TW202121304A - System for obtaining additional data when identifying to execute operation and method thereof - Google Patents

Abstract

A system for obtaining additional data when identifying to execute an operation and a method thereof are provided. By transmitting an identification and user data sent by a mobile from a service host to a telecommunications server via an identity server, obtaining number data according to the identification by the identity server when the identification and user data are approved by the identity server, transmitting the number data from the telecommunications server to the identity server, filtering the number data in accordance with access permissions to generate additional data by the identity server, transmitting the additional data and the verification result from the identity server to the service host, and executing an operation based on the user data and the additional data when the verification result shows the identification and the user data are approved, the system and the method can achieve the effect of using additional data is obtained from mobile identity verification process to execute an account opening operation.

Description

System and method for obtaining additional data to perform corresponding operations during identity confirmation

A service execution system and method, in particular, refers to a system and method for obtaining additional data to perform corresponding operations during identity confirmation.

In recent years, due to the rapid development of communications and network-related industries, people’s demand for the electronic and mobile services of various services has been increasing. This demand is also reflected in the financial industry. For example, securities companies, banks, and investment advisory companies In addition to providing network services, mobile applications (APP) have also been provided. Users can use various mobile devices such as mobile phones or tablets to execute mobile applications. The mobile applications connect to the corresponding service server through the Internet. (Or called the application host), the user can operate the mobile device to perform mobile services such as securities transactions and transfers. In this way, the user can perform the required mobile service without leaving the location.

But to use the mobile services provided by the financial industry, you usually need to open an account in a bank first. In the past, opening an account at a bank usually required to be handled in person at the counter, but with the opening of government laws, bank account opening can also be completed online.

However, in the process of opening an online account, the user needs to be authenticated. In other words, users need to provide other bank accounts or use natural person certificates to verify their identity. For users who do not have other bank accounts or natural person certificates, the current identity verification method used in online account opening operations cannot be performed, resulting in Users cannot open an account online.

In summary, it can be seen that in the prior art, there has been a problem that some users cannot use the existing identity verification method to complete online account opening for a long time. Therefore, it is necessary to propose improved technical means to solve this problem.

In view of the problem in the prior art that some users cannot use the existing identity verification method to complete online account opening, the present invention discloses a system and method for obtaining additional data to perform corresponding operations during identity verification, in which:

The system for obtaining additional data to perform corresponding operations during identity confirmation disclosed in the present invention at least includes: a mobile device; a service server, which provides a connection to the mobile device to request the mobile device to confirm the identity and receive the service generated by the mobile device Commands, where the service command includes identification data and user data; the authentication server is used to set the access authority of the service server and is used to receive the service command sent by the service server; the telecommunications server is used to receive The identification data and user data sent by the authentication server, and verify the identification data and user data to generate the verification result, and to obtain the relevant data of the door number based on the identification data when the identification data and user data are verified. And send the verification result and door number-related data to the authentication server, so that the authentication server can filter the door number-related data according to the access permissions to generate additional data, and send the verification result and additional data to the service server to make the service server When the verification result indicates that the verification is passed, the operation corresponding to the type of identity verification is performed based on the user data and additional data.

The method for obtaining additional data to perform corresponding operations during identity confirmation disclosed in the present invention includes at least the steps of: setting the access authority of the service server by the authentication server; connecting the mobile device and the service server; and the mobile device on the service server When requesting identity verification, generate a service command and send the service command to the service server, where the service command includes identification data and user data; the service server sends the identification data and user data to the telecommunications server through the authentication server ; The telecommunication server verifies the identification data and user data to generate the verification result; when the identification data and user data pass the verification, the telecommunication server obtains the relevant data of the house number based on the identification data; the telecommunication server sends the verification result and the relevant data of the house number To the authentication server; the authentication server filters the door number-related data according to the access rights to generate additional data, and sends the verification result and additional data to the service server; the service server, when the verification result indicates that the verification is passed, is based on the user The data and additional data perform operations corresponding to the type of identity confirmation.

The system and method disclosed in the present invention are as above. The difference with the prior art is that the present invention sends a service command including identification data and user data to the service server when the service server requests identity confirmation through a mobile device. The server sends the identification data and user data in the service instruction to the telecommunications server through the identity verification server, so that the telecommunications server verifies the identification data and user data to generate a verification result, when the identification data and user data pass the telecommunications server When verifying, the telecommunications server obtains the door number-related data based on the identification data, and sends the verification result and the door number-related data to the authentication server. The authentication server screens the door number-related data according to the preset access rights to generate additional Data, and send the verification result and additional data to the service server. When the verification result indicates that the verification is passed, the service server performs operations corresponding to the type of identity verification based on the user data and additional data, so as to solve the problems in the prior art , And can achieve the technical effect of completing the online account opening operation using the additional information provided during identity recognition.

