CN111800509B

CN111800509B - Personal information access request system and method for applying same

Info

Publication number: CN111800509B
Application number: CN202010644164.3A
Authority: CN
Inventors: 丁晓强; 张仁卓
Original assignee: Beijing Shangyin Technology Co ltd
Current assignee: Beijing Shangyin Technology Co ltd
Priority date: 2020-07-07
Filing date: 2020-07-07
Publication date: 2022-07-01
Anticipated expiration: 2040-07-07
Also published as: CN111800509A

Abstract

The invention provides a personal information access request system and a method applying the system, wherein the system comprises a personal information access request unit, an agent unit and a service unit; the personal information access request unit provides a user information input and output interface of a personal information access request, the agent unit interacts with the personal information access request unit to provide for receiving of a personal information access request message, and the service unit interacts with the agent unit to provide for receiving of a personal information access request message. According to the personal information access request system, the personal information access request unit provides a uniform operation interface, the agent unit provides a one-stop personal information access request by providing a uniform access entrance, so that the operation of a requester is simplified, and efficient and transparent personal information access request service is provided for the requester.

Description

Personal information access request system and method for applying same

Technical Field

The invention belongs to the field of personal information processing, and particularly relates to a personal information access request system and a method for applying the same.

Background

With the rapid development of the internet, various internet services and mobile applications provide users with rich information and services. However, when these services are provided, the service providers also collect, process, analyze, and even share a lot of personal information of users, and become data controllers. In order to achieve transparency of personal data processing, related data protection laws and regulations are promulgated by many countries and regions, and a data controller is required to provide a personal information access request function for a user. The network security laws in china also require that network operators provide measures for users to delete or correct personal information.

Many of the existing data controllers do not provide a personal information access request function. For data controllers providing personal information access request functions, user operation interfaces provided by the data controllers are not uniform, the realized functions are not uniform, the data controllers are not convenient for user operation, the appeal of the personal information access requester cannot be fully met, and the legal and legal requirements are difficult to meet.

Disclosure of Invention

In order to solve the above problems and overcome the above drawbacks of the prior art, embodiments of the present application provide a method and a system for requesting personal information access, which are implemented by a computer, and are helpful to improve the processing efficiency of personal information access, improve the transparency of personal information processing, and ensure that the requirements of laws and regulations are met.

In one embodiment, the present invention provides a personal information access request system, the system comprising: the personal information access system comprises a personal information access request unit, an agent unit and a service unit; personal information access request unit: providing a user information input and output interface of a personal information access request, packaging input information of a requester into a personal information access request message, and sending the personal information access request message to the agent unit; receiving an access response and a notification message returned by the agent unit, and showing the access response and the notification message to a requester; the proxy unit: interacting with the personal information access request unit, and providing the receiving of a personal information access request message and the sending of a response message and a notification message; analyzing, preprocessing, packaging and distributing the messages from the personal information access request unit and the service unit; interