TWI647942B - A system and method for accessing and authenticating an electronic certificate - Google Patents

Abstract

The present invention discloses an electronic document authentication and authorization access system and method. The method includes: initiating, by an application service module, a request for data access authorization of an electronic document to a browser; receiving a request provided by the browser through a client application to call a card access module, and The card access module performs authentication; after the electronic certificate authentication is completed, the data field of the selected authorized authority is obtained through a voucher management device and stored in one of the application service modules; and is connected through a client. The module downloads a data field of the voucher and the authorized authority in the credential area; the voucher is verified by a voucher verification module, so that the application service module reads the personal data of the user in the electronic certificate.

Description

Electronic document authentication and authorization access system and method

The present invention relates to an authentication and authorization access technology, and more particularly to an electronic certificate authentication and authorization access system and method.

A smart card is a type of chip card in which an integrated circuit chip is embedded in a portable plastic card. The card includes a microprocessor, an I/O interface, and a memory, and can store various types of card information, and can be classified into an identity card, a health insurance card, a driver's license, a credit card, an electronic ticket, a transportation ticket, etc. according to the purpose of storing the information. A smart card with identity authentication or personal information in the card can be called an electronic certificate.

Under the existing e-Certificate structure, if there is a service provider for a third-party service provider, the user needs to be authenticated by e-mail. A unified authentication service server is often required, and the authentication process is complicated and takes time. Also higher. If the service providing device needs to access the data in the electronic certificate, the user can only trust the service providing device unconditionally. A malicious service provider can read all the information of an electronic document, rather than a small part of it, causing leakage of user information.

In the prior art, there is an authentication for the electronic identity card, which requires an eID system. An authentication service system cannot authorize only specific information to the service provider.

In the prior art, the information of each person in the electronic identity card is obtained through a browser, and transmitted to a unified authentication server to complete the identity authentication, and then the authentication result is transmitted back to the browser, and then provided to the application initiated by the authentication. program. This technology cannot be used for data management and control. It must also set up a unified authentication server and perform connection authentication every time it is authenticated.

In addition, in the prior art, the client can directly authenticate the service provider device, but the service provider still needs to perform connection authentication on the unified eID third-party authentication platform at the back-end device. At the same time, although this technology can protect personal identity and privacy information during authentication, it still cannot obtain data access authorization. This technology cannot provide support if the service provider requires personal information from some electronic documents.

Moreover, in the prior art, an authorized identification provider (Identity Provider) is required to obtain an authorized access to the electronic certificate, and the data authorization access cannot immediately reduce the authorized data by the user.

It can be seen that there are still many shortcomings in the above-mentioned conventional methods, which is not a good design, but needs to be improved.

The present invention provides an electronic document authentication and authorization access system and method, the purpose of which is to provide a trusted identity authorization and data authorization access technology in a service providing device and a user device, thereby preventing a person or a hacker from forging identity fraud services. Providing a device or a service providing device to steal user data without authorization. At the same time, the client can be authenticated through the electronic certificate and the application service module, and the user authorization machine is provided. system. When the user device performs data access authorization, the user can also restrict the accessed electronic document data, and can ensure that the application service module can only access the personal data allowed by the user.

Therefore, in accordance with the above purposes, the present invention provides an electronic document authentication and authorization access system, comprising: a service providing device having an application service module, wherein the application service module initiates a user identity authentication request to the browser and provides The data field of the selected user's authentication data item, and the application service module has a voucher area for storing the data field of the authorization authority; the voucher management device grants the phase according to the selected user's authentication data item a data field corresponding to the authorized authority; and a user device having a client application for calling the client application after receiving the identity authentication request provided by the browser for the user a card access module of the program, wherein the card access module performs authentication of the user's electronic certificate according to an electronic certificate, so that after the authentication of the electronic document is completed, the client application downloads the certificate area After the issued voucher and the data field of the authorized authority stored in the voucher area, the card access module is used to The certificate verification module is authenticated by one of the client applications, so that the application service module reads the user's personal data stored in the electronic document through the data field of the authorization authority through the card access module. .