In the following, the features and implementation of the present invention will be described in detail with the drawings and embodiments. The content is sufficient to enable any person familiar with the relevant art to easily and fully understand the technical means used by the present invention to solve the technical problems and implement them accordingly. The achievable effect of the invention.

The present invention allows the service server identity to be verified by the mobile device through the telecommunication server, and additional data can be obtained through the identity verification server, so that the service server can use the additional data to perform corresponding operations after the mobile device passes the verification.

The additional data mentioned in the present invention is the data associated with the door number used by the mobile device to connect to the mobile communication network, including the personal status of the door number, the card type of the corresponding SIM card, the holding time of the door number, and the door number The payment status, etc., but the present invention is not limited to this.

In the following, the operation of the system of the present invention will be explained by using the system architecture diagram of obtaining additional data during identity verification mentioned in the present invention to perform corresponding operations in the "Figure 1A" of the present invention. As shown in "Figure 1A", the system of the present invention includes a mobile device 110, a service server 120, an authentication server 130, and a telecommunication server 140. Among them, the mobile device 110, the service server 120, the identity verification server 130, and the telecommunications server 140 are all computing devices.

The computing device mentioned in the present invention includes, but is not limited to, one or more processors, one or more memory modules, and components such as buses connecting different components (including memory modules and processors). Through the included multiple components, the computing device can load and execute the operating system, make the operating system run on the computing device, and can also execute software or programs. In addition, the computing device also includes a housing, and the above-mentioned components are arranged in the housing.

The bus of the computing device mentioned in the present invention may include one or more types, for example, including data bus, address bus, control bus, extended function bus ( expansion bus), and/or local bus (local bus). The bus of computing equipment includes, but is not limited to, parallel industry standard architecture (ISA) bus, peripheral component interconnect (PCI) bus, Video Electronics Standards Association (VESA) local bus, and serial universal serial bus (USB), PCI-E bus, etc.

The processor of the computing device provided by the present invention is coupled with the bus. The processor contains a register group or register space. The register group or register space can be completely set on the processing chip, or all or part of it can be set outside the processing chip and connected via a dedicated electrical connection. And/or coupled to the processor via the bus. The processor may be a processing unit, a microprocessor, or any suitable processing element. If the computing device is a multi-processor device, that is, the computing device includes multiple processors, the processors included in the computing device are all the same or similar, and they are coupled and communicated through a bus. The processor can interpret a series of multiple instructions to perform specific operations or operations, such as mathematical operations, logical operations, data comparison, copy/move data, etc., to run the operating system or execute various programs, modules, and/or element.

The processor of the computing device can be coupled to the chipset or electrically connected to the chipset through a bus. The chipset is composed of one or more integrated circuits (ICs), including a memory controller and peripheral input/output (I/O) controllers, that is to say, the memory controller and peripheral input/output controllers can be included in In an integrated circuit, two or more integrated circuits can also be used. Chipsets usually provide I/O and memory management functions, as well as multiple general-purpose and/or special-purpose registers, timers, etc., among which the aforementioned general-purpose and/or special-purpose registers and timers can be coupled or One or more processors electrically connected to the chipset are accessed or used.

The processor of the computing device can also access the data in the memory module and the mass storage area installed on the computing device through the memory controller. The above-mentioned memory modules include any type of volatile memory (volatile memory) and/or non-volatile memory (NVRAM), such as static random access memory (SRAM), dynamic random access Memory (DRAM), flash memory (Flash), read-only memory (ROM), etc. The above-mentioned large-capacity storage area can include any type of storage device or storage medium, such as hard disk drives, optical discs, flash drives (flash memory), memory cards, and solid state disks (Solid State Disk, SSD), or any other storage device, etc. In other words, the memory controller can access data in static random access memory, dynamic random access memory, flash memory, hard disk drives, and solid state drives.

