TW202211056A - System and method for personal information authorization - Google Patents

Abstract

The present invention provides a personal information authorization system and a personal information authorization method, the main purpose of which is that the user can complete the identity authentication through the electronic device he/she holds, and use the real-time personal information authorization mechanism to restrict the personal information accessible by third-party application services. In this way, it can be ensured that the application service can only access the personal information that the user allows to provide, and prevent others from stealing the user's personal information without authorization, thereby achieving a safer, more convenient and more real-time authorization of identity information.

Description

Personal Information Authorization System and Personal Information Authorization Method

The present invention relates to an authorization system and an authorization method, and in particular, to a personal asset authorization system and a personal asset authorization method.

Generally speaking, personal data (referred to as personal data) generally refers to the natural person's name, date of birth, unified national identity card number, passport number, characteristics, fingerprints, marriage, family, education, occupation, medical records, medical treatment, genetics, Sex life, health check, criminal record, contact information, financial situation, social activities and other information that can directly or indirectly identify the individual.

Under the existing authorization technology, through technologies such as electronic signature and access token, the user does not need to provide the account number and password to the service provider, and then the service provider can allow the service provider to access the personal information stored on the server. However, the user must directly operate the terminal system or website of the service provider. Malicious service provider terminals can forge the authorization scope to request access to more data items, instead of only accessing a small part of what they need, resulting in Leakage of personal information.

In view of this, the present invention provides a personal information authorization system and a personal information authorization method, which can be used to solve the above-mentioned technical problems.

The present invention provides a personal information authorization system, which includes a mobile personal information authorization server and a mobile authentication server. The mobile personal data authorization server is configured to: receive a data authorization request from an application service server, wherein the personal data authorization request is generated by the application service server in response to a specific application service requested by a user, and the specific data authorization request is generated by the application service server. The application service requires a plurality of personal information items; in response to the personal information authorization request, an information authorization ticket is returned to the application service server, wherein the application service server converts the personal information authorization ticket into an authorization image; An electronic device of the device receives an authorization consent record and authentication information, and forwards the authorization consent record and authentication information, wherein the authorization consent record and authentication information indicate that the user agrees to provide a plurality of specific personal information corresponding to the aforementioned personal information items. The mobile authentication server is connected to the mobile data authorization server, and is configured to: receive the authorization consent record and authentication information, and verify the authentication information; in response to determining that the authentication information is verified, save the authorization consent record, and authorize the authorization through the mobile data The server provides a data inquiry command to a data providing server, wherein the data providing server provides the user's specific data to the mobile data authorization server in response to the data inquiry command, and the mobile data authorization server The server provides the above-mentioned specific information to the application service server to execute the specific application service.

The present invention provides a personal information authorization method, which is suitable for a personal information authorization system including a mobile personal information authorization server and a mobile personal information authorization server. The method includes: the mobile personal information authorization server receives from an application server server. A data authorization request, wherein the data authorization request is generated by the application service server in response to a specific application service requested by a user, and the specific application service requires multiple data items; it is responded by the mobile data authorization server In response to the personal information authorization request, an information authorization ticket is returned to the application service server, wherein the application service server converts the personal information authorization ticket into an authorization image; in response to determining that an authorization consent record is received from an electronic device of the user, and Authentication information, the authorization consent record and authentication information are forwarded by the mobile personal information authorization server to the mobile authentication server, wherein the authorization consent record and the authentication information indicate that the user agrees to provide a plurality of specific information corresponding to the aforementioned personal information items; and The mobile authentication server verifies the authentication information; in response to determining that the authentication information is verified, the mobile authentication server saves the authorization and consent record, and provides an information query command to an information provision server through the mobile personal information authorization server, wherein the personal information provides The server provides the user's specific data to the mobile data authorization server in response to the data query command; the mobile data authorization server provides the above-mentioned specific data to the application service server to execute the specific application service .

Please refer to FIG. 1 , which is a schematic diagram of a personal information authorization system according to an embodiment of the present invention. As shown in FIG. 1 , the personal information authorization system 100 of the present invention includes an application service server 100 , an electronic device 110 , a mobile personal information authorization server 120 , a mobile authentication server 130 and a personal information providing server 140 .

In different embodiments, the application service server 100 is, for example, a server that can provide various application services, such as a banking system (online/check-in), a ticketing system, etc., and the above various application services, for example, need to be used Services that can be used by one or more individuals of the user, such as lending, booking tickets, etc., but not limited to this. For the convenience of description, the following will take a banking system as an example for illustration, but it is not intended to limit the possible implementation of the present invention.

In one embodiment, the application service server 100 can display various application services provided by the bank through the user interactive interface 101 (eg, a touch screen, etc.) disposed on the bank counter, and the user can directly access the Select the desired application service (hereinafter referred to as a specific application service). For example, if a user wants to apply for a loan service at a bank, he can directly select the loan service as the above-mentioned specific application service in the user interaction interface 101, and the application service server 100 can generate personal information accordingly. The authorization request S1 is forwarded, and the data authorization request S1 is forwarded to the mobile data authorization server 120 .

In other embodiments, the user interface 101 can also be implemented as a webpage of the banking system. In this case, the user can select the desired specific application service in the bank's web interface, and the application service server 100 can also generate a personal data authorization request S1 accordingly, and forward the data authorization request S1 to the mobile personal data The authorization server 120 is not limited to this.

Correspondingly, the mobile personal data authorization server 120 may return the personal data authorization ticket S2 to the application service server 100 in response to the personal data authorization request S1 . In different embodiments, the personal information authorization ticket S2 may include at least one of the identification code of the application service provider (such as the code of the above-mentioned bank), the operation serial number, the content of the personal information authorization field, the time of issuance of the ticket, and the signature, But not limited to this.

In one embodiment, when the mobile personal information authorization server 120 receives the personal information authorization request S1, the personal information authorization request verification module 121 therein can verify the legality of the personal information authorization request S1 sent by the application service server 100. properties, including source-side verification and data field verification of personal information authorization request S1, etc., but not limited to this. In addition, after determining that the personal information authorization request S1 has passed the verification, the mobile personal information authorization server 120 can accordingly issue and return the personal information authorization ticket S2 to the application server 100 by the authorization ticket management module 123 therein. But not limited to this.

In one embodiment, after the application service server 100 receives the personal information authorization ticket S2, the authorization barcode conversion module 102 therein can convert the personal information authorization ticket S2 into the authorization image S3, and the user interface 101 can be used for Display the authorized image S3. In different embodiments, the authorization picture S3 can be presented as a one-dimensional barcode, a two-dimensional barcode or other barcode pictures that can characterize the personal information authorization ticket S2, but it is not limited thereto.

After that, the user can, for example, capture S3 through the authorized image capture module 111 (for example, an image capture module such as a camera on the electronic device 110 ) of the electronic device 110 (for example, various smart devices) held by the user. Authorize the picture, and convert the authorized picture S3 into a personal information authorization note S2.

Next, the authorization ticket verification module 112 in the electronic device 110 can be used to verify the personal information authorization ticket S2, and after determining that the personal information authorization ticket S2 is verified, display the personal information items (such as address, telephone number, etc.) required by the above-mentioned specific application service. Wait). In this case, the user of the electronic device 110 can confirm on the electronic device 110 whether the selected specific application service is allowed to obtain the specific personal information corresponding to the above-mentioned personal information item.

In one embodiment, in response to determining that the user agrees to authorize the above-mentioned specific individual to use the specific application service, the electronic device 110 may generate an authorization consent record S4 and authentication information S5 (which may include, for example, a specific user code corresponding to the above-mentioned user). and authentication time), and encrypt the authentication information S5 with the authentication key.