In addition, the present invention further provides an electronic document authentication and authorization access method, comprising: initiating a request for data access authorization of an electronic document to a browser through an application service module; through a client application Receiving the request provided by the browser to call a card to save The module is taken, and then the card access module is authenticated according to the provisions of the electronic certificate; after the electronic certificate authentication is completed, the data field of the selected authorized authority is obtained through a voucher management device and stored in the application service module. a credential area; downloading a credential and authorization authority data field in the credential area through a client connection module; and submitting the voucher to a credential verification through a card access module connected to the client connection module The module verification is performed to enable the application service module to read the personal data of the user stored in the electronic certificate through the data field of the authorization authority according to the card access module.

Therefore, the technical advantage of the present invention is that the present invention provides an identity authorization and data authorization access technology that can be trusted by the unified authentication service system of the electronic certificate. Moreover, the present invention provides a trusted identity authorization and data authorization access technology in the service providing device and the user device. At the same time, the present invention provides a data part authorization access technology, which uses the chip card management to match the user interaction, and the user can adjust the data for each authorization.

10‧‧‧Electronic Document Certification Authorization Access System

100‧‧‧User device

101, 210, 310‧‧‧ browser

102, 230, 330‧‧‧ client applications

103‧‧‧Service providing device

104, 220, 320‧‧‧ Application Service Module

105, 321‧‧ ‧ certificate area

106‧‧‧Voucher management device

107‧‧‧Internet

108, 211, 311‧‧‧ Web Support Module

231,331‧‧‧Client connection module

232, 332‧‧‧ card access module

333‧‧‧Voucher verification module

Steps S21 to S26, S31 to S39‧‧

The specific embodiments disclosed in the present disclosure will be described in detail with reference to the following drawings, which are shown in the following drawings: FIG. 1 is a system block diagram of an electronic certificate authentication and authorization access system of the present invention; FIG. 2 is an electronic certificate of the present invention. The authentication flow chart; and the third figure is a flow chart of the electronic certificate authentication and authorization access of the present invention.

As shown in Figure 1, it is the electronic certificate authentication authorization access of the present invention. A system block diagram of the system 10, the system 10 is mainly composed of a user device 100 at the user end and a service provider device 103 of the service provider, wherein the user device 100 includes the browser 101 and the client application 102; The providing device 103 mainly provides the application service module 104. The user accesses the application service module 104 through the browser 101. When the application service module 104 requires the user to authenticate the identity through an electronic certificate (such as an identity card, a health insurance card, a driver's license, or a credit card), or ask for When the user profile is taken, the browser 101 will use the webpage support module 108 to transfer the request of the application service module 104 to the client application 102. When the client application 102 receives the request from the browser 101, The user will be prompted to provide an electronic certificate, such as placing the electronic document in a card reader (not shown), or sensing the electronic document through a near field communication (NFC) function on a mobile device (such as a mobile phone). . The client application 102 will perform the corresponding operations in response to the type of demand received.

If the application service module 104 requires the user to perform identity authentication, most of the requirements of this type appear in the scenario of logging in the application service, signing the electronic file, etc., at this time, the client application 102 will prompt the user to input a personal identification number (PIN). Or use biometric methods (such as fingerprints, face recognition, etc.) to access the electronic certificate and perform the signature action. After the completion, the signature data is returned, and the application service module 104 can verify the signature data. Confirm the authenticity of the remote device user identity.

When the application service module 104 needs to access the data in the user's electronic certificate, the following two pre-operations must be completed: (1) The application service module 104 must list the required user data items. And located in the voucher The certificate management device 106 of the management center applies for issuing the authorization certificate exclusive to the application service. After the verification and verification by the certificate management device 106, the content of the authorization certificate specific to the application service module 104 will be read by the application service module 104. The authorization item will be stored in the credential area 105 in the application service module 104. (2) The application service root certificate of the credential management device 106 must be implanted before the electronic certificate of the user is issued.