The processor of the computing device can also connect and communicate with peripheral output devices, peripheral input devices, communication interfaces, and GPS receivers and other peripheral devices or interfaces through the peripheral I/O bus through the peripheral I/O controller. The peripheral input device can be any type of input device, such as a keyboard, mouse, trackball, touchpad, joystick, etc. The peripheral output device can be any type of output device, such as a display, a printer, etc., a peripheral input device It can also be the same device as the peripheral output device, such as a touch screen. The communication interface can include a wireless communication interface and/or a wired communication interface. The wireless communication interface can include a mobile communication network that supports Wi-Fi, Zigbee and other wireless local area networks, Bluetooth, infrared, near field communication (NFC), 3G/4G/5G, etc. The wired communication interface can be an Ethernet device, Asynchronous Transfer Mode (ATM) device, DSL modem, cable modem, etc. The processor can periodically poll various peripheral devices and interfaces, so that the computing device can input and output data through various peripheral devices and interfaces, and can also communicate with another computing device having the above-described components.

The mobile device 110 can be connected to the service server 120 via a wireless network, and can send data or signals to the service server 120, and can also receive data or signals sent by the service server 120. The wireless network mentioned in the present invention includes, but is not limited to, wireless local area networks such as WiFi, mobile communication networks such as 3G/4G, and so on.

The mobile device 110 can use the service provided by the connected service server 120, and when it receives the identity confirmation request sent by the service server 120, it is responsible for generating the type corresponding to the identity confirmation requested by the service server 120 Service instructions. In the present invention, the type of identity confirmation is usually defined by the service server 120, and includes at least two types of user identification and device confirmation, but the present invention is not limited to this.

The service command generated by the mobile device 110 includes identification data and user data. The identification data and user data in the service order may differ depending on the type of identity confirmation. For example, when the type of identity confirmation is device confirmation, the identification data can be the device identification data of the mobile device 110 (for example, the card number or door number of the SIM card used by the mobile device 110 to connect to the mobile communication network), or it can be The network identification data of the mobile device 110 connected to the mobile communication network (such as the network address used by the mobile device 110), and the user data can be the door number corresponding to the SIM card used by the mobile device 110 to connect to the mobile communication network ; For another example, when the type of identity confirmation is door number identification, the identification data can also be the device identification data or network identification data of the mobile device 110, and the user data can include the mobile device 110 used to connect to the mobile communication network. In addition to the door number corresponding to the SIM card used, it can also include user identification data such as the ID number of the user of the mobile device 110 and the birthday of the user of the mobile device, and even the user data can also include the registration service server Personal data required for the services provided by the device 120. Among them, the user identification data is data sufficient to identify the user of the mobile device 110, and is usually unique; personal data can include gender, address, email account, and other data related to the user of the mobile device 110, but the present invention does not Limited by this.

The mobile device 110 can also connect to the telecommunication server 140 through the mobile communication network to obtain the license token issued by the telecommunication server 140, and can add the obtained license token to the service instruction when generating the service instruction. It is possible to generate a service instruction containing a license token. Among them, the license token is the data generated by the telecommunication server 140 performing a specific encoding method on the specific data. It is usually composed of a certain number of letters, numbers, and symbols arranged arbitrarily, and is time-sensitive. For example, the license token is not only encoded In addition to the generated data, a time stamp can also be included.

The service server 120 can provide one or more services for the mobile device 110 to use, and can perform operations corresponding to the services used by the mobile device 110. In some embodiments, the service server 120 may be composed of multiple computing devices. For example, as shown in “FIG. 1B”, the service server 120 may include an application host 121 and an identification host 125. In other words, the functions of the application host 121 and the identity recognition host 125 are also the functions of the service server 120. The application host 121 and the identity recognition host 125 will be respectively described below.

The application host 121 can provide a connection to the mobile device 110 via a wireless network, and can transmit data or signals to the mobile device 110, and can also receive data or signals transmitted by the mobile device 110. Similarly, the application host 121 can be connected to the identification host 125 through a physical line or circuit, a wired network or a wireless network, and can send data or signals to the identification host 125, and can also receive data sent by the identification host 125 Or signal. The wired network mentioned in the present invention includes but is not limited to Ethernet.

The service used by the mobile device 110 is usually provided by the application host 121, where the application host 121 may first request the mobile device 110 to perform identity confirmation when the mobile device 110 requests to use a specific service.

The application host 121 can also receive a service command corresponding to the type of identity confirmation generated by the mobile device 110, and can transmit the received service command to the identity recognition host 125.

The application host 121 can also receive the verification result generated by the telecommunication server 140 through the identity recognition host 125, and can be based on the received verification result when the received verification result indicates that the identification data received from the mobile device 110 and the user data are verified The user data of the mobile device 110 and the additional data from the authentication server 130 perform operations that require identity verification requested by the mobile device 110, for example, scoring based on the additional data to determine whether to open an online account, etc. However, the present invention does not Not limited to the above.