In one embodiment, when it is determined that the user agrees to authorize the above-mentioned specific individual to use the specific application service, the identity authentication module 113 in the electronic device 110 can perform identity authentication on the user, such as password authentication, fingerprint authentication, and face authentication. , or other forms of biometric authentication, etc., but not limited to this.

Afterwards, the electronic device 110 may send the authorization consent record S4 and the encrypted authentication information S5 to the mobile data authorization server 120 . Correspondingly, the personal information authorization management module 122 in the mobile personal information authorization server 120 can interface with the mobile authentication server 130 to verify the authentication information S5. That is, the personal information authorization management module 122 can forward the encrypted authentication information S5 to the mobile authentication server 130 according to the authorization consent record S4, so that the mobile authentication server 130 can verify the authentication information S5.

In one embodiment, the authentication key management module 132 in the mobile authentication server 130 can be used, for example, to manage the correspondence between a plurality of user authentication codes and a plurality of authentication keys. In this case, after the mobile authentication server 130 receives the encrypted authentication information S5, the authentication key management module 132 can query the corresponding authentication key according to the above-mentioned specific user code, but it is not limited thereto.

After obtaining the corresponding authentication key, the authentication information verification module 131 in the mobile authentication server 130 can decrypt the authentication information S5 through the authentication key, and verify the validity of the authentication information S5.

In one embodiment, in response to determining that the authentication information S5 is verified, the mobile authentication server 130 may notify the user of the mobile data authorization server 120 that the user agrees to the record storage module 124 to save the authorization consent record S4, and authorize the user through the mobile data authorization server 120. The server 120 provides the data query command S6 to the data providing server 140 . Specifically, the mobile personal information authorization server 120 can forward the personal information query instruction S6 to the personal information providing server 140 through the personal information authorization management module 122, so that the personal information providing server 140 can query the above-mentioned specific personal information.

In one embodiment, the personal information providing server 140 is, for example, a household registration office or other server that stores various personal information of the user, and the above-mentioned various personal information can be stored in the personal information providing server 140 , for example. Personal database 142 . In one embodiment, after the personal information providing server 140 receives the personal information query instruction S6, the personal information query processing module 141 therein can verify the personal information query instruction S6, and can determine that the personal information query instruction S6 passes the verification. , providing the user's specific personal information S7 to the mobile personal information authorization server 120 .

Correspondingly, the mobile personal information authorization server 120 can return the specific personal information S7 provided by the personal information providing server 140 to the application service server 100 through the personal information authorization management module 122 .

After that, the application service server 100 can execute the user-selected data S7 of the user of the electronic device 110 (eg, the user's address, phone number, etc.) specific application services.

Please refer to FIG. 2 , which is a flowchart of a method for authorizing personal information according to an embodiment of the present invention. The method of this embodiment can be executed by the personal information authorization system 10 in FIG. 1 , and the details of each step in FIG. 2 will be described below with the components shown in FIG. 1 .

First, in step S210 , the mobile personal information authorization server 120 may receive a personal information authorization request S1 from an application server 100 , wherein the personal information authorization request S1 corresponds to the user of the electronic device 110 by the application server 110 The specific application service required, and the specific application service requires a plurality of individual items.

In step S220, the mobile personal information authorization server 120 may respond to the personal information authorization request S1 and return the personal information authorization ticket S2 to the application server 100, wherein the application server 100 may convert the personal information authorization ticket S2 into Licensed Image S3.

In step S230, in response to determining that the authorization consent record S5 and the authentication information S6 are received from the user's electronic device 110, the mobile data authorization server 120 may forward the authentication information S5 to the mobile authentication server 130 in response to the authorization consent record S5 , wherein the authorization consent record S5 and the authentication information S6 indicate that the user agrees to provide a plurality of specific personal information S7 corresponding to the aforementioned personal information items.

In step S240, the mobile authentication server 130 can verify the authentication information S6. In step S250, in response to determining that the authentication information S6 is verified, the mobile authentication server 130 may notify the mobile data authorization server 120 to save the authorization consent record S5, and provide the data query command S6 to the mobile data authorization server 120 through the mobile data authorization server 120. The personal information providing server 140, wherein the personal information providing server 140 can provide the specific personal information S7 of the user to the mobile personal information authorization server 120 in response to the personal information query command S6.