The purpose of the above two pre-operations is mainly to enable the client application 102 to be verified by the user device 100 directly through the certificate chain by using the root certificate already embedded in the electronic certificate. The authenticity and legality of the authorization credentials provided by the application service module 104. The client application 102 will verify the access rights of the application service module 104 according to the data item specification in the authorization voucher, and prompt the user to access the data items specified by the application service module 104, for example, the date of birth. Day, phone, residential address, etc. The user can refuse to authorize some of the personal data, leaving only the remaining data for reading. Only after the user agrees to access, the client application 102 can read the personal data that has been authorized to be accessed from the electronic certificate, and then return the personal data to the browser 101 after the reading is completed, thereby transmitting Used by the application service module 104. Related applications of this type can be used in the future in the form of personal data form filling, age checking, and local resident-specific services.

Figure 2 is a flow chart of the authentication of the electronic certificate of the present invention.

In step S21, when the application service module 220 needs to use the client electronic certificate to authenticate the user, the application service module 220 must be directed to the browser. 210 initiates an authentication request.

In step S22, the browser 210 is configured to use the webpage support module 211 to establish a connection to the client application 230 via the internetwork 107 (as shown in FIG. 1). If the client application 230 is not in the startup state, the webpage is The support module 211 will start up and then connect. When the client application 230 is launched, the client connection module 231 will connect to the webpage support module 211. When the client connection module 231 receives the authentication request, the user is prompted for the authentication request, and the corresponding application service and the electronic certificate are authenticated.

In step S23, after the user agrees and inserts or senses the electronic document, the client application 230 calls the card access module 232 and performs authentication according to the electronic certificate, such as the user inputting the individual. The identification code (PIN) or biometric identification is used to obtain the signature back. After the electronic certificate authentication is completed, the authentication result is passed to the card access module 232.

In step S24, the authentication result is transmitted to the client connection module 231 through the card access module 232.

In step S25, the authentication result is transmitted to the web page support module 211 via the client connection module 231.

In step S26, the authentication result is transmitted to the application service module 220 via the web page support module 211, and the entire authentication procedure is completed.

Figure 3 is a flow chart of the electronic certificate authentication and authorization access of the present invention.

If the application service module 320 wants to access the content data of the specific electronic certificate, the authorization certificate should be obtained in advance and stored in the voucher area 321, that is, the application service module 320, which can display the authentication for the selectable user. The data field of the data item, after which the voucher management device 106 (as shown in FIG. 1) grants the corresponding authorization authority according to the data field of the selected user's authentication data item, and stores the authorization authority to Document area 321.

In step S31, when the application service module 320 needs to access the content data of the client electronic certificate, the application service module 320 should initiate an electronic document data access authorization request to the browser 310, wherein the content of the authorization request needs to include the application. The connection of the credential area 321 owned by the service module 320.

In step S32, the browser 310 connects the webpage support module 311 to the client application 330 via the Internet 107 (as shown in FIG. 1) for communication. If the client application 330 is not activated, The web page support module 311 will start up and then connect. After the client application 330 is launched, the client connection module 331 will be executed. The client connection module 331 will provide a connection service to enable the webpage support module 311 to establish a connection with it.

In step S33, when the client connection module 331 receives the data authorization and access request (which must include the corresponding credential area link), the client connection module 331 will initiate the Internet 107 (as shown in FIG. 1). Connected to the voucher area 321 to download the voucher. If there is no corresponding certificate, the request will be rejected.

In step S34, the card access module 332 obtains the credentials from the credential area 321 via the client connection module 331.

In step S35, the card access module 332 passes the certificate to the voucher verification module 333 for verification. The voucher verification module 333 first verifies whether the voucher is within the validity period and whether it is not retired. If the verification is successful, then The credential prompts the user to apply the data field that the service wants to read. user The data field being read can be rejected or reduced. After the user agrees and inserts or senses the electronic credential, the card access module 332 provides the credential to the electronic credential and executes the data access instruction in accordance with the data field provided or selected by the user. The electronic certificate verifies the credential chain according to the aforementioned application service root certificate. If the voucher chain is successfully verified and the electronic document accepts the data item to be read in the voucher, the data access instruction can correctly read the electronic document. If the credential chain fails to be verified, it will still be denied access by the e-document when reading the data field to be authorized.

In step S36, the reply result of the electronic certificate is transmitted to the card access module 332 through the voucher verification module 333.