The identification host 125 can be connected to the application host 121 through a physical line or circuit, a wired network or a wireless network, and the identification host 125 can also be connected to the authentication server 130 through a wired or wireless network. The identification host 125 It can also send data or signals to the application host 121 or the authentication server 130, and can also receive data or signals sent by the application host 121 or the authentication server 130.

The identification host 125 can select a connection method with the identity verification server 130 according to the type of identity confirmation received, and can transmit the received service command to the identity verification server 130 according to the selected connection method. And receive the additional data returned by the authentication server 130. For example, the method for the identification host 125 to select the connection method may be to select different transmission interfaces provided by the authentication server 130 according to different types of identity confirmation, and use the selected transmission interface to establish a connection with the authentication server 130 Connection, but the present invention is not limited to this.

The authentication server 130 can be connected to the service server 120 via a wired network or a wireless network, and can send data or signals to the service server 120, and can also receive data or signals sent by the service server 120.

The identity verification server 130 is responsible for receiving the service command sent by the service server 120. Generally speaking, the authentication server 130 can define the data format of the service command according to the transmission interface of the received service command, and read the identification data and user data from the received service command according to the defined data format.

The identity verification server 130 may also first determine whether the service command is correct when receiving the service command, and then read out the identification data and user data when it determines that the service command is correct. For example, the authentication server 130 can determine whether the service command is consistent with the transmission interface of the received service command. In more detail, the authentication server 130 can determine whether the length of the service command matches the data format and whether the specified location in the service command is consistent. The method of including specific characters or specific data to determine whether the service command is correct, but the manner in which the identity verification server 130 determines whether the service command is correct is not limited to the above.

The authentication server 130 is also responsible for sending the identification data and user data retrieved from the service order to the telecommunications server 140. If the service order also includes the license token, the authentication server 130 can also transfer the license token from the service command Take it out and send it to the telecommunication server 140. The authentication server 130 can select the method of connecting with the telecommunication server 140 according to the connection method used by the service server 120 (or the transmission interface through which the service command is received), so as to send the retrieved identification data and user data to The telecommunication server 140 and the identity verification server 130 can also generate service messages corresponding to the connection mode used by the service server 120, and can combine all the information when sending identification data and user data to the telecommunication server 140. The generated service message is sent to the telecommunication server 140. Among them, the service message can enable the telecommunication server 140 to determine the verification method that needs to be performed, for example, verification identification data (device identification data or network identification data of the mobile device 110) and user data (the mobile device 110 is connected to the mobile communication network gate). Number) is registered, or user data is verified based on identification data (device identification data or network identification data of mobile device 110) (the number used by the mobile device 110 to connect to the mobile communication network and the use of the user of the mobile device 110 (Identification data) are consistent, etc.

The authentication server 130 is also responsible for setting the access authority of the service server 120 or the application host 121. The access authority set by the authentication server 130 can determine the items of additional data that the service server 120/application host 121 can obtain.

For example, the authentication server 130 may provide an input interface to input the owner identification name and the access authority of the service server 120/application host 121 in the certificate used by the service server 120/application host 121, and based on the The input data sets the access authority of the service server 120/application host 121. However, the manner in which the authentication server 130 sets the access authority is not limited to the above.

The identity verification server 130 is also responsible for receiving the authentication message containing the verification result returned by the telecommunication server 140, and is responsible for sending the received verification result back to the service server 120. If the authentication message received by the authentication server 130 also contains information about the door number, the authentication server 130 can also read out the service from the information about the door number according to the access permissions of the service server 120/application host 121. The data items that the server 120/application host 121 can obtain, and generate additional data based on the read data items, or the door number-related data is included in the service server 120/ according to the access permissions of the service server 120/application host 121 The data items that cannot be obtained by the application host 121 are deleted, and the door number-related data after the deleted data is used as additional data. The identity verification server 130 may also send the generated additional data and the verification result in the verification message to the service server 120 together.

The telecommunication server 140 can be connected to the identity verification server 130 via a wired network or a wireless network, and can send data or signals to the identity verification server 130, and can also receive data or signals sent by the identity verification server 130.

