificate, the asset owner and / or The authorization certificate and query conditions provided by the data requester are invalid; or when the authorization certificate provided by the asset owner and / or the data requester does not match the first authorization certificate, and the asset owner and And / or when the search conditions provided by the data demander do not match the search conditions previously added to the generated asset certificate, Invalid proof of authorization and query recognize the ownership of those assets and / or demand side of the information provided. The asset certificate authorization inquiry method according to any of claims 18 to 21, wherein: the type of the asset includes one or more of the following combinations: bank deposits, foreign currencies, stocks, bonds, and funds; said The asset certificate includes one or more of the following combinations: transaction date, transaction details, total transaction amount, account balance, and currency. The asset certificate authorization inquiry method according to any one of claims 18 to 21, wherein the first authorization certificate includes one or more of the following: the identity certificate of the owner of the data, the data The name of the owner, the identity certificate of the data provider, the name of the data provider, the identity certificate of the data demander, the name of the data demander, and the authorization scope condition; wherein the authorization scope condition It includes one or more of the following combinations: Validity period, maximum number of queries, time point of query subject, query subject. The asset certificate authorization query method according to any one of claims 18 to 21, wherein the query conditions include one or more of the following combinations: query password, identity certificate, queryable time, and queryable content. The asset certificate authorization inquiry method according to any one of claims 18 to 21, wherein the data provider corresponds to an asset certificate database, the asset owner corresponds to an asset certificate database, and the data The demand party corresponds to an asset certification database, the data provider's asset certification database, the asset owner's asset certification database, and the data demand party's asset certification database communicate with each other, and the data provider The asset certificate database of the asset owner, the asset certificate database of the asset owner, and the asset certificate database of the data demander are decentralized synchronization mechanisms, and the asset certificate database of the data provider is used to store the first An authorization certificate and an encrypted asset certificate after adding the query conditions, and synchronously storing the first authorization certificate and the encrypted asset certificate after adding the query conditions in the asset certificate database of the asset owner and the data requirements Party's asset certificate database. The asset certificate authorization query method according to any one of claims 18 to 21, wherein the implementation method of the asset certificate authorization query method further includes: implementing in a blockchain manner to generate a block in the area On the blockchain, the owner of the block is the owner of the asset, and the block address of the block is the first authorization certificate. An asset certificate authorization inquiry method, wherein the asset certificate authorization inquiry method includes: a second receiving step of receiving an asset certificate application request and a second authorization certificate sent by the data demander; a second authentication step of authenticating the first Whether the authorization certificate is generated by the owner of the asset; the step of generating a second asset certificate, when the second authorization certificate is generated by the owner of the asset, according to the management of the asset owner on the data provider The asset generation includes an asset certificate signed by the data provider's digital certificate, and the asset certificate is encrypted with the data requester's public key; the second asset certificate generation step adds an inquiry to the encrypted asset certificate Conditions; a second authorization certificate generation step, generating a third authorization certificate according to the asset certificate application request; a second sending step, sending the third authorization certificate and the encrypted asset certificate after adding a query condition to the data The asset certificate database of the provider; the second sending step, the third authorization certificate Send to the data requester; the second receiving step, receiving the authorization certificate and query conditions provided by the data requester; the second authentication step, according to the third authorization certificate and the query conditions added Encrypted asset certificate to verify whether the authorization certificate and query conditions provided by the data requester are valid; the second asset certificate operation step, when the authorization certificate and query conditions provided by the data requester are valid, according to the data requester The authorization certificate provided calculates the asset certificate required by the data demander; the second asset certificate query step communicates with the asset certificate database of the data provider or communicates with the asset certificate database of the data provider Obtain the calculated asset certificate from the associated asset certificate database; the second sending step sends the acquired asset certificate to the data requester so that the data requester uses the data requester's private key Decrypting the acquired asset certificate. The asset certificate authorization inquiry method according to item 27 of the scope of patent application, wherein the step of generating the second authorization certificate specifically includes: determining the authorization scope according to the asset certificate application request, and hashing the authorization scope according to the authorization scope. Generating the third authorization certificate. According to the asset certificate authorization query method according to item 27 of the scope of patent application, wherein the second authentication step authenticates the information provided by the data demander according to the third authorization certificate and the encrypted asset certificate after adding the query conditions. Whether the authorization certificate and the query conditions are valid include: matching the authorization certificate provided by the data requester with the third authorization certificate, and matching the query conditions provided by the data requester with the asset certificate added in advance When the authorization certificate provided by the data requester matches the third authorization certificate, and the query condition provided by the data requester matches the query condition previously added to the generated asset certificate. When both match, confirm that the authorization certificate and query conditions provided by the data requester are valid; or when the authorization certificate provided by the data requester matches the third authorization certificate, but the query conditions provided by the data requester When the search conditions not previously added to the generated asset certificate do not match, confirm the data The authorization certificate and query conditions provided by the requestor are invalid; or when the authorization certificate provided by the data requester does not match the third authorization certificate, but the query conditions provided by the data requester are pre-added in the generation When the query conditions of the asset certificate match, confirm that the authorization certificate and query conditions provided by the data demander are invalid; or when the authorization certificate provided by the data demander does not match the third authorization certificate, and the When the search conditions provided by the data requester do not match the search conditions previously added to the generated asset certificate, it is confirmed that the authorization certificate and search conditions provided by the data requester are invalid. The asset certificate authorization inquiry method according to any one of claims 27 to 29, wherein: the type of the asset includes one or more of the following combinations: bank deposits, foreign currencies, stocks, bonds, funds; The asset certificate includes one or more of the following combinations: transaction date, transaction details, total transaction amount, account balance, and currency. The asset certificate authorization inquiry method according to any one of claims 27 to 29, wherein the third authorization certificate includes one or more of the following: the identity certificate of the data owner, the data The name of the owner, the identity certificate of the data provider, the name of the data provider, the identity certificate of the data demander, the name of the data demander, and the authorization scope condition; wherein the authorization scope condition It includes one or more of the following combinations: Validity period, maximum number of queries, time point of query subject, query subject. The asset certificate authorization query method according to any one of claims 27 to 29, wherein the query conditions include one or more of the following combinations: query password, identity certificate, queryable time, and queryable content. The asset certificate authorization inquiry method according to any one of claims 27 to 29, wherein the data provider corresponds to an asset certificate database, the asset owner corresponds to an asset certificate database, and the data The demand party corresponds to an asset certification database, the data provider's asset certification database, the asset owner's asset certification database, and the data demand party's asset certification database communicate with each other, and the data provider The asset certificate database of the asset owner, the asset certificate database of the asset owner, and the asset certificate database of the data demander are decentralized synchronization mechanisms, and the asset certificate database of the data provider is used to store the first Three authorization certificates and encrypted asset certificates after adding the query conditions, and synchronously storing the third authorization certificate and encrypted asset certificates after adding the query conditions in the asset certificate database of the asset owner and the data requirements Party's asset certificate database. The asset certificate authorization query method according to any one of claims 27 to 29, wherein the implementation method of the asset certificate authorization query method further includes: implementing in a blockchain manner to generate a block in the area On the blockchain, the owner of the block is the data demander, and the block address of the block is the third authorization certificate. A computer program product, when the computer is loaded with the computer program and executed, it can complete the asset certificate authorization inquiry method described in any one of the patent application scopes 18 to 26, and / or the patent application scope any of the patent scopes 27 to 34 A method for inquiring about a certificate of asset authorization.