In step S260, the mobile personal information authorization server 120 may provide the specific personal information S7 to the application service server 100, so that the application service server 100 can execute the specific application service accordingly.

The details of the steps in FIG. 2 can be referred to the descriptions in the previous embodiments, and are not described herein again.

To sum up, the personal information authorization system and method of the present invention can verify the legitimacy of the personal information authorization request generated by the application service server, and issue an authorization ticket to the application service server according to the personal information authorization request. If the user confirms the authorization in the electronic device, the procedure of storing and verifying the user's authorization consent record and authentication information is executed, and finally the personal information query result is returned to the application server according to the personal information authorization request.

For the user, he only needs to select the desired specific application service on the user interface, and then use the electronic device to capture the authorized image displayed on the user interface to know which specific application services are required. information items, and can decide whether to authorize a specific application service to obtain the specific personal information of the above-mentioned personal information items. In other words, the user can decide which personal information to authorize for the selected specific application service according to his or her own wishes, thereby preventing the application service server from obtaining additional personal information that is not authorized by the user. Thereby, the security of the user's personal information can be further ensured, and the user's personal information can be prevented from being obtained by a malicious application server.

Although the present invention has been disclosed above by the embodiments, it is not intended to limit the present invention. Anyone with ordinary knowledge in the technical field can make some changes and modifications without departing from the spirit and scope of the present invention. Therefore, The protection scope of the present invention shall be determined by the scope of the appended patent application.

10: Personal Information Authorization System 100: Application service server 101: User Interface 102: Authorized barcode conversion module 110: Electronic Devices 111: Authorized image capture module 112: Authorization ticket verification module 113: Identity authentication module 120:Mobile Personal Data Authorization Server 121: Personal information authorization request verification module 122: Personal Information Authorization Management Module 123: Authorized ticket management module 124: User agrees to record storage module 130: Mobile Authentication Server 131: Authentication information verification module 132: Authentication key management module 140: Personal information providing server 141: Personal information query processing module 142: Personal Information Database S1: Personal Information Authorization Request S2: Personal Assets Authorization Note S3: Licensed Image S4: Authorization Consent Record S5: Authentication Information S6: personal information query instruction S7: specific personal information S210~S260: Steps

FIG. 1 is a schematic diagram of a personal information authorization system according to an embodiment of the present invention. FIG. 2 is a flowchart of a method for authorizing personal information according to an embodiment of the present invention.

10: Personal Information Authorization System

100: Application service server

101: User Interface

102: Authorized barcode conversion module

110: Electronic Devices

111: Authorized image capture module

112: Authorization ticket verification module

113: Identity authentication module

120:Mobile Personal Data Authorization Server

121: Personal information authorization request verification module

122: Personal Information Authorization Management Module

123: Authorized ticket management module

124: User agrees to record storage module

130: Mobile Authentication Server

131: Authentication information verification module

132: Authentication key management module

140: Personal information providing server

141: Personal information query processing module

142: Personal Information Database

S1: Personal Information Authorization Request

S2: Personal Assets Authorization Note

S3: Licensed Image

S4: Authorization Consent Record

S5: Authentication Information

S6: personal information query instruction

S7: specific personal information

Claims (12)