The telecommunication server 140 is responsible for receiving the identification data and user data sent by the identity verification server 130, and is responsible for verifying the identification data and the user data to generate a verification result. For example, the telecommunications server 140 can determine whether there is a piece of data that includes both the received identification data and user data in the stored data. When the telecommunications server 140 stores a piece of data that includes both the identification data and the user data. In the case of data, the telecommunication server 140 can generate a verification result that passes the verification; otherwise, it generates a verification result that fails the verification. However, the manner in which the telecommunication server 140 verifies the identification data and user data is not limited to the above.

The telecommunications server 140 can also receive the license token sent by the identity verification server 130, and can verify the license token. For example, the telecommunications server 140 determines whether the license token is issued by the telecommunications server 140, if the license token contains a time stamp, etc. For time-sensitive messages, the telecommunications server 140 can even determine whether the license token is within the valid time, but the way the telecommunications server verifies the license token is not limited to the above. When the license token passes the verification of the telecommunications server 140, that is, the telecommunications server 140 determines that the license token is indeed sent by the telecommunications server 140 (and the license token is within a limited time), the telecommunications server 140 can generate a verification result that passes the verification; Conversely, the telecommunication server 140 may generate a verification result that fails the verification. Wherein, the telecommunications server 140 can store the issued license token and the identification data of the mobile device 110 sent to the license token as a piece of license verification data when sending the license token to the mobile device 110, and based on the stored license verification data To determine whether the received license token is issued by itself (telecom server 140), that is, to determine whether there is a piece of license verification data that contains the received license token and identification data Data, but the present invention is not limited to this.

The telecommunication server 140 is also responsible for generating and including verification results, and transmitting the generated verification results to the identity verification server 130. Generally speaking, the telecommunication server 140 can generate an authentication message containing the verification result, and send the authentication message to the identity verification server 130.

The telecommunications server 140 is also responsible for obtaining the corresponding door number-related data based on the received identification data after generating the verification result that passed the verification, and adding the obtained door number-related data to the generated authentication message, thereby adding The verification result is sent to the identity verification server 130 together with the door number related data. The telecommunications server 140 can read the corresponding target door number based on the identification data, and read the personal application status, card type, processing time, payment record and other data based on the target door number, and calculate the holding time based on the processing time, and The payment status is judged according to the payment record, so as to generate the door number related data including the information items such as the status, card type, holding time, payment status, etc., but the present invention is not limited to this.

Next, an embodiment is used to explain the operating system and method of the present invention, and please refer to "Figure 2A" for the flow chart of the method of obtaining additional data during identity verification in the present invention to perform corresponding operations. In this embodiment, it is assumed that the mobile device 110 is a mobile phone, and the service server 120 includes an application host 121 and an identification host 125, but the invention is not limited to this.

First, the identity verification server 130 may first set the access authority of the service server 120 (step 201). In this embodiment, it is assumed that the administrator of the authentication server 130 can set the access authority of the service server 120 to the door number-related data according to the owner name identity in the certificate of the service server 120 or the application host 121. If the door number-related data includes data items such as the personal application status, card type, holding time, payment status, etc., the identity verification server 130 can set whether the service server 120 has the ability to read the personal application status, card type, and holding status. Have access rights to data items such as time and payment status.

After that, when the user operates the mobile device 110 to connect to the service server 120 (step 210), the user can operate the mobile device 110 to request the use of the service provided by the application host 121 in the service server 120. When the service requested by the user operating the mobile device 110 needs to be identified, for example, when the service used by the user needs to be registered or the user's identity needs to be confirmed, the application host 121 may request the mobile device 110 to confirm the identity. In this embodiment, it is assumed that the service requested by the user is online account opening.

The mobile device 110 can generate a service command corresponding to the type of identity confirmation requested by the application host 121 when the application host 121 in the service server 120 requests identity confirmation, and send the generated service command to the service server 120 (Step 220). In this embodiment, it is assumed that the types of identity confirmation required by the application host 121 are user registration and user confirmation. Since the service requested by the user is online account opening, the application host 121 can request the mobile device 110 to perform the classification. The identity confirmation for the user registration. In this way, the service command generated by the mobile device 110 can include the device identification data or network identification data (identification data) of the mobile device 110, and the ID number, birthday, and date of the user of the mobile device 110. And the door number (user data) used by the user on the mobile device 110; and if the application host 121 requests the mobile device 110 to confirm the identity of the type of user confirmation, the service command generated by the mobile device 110 may include the mobile The device identification data or network identification data (identification data) of the device 110 and the door number (user data) used by the user on the mobile device 110.