In step S37, the reply result of the electronic certificate is transmitted to the client connection module 331 through the card access module 332.

In step S38, the reply result of the electronic certificate is transmitted to the webpage support module 311 via the client connection module 331.

In step S39, the reply result of the electronic document is transmitted to the application service module 320 through the webpage support module 311, and the entire data authorization and access procedure is completed.

Compared with the lack of authentication of the user's electronic certificate by the third-party service providing device, the present invention provides the client electronic certificate authentication and authorization access system and method, which can be authenticated by the client through the electronic certificate and the application service. And provide a user authorization mechanism to ensure that the application service can only access the personal data allowed by the user, and can apply the electronic card and multi-card card-making industry, such as a chip identification card and a citizen card. At the same time, the technical advantages of the present invention are as follows: (1) No need for authentication and authorization Through a unified authentication service system, the user device only needs to connect to the service providing device; (2) the data access is authorized to the user's electronic ID device, and the service providing device determines the accessible data field by using the voucher; 3) The user can decide on the information to be provided in each authorization.

The above-described embodiments are merely illustrative of the principles, features, and functions of the present disclosure, and are not intended to limit the scope of the present disclosure. Any person skilled in the art can practice the above without departing from the spirit and scope of the disclosure. The embodiment is modified and changed. Any equivalent changes and modifications made by the disclosure of this disclosure should still be covered by the scope of the patent application. Therefore, the scope of protection of the present disclosure should be as set forth in the scope of the patent application.

Claims (11)

An electronic document authentication and authorization access system includes: a service providing device having an application service module, wherein the application service module initiates an authentication request to a browser and provides information of a selectable user's authentication data item a field, and the application service module has a voucher area for storing the data field of the authorization authority; and a voucher management device, according to the selected authentication data item of the user, the corresponding data column of the authorization authority is granted And a user device having a client application for receiving a card access mode of the client application after receiving the authentication request provided by the browser The group access module performs authentication of the user's electronic certificate without performing authentication of the electronic certificate by an authentication service system, so that after the authentication of the electronic document is completed, the client application is After downloading the certificate issued by the credential area and the data field of the authorized authority stored in the credential area, the card access module The certificate is authenticated by one of the client application credential verification modules, so that the application service module reads the stored in the electronic certificate through the data field of the authorization authority of the card access module. User's profile. The system of claim 1, wherein the user's authentication data item includes the user's identity font number, the user's name, the user's mobile phone number, or a combination thereof. . The system of claim 1, wherein the browser package The webpage support module is configured to transmit data to the application service module and the client connection module of the client application through an internet. The system of claim 3, wherein the card access module transmits data through the client connection module. The system of claim 1, wherein the credential management device embeds an application root certificate into the electronic credential to verify the authenticity and legality of the authorization authority. The system of claim 1, wherein the electronic document is one of an identity card, a health insurance card, a driver's license, and a credit card. The system of claim 1, wherein after the application service module receives the authentication request, the client application prompts the user to input a personal identification number (PIN) or utilizes a biometric method to perform the User identity authentication. An electronic document authentication and authorization access method includes: initiating, by an application service module, a request for data access authorization of an electronic document to a browser; receiving, by a client application, the request provided by the browser Calling a card access module, and then the card access module performs authentication of the electronic certificate without performing authentication of the electronic certificate by an authentication service system; when the electronic certificate is authenticated, through a voucher management device Obtaining a data field of the selected authorization authority and storing it in one of the application service modules; Downloading a credential and a data field of the authorized authority in the credential area through a client connection module; and submitting the credential to the credential through the card access module connected to the client connection module The verification module verifies that the application service module reads the personal data of the user stored in the electronic certificate through the data field of the authorization authority according to the card access module. The method of claim 8, wherein the card access module authenticating the electronic certificate comprises the user entering a personal identification number (PIN) or using a biometric method. The method of claim 8, wherein the credential management device embeds the application service root credential into the electronic credential to verify the authenticity and legality of the authorization authority. The method of claim 8, wherein the electronic document is one of an identity card, a health insurance card, a driver's license, and a credit card.