A personal information authorization system, including: A mobile data authorization server configured to: A resource authorization request is received from an application server, wherein the resource authorization request is generated by the application server in response to a specific application service requested by a user, and the specific application service requires multiple resources project; In response to the resource authorization request, return a resource authorization ticket to the application server, wherein the application server converts the resource authorization ticket into an authorization image; In response to determining that an authorization consent record and authentication information are received from an electronic device of the user, forwarding the authentication information in response to the authorization consent record, wherein the authorization consent record and the authentication information indicate that the user agrees to provide the corresponding a number of specific personal data for these personal data items; and a mobile authentication server connected to the mobile data authorization server and configured to: receive the certification information and verify the certification information; In response to determining that the authentication information is verified, notify the mobile data authorization server to save the authorization consent record, and provide an information query command to a data provision server through the mobile data authorization server, wherein the data provision server the server provides the data of the user to the mobile data authorization server in response to the data query command, and the mobile data authorization server provides the specific data to the application server, to execute that specific application service. The system according to claim 1, further comprising the application service server, which includes: an authorization barcode conversion module for converting the personal asset authorization ticket into the authorization image; and a user interface for displaying the authorized image. The system of claim 1, further comprising the electronic device, comprising: an authorization barcode capture module for capturing the authorization image and converting the authorization image into the asset authorization ticket; An authorization ticket verification module configured to: Verifying the asset authorization ticket, and after determining that the asset authorization ticket has passed the verification, displaying the asset items required by the specific application service; In response to determining that the user agrees to authorize the specific individuals to the specific application service, generating the authorization agreement record and the authentication information, and encrypting the authentication information with an authentication key; Send the authorization consent record and the encrypted authentication information to the mobile personal information authorization server. The system of claim 3, wherein the electronic device further comprises an identity authentication module for performing an identity authentication on the user when the user agrees to authorize the specific individuals to the specific application service. The system of claim 1, further comprising the data providing server configured to: Verify the data query instruction; In response to determining that the information query command has passed the verification, the specific personal information of the user is provided to the mobile personal information authorization server. The system of claim 1, wherein the authorized image includes a one-dimensional barcode or a two-dimensional barcode. The system according to claim 1, wherein the personal information authorization ticket includes at least one of the identification code of the application service provider, the operation serial number, the content of the personal information authorization field, the issuance time of the ticket, and the signature. The system of claim 1, wherein the mobile personal information authorization server includes an authorization request verification module, which is used for verifying the legitimacy of the personal information authorization request sent by the application service server, including the source terminal Validation and validation of the data fields of the data authorization request. The system of claim 1, wherein the mobile personal information authorization server includes an information authorization management module, which is used for interfacing with the mobile authentication server to verify the authentication information and interfacing with the data providing server The server queries the specific data, and returns the specific data provided by the data providing server to the application server. The system of claim 1, wherein the mobile personal asset authorization server includes an authorization ticket management module for issuing the personal asset authorization ticket according to the data field of the personal asset authorization request. The system of claim 1, wherein the authentication information includes a specific user code and an authentication time corresponding to the user, and the mobile authentication server includes: an authentication key management module, which is used for managing the correspondence between a plurality of user authentication codes and a plurality of authentication keys, and after receiving the authentication information, inquires a corresponding authentication key according to the specific user code; and An authentication information verification module is used for decrypting the authentication information through the authentication key and verifying the legality of the authentication information. A personal information authorization method, suitable for an information authorization system including a mobile personal information authorization server and a mobile authentication server, the method comprising: A resource authorization request is received by the mobile data authorization server from an application service server, wherein the data authorization request is generated by the application service server in response to a specific application service requested by a user, and the A specific application service requires multiple personal items; returning an asset authorization ticket to the application service server by the mobile asset authorization server in response to the asset authorization request, wherein the application service server converts the asset authorization ticket into an authorization image; In response to determining that an authorization consent record and authentication information are received from an electronic device of the user, the mobile data authorization server forwards the authentication information to the mobile authentication server in response to the authorization consent record, wherein the authorization consent record and the authentication information indicates that the user agrees to provide a plurality of specific personal information corresponding to the personal information items; verifying the authentication information by the mobile authentication server; In response to determining that the authentication information is verified, notify the mobile data authorization server to save the authorization consent record, and provide an information query command to a data provision server through the mobile data authorization server, wherein the data provision server the device provides the specific data of the user to the mobile data authorization server in response to the data query command; and The specific data are provided by the mobile data authorization server to the application service server to execute the specific application service.

Images