After the service server 120 receives the service command sent by the mobile device 110, the service server can send the identification data and user data to the telecommunication server 140 through the authentication server 130 (step 230). In this embodiment, it is assumed that the application host 121 in the service server 120, after receiving the service command sent by the mobile device 110, can read the identification data and user data from the service command, and send the service command to the service The identification host 125 in the server 120, and the application host 121 can also generate a type message corresponding to the type of identity confirmation required by the mobile device 110 after receiving the service command, and can compare the received service command and all The generated type message is sent to the identification host 125. After the identity recognition host 125 receives the service command sent by the application host 121, the identity recognition host 125 can determine the type of connection that the application host 121 requires the mobile device 110 to perform identity verification according to the service command, and select the connection method according to the selected connection The service command is sent to the identity verification server 130 in this way. After the identity verification server 130 receives the service command sent by the service server 120, the identity verification server 130 can read the identification data and user data from the received service command, and can read out the The identification data and user data are sent to the telecommunication server 140, or when the service command is received, the type message is also received. The identity verification server 130 can also select the identity verification server 130 according to the received type message. Provide the corresponding transmission interface (connection mode), and send the received service command to the identity verification server 130 through the selected transmission interface.

After the telecommunication server 140 receives the identification data and user data sent by the identity verification server 130, the telecommunication server 140 can verify the received identification data and user data, and generate a corresponding verification result (step 250 ). In this embodiment, it is assumed that the telecommunication server 140 can determine whether there is a piece of data including the received identification data and user data in the stored data, so as to verify the identification data and user data. If the data stored in the telecommunications server 140 contains data including identification data and user data, the telecommunications server 140 can generate a verification result that passes the verification. On the contrary, if the data stored in the telecommunications server 140 does not contain both identification data and user data By identifying the data and the user data, the telecommunication server 140 can generate a verification result that fails the verification.

If the verification result generated by the telecommunication server 140 indicates that the identification data and the user data have not been verified, the telecommunication server 140 may generate an authentication message including the verification result and send the generated authentication message to the identity verification server 130.

If the verification result generated by the telecommunication server 140 indicates that the identification data and the user data have been verified, the telecommunication server 140 may obtain the door number related data according to the identification data (step 260). In this embodiment, it is assumed that the door number-related data obtained by the telecommunication server 140 includes data items such as the status of the personal application, card type, holding time, payment status, etc., and the telecommunication server 140 can generate a verification result that is related to the door number. The authentication message of the data is sent and the generated authentication message is sent to the identity verification server 130 (step 270).

After the identity verification server 130 receives the authentication message returned by the telecommunication server 140, it can determine whether the authentication message contains information related to the door number. If it does not include information related to the door number, the authentication server 130 can directly The verification result in the authentication message is sent to the service server 120, and if the authentication message contains door number-related data, the identity verification server 130 can change the door number-related data according to the access permissions of the service server 120/application host 121 The data items that can be accessed by the service server 120 are filtered out to generate additional data, and the received verification result and the generated additional data can be sent back to the service server 120 (step 280). In this embodiment, it is assumed that the access authority of the service server 120/application host 121 means that the service server 120/application host 121 can access the personal status, holding time, and payment status in the door number related information, but cannot Access card type, the identity verification server 130 can read from the door number-related information the personal status, holding time, payment status and other item data that can be accessed by the service server 120/application host 121, and based on all information The read-out item data generates additional data, and sends the generated additional data together with the verification result in the authentication message to the identification host 125 of the service server 120. After receiving the verification result (and additional data) sent by the identity verification server 130, the identification host 125 can send the received verification result (and the additional data) to the application host 121 of the service server 120.

After the service server 120 receives the verification result (and additional data) sent by the identity verification server 130, the service server 120 can determine whether the received verification result indicates that the verification is passed. If the verification result indicates that the verification is not passed, the application host 121 in the service server 120 can refuse to execute the service to be used by the mobile device 110; and if the verification result indicates that the verification is passed, the application host 121 in the service server 120 can be based on The user data received from the mobile device 110 and the additional data received from the identity verification server 130 perform the operation that requires identity confirmation (step 290). In this embodiment, it is to check whether the additional data meets the predetermined security control conditions and basis The user data establishes the operating procedures included in the online account opening service requested by the mobile device 110 such as account data.

In this way, through the present invention, the service server 120 can verify the data provided by the user of the mobile device 110 through the third-party telecommunication server 140, and obtain additional information through the identity verification server 130, so that the user of the mobile device 110 On the premise that the provided data is verified, the service requested by the mobile device 110 from the service server 120 is executed based on the additional data that can be obtained.

In the above embodiment, when the mobile device 110 generates a service command (step 220), the mobile device 110 can first connect to the telecommunications server 140 through the mobile communication network, and obtain the telecommunications The license token issued by the server 140 (step 223). Then, when the mobile device 110 generates the service order, it can add the license token obtained from the telecommunications server 140 to the generated service order (step 225), that is, generate After the service instruction including the license token, the mobile device 110 may transmit the generated service instruction to the service server 120 (step 229).

In this way, when the telecommunication server 140 verifies the received identification data and user data (step 250), the license token can also be verified together. In other words, the telecommunication server 140 can determine whether there is a piece of data including the received identification data and user data in the stored data, and can determine whether the license token is issued by the telecommunication server 140 itself. If the data stored by the telecommunications server 140 contains data including identification data and user data, and the license token is issued by the telecommunications server 140, the telecommunications server 140 can generate a verification result that passes the verification. On the contrary, if the telecommunications server 140 If the data stored in the server 140 does not contain both identification data and user data, or the license token is not sent by the telecommunication server 140, the telecommunication server 140 may generate a verification result that fails the verification.

In summary, it can be seen that the difference between the present invention and the prior art is that a mobile device sends a service command to the service server when the service server requests identity confirmation, and the service server uses the identity verification server to identify the identification in the service command. The data and user data are sent to the telecommunications server so that the telecommunications server verifies the identification data and user data to generate a verification result. When the identification data and user data pass the verification of the telecommunications server, the telecommunications server reads the identification data The door number-related data and the verification result and the door number-related data are sent to the authentication server. The authentication server can read the corresponding additional data from the door number-related data and send it for verification according to the preset access permissions of the service server. The result and additional data are sent to the service server. When the verification result is passed, the service server executes the technical means of the operation that requires identity confirmation based on the user data and additional data. This technical means can solve the part of the prior art The user cannot use the existing identity verification method to complete the online account opening problem, thereby achieving the technical effect of opening an account based on the additional data obtained when using a mobile device for identity recognition.

Furthermore, the method of obtaining additional data to perform corresponding operations during identity verification of the present invention can be implemented in hardware, software, or a combination of hardware and software, and can also be implemented in a centralized manner in a computer system or distributed with different components Realize in a distributed way of several interconnected computer systems.

Although the embodiments of the present invention are disclosed as above, the content described is not intended to directly limit the scope of patent protection of the present invention. Any person with ordinary knowledge in the technical field to which the present invention belongs, without departing from the spirit and scope of the present invention, makes slight modifications to the form and details of the implementation of the present invention, all belong to the patent protection of the present invention. range. The scope of patent protection of the present invention shall still be determined by the scope of the attached patent application.

110: mobile device 120: service server 121: application host 125: identification host 130: authentication server 140: Telecom Server Step 201: The authentication server sets the access permissions of the service server Step 210: connect the mobile device and the service server Step 220: The mobile device generates a service command when the service server requests identity confirmation, and sends the service command to the service server Step 223: Connect the mobile device to the telecommunications server to obtain a license token Step 225: The mobile device generates a service instruction corresponding to the type of identity confirmation, and adds the license token to the service instruction Step 229: The mobile device sends a service command to the service server Step 230: The service server sends the identification data and user data to the telecommunications server through the authentication server Step 250: The telecommunication server verifies the identification data and user data to generate a verification result Step 260: When the identification data and user data pass the verification, the telecommunication server obtains the relevant information of the house number according to the identification data Step 270: The telecom server sends the verification result and door number related data to the authentication server Step 280: The authentication server filters the door number-related data according to the access rights to generate additional data, and sends the verification result and additional data to the service server Step 290: When the verification result indicates that the verification is passed, the service server executes the operation requesting identity verification based on the user data and additional data

Figure 1A is a system architecture diagram for obtaining additional data to perform corresponding operations during identity verification provided by the present invention. Figure 1B is another system architecture diagram for obtaining additional data to perform corresponding operations during identity confirmation according to the present invention. Figure 2A is a flow chart of the method of obtaining additional data to perform corresponding operations during identity confirmation according to the present invention. Figure 2B is a flow chart of the method for the mobile device to obtain the license token and send it to the service server according to the present invention.

Step 201: The authentication server sets the access permissions of the service server

Step 210: connect the mobile device and the service server

Step 220: The mobile device generates a service command when the service server requests identity confirmation, and sends the service command to the service server

Step 230: The service server sends the identification data and user data to the telecommunications server through the authentication server

Step 250: The telecommunication server verifies the identification data and user data to generate a verification result

Step 260: When the identification data and user data pass the verification, the telecommunication server obtains the relevant information of the house number according to the identification data

Step 270: The telecom server sends the verification result and door number related data to the authentication server

Step 280: The authentication server filters the door number-related data according to the access rights to generate additional data, and sends the verification result and additional data to the service server

Step 290: When the verification result indicates that the verification is passed, the service server executes the operation requesting identity verification based on the user data and additional data

Claims (10)

A method for obtaining additional data to perform corresponding operations during identity verification, the method at least includes the following steps: An authentication server sets an access authority for a service server; Connect a mobile device and the service server; The mobile device generates a service command when the service server requests identity confirmation, and sends the service command to the service server, where the service command includes an identification data and a user data; The service server sends the identification data and the user data to a telecommunication server through the authentication server; The telecommunication server verifies the identification data and the user data and generates a verification result; When the identification data and the user data pass the verification, the telecommunication server obtains a house number related data based on the identification data; The telecommunication server sends the verification result and the related data of the door number to the identity verification server; The authentication server filters the data related to the door number according to the access authority to generate additional data, and transmits the verification result and the additional data to the service server; and When the verification result indicates that the verification is passed, the service server executes the operation requesting the identity confirmation based on the user data and the additional data. For example, the method of obtaining additional data to perform corresponding operations during identity verification described in item 1 of the scope of the patent application, wherein the authentication server sets the access authority of the service server for the authentication server according to the service The server's certificate sets the access authority. For example, the method of obtaining additional data to perform corresponding operations when confirming identity as described in item 1 of the scope of the patent application, wherein the step of obtaining the relevant information of the door number according to the identification data by the telecommunication server is that the telecommunication server obtains according to the identification data A target door number, and according to the target door number, read the corresponding personal application status, card type, holding time, and payment status to generate the relevant information of the door number. For example, the method of obtaining additional data to perform corresponding operations during identity verification described in item 1 of the scope of patent application, wherein the step of generating the service command corresponding to the type of identity verification by the mobile device further includes connecting the mobile device to The telecommunication server obtains a license token, and when generating the service instruction, adds the license token to the step of the service instruction. For example, the method of obtaining additional data to perform corresponding operations during identity verification described in item 1 of the scope of patent application, wherein the service server transmits the identification data and the user data to the telecommunication server through the identity verification server It also includes that the service server selects the transmission interface provided by the authentication server according to the type of identity confirmation to select a connection method with the authentication server, and sends the service command to the identity according to the connection method The authentication server, and the steps for the identity authentication server to send the identification data and the user data to the telecommunication server. A system for obtaining additional data to perform corresponding operations during identity confirmation, the system including at least: A mobile device; A service server, providing the mobile device connection, for requesting the mobile device to perform an identity confirmation, and receiving a service command generated by the mobile device, wherein the service command includes an identification data and a user data; An authentication server for setting an access authority of the service server and for receiving the service command sent by the service server; and A telecommunications server for receiving the identification data and the user data sent by the identity verification server, and verifying the identification data and the user data to generate a verification result, and used for the identification data and the user data When the user data is verified, obtain a door number related data based on the identification data, and send the verification result and the door number related data to the authentication server, so that the authentication server can filter the door number according to the access rights Related data to generate additional data, and send the verification result and the additional data to the service server. When the verification result indicates that the verification is passed, the service server requests the identity confirmation based on the user data and the additional data Of homework. For example, the system that obtains additional data to perform corresponding operations during identity verification described in item 6 of the scope of patent application, wherein the identity verification server sets the access authority based on the certificate of the service server. For example, the system that obtains additional data to perform corresponding operations when confirming the identity described in item 6 of the scope of the patent application, wherein the telecommunication server obtains a target number based on the identification data, and reads the corresponding target number based on the target number The personal status, card type, holding time, and payment status are used to generate the relevant information of the door number. For example, the system that obtains additional data to perform corresponding operations when confirming the identity as described in item 6 of the scope of the patent application, wherein the mobile device is further used to connect to the telecommunication server to obtain a license token, and add the license token to the service In the instruction. For example, the system that obtains additional data to perform corresponding operations during identity verification described in item 6 of the scope of patent application, wherein the service server selects the transmission interface provided by the identity verification server according to the type of identity verification to select the identity Verify a connection method between servers, and send the service command to the authentication server according to the connection method.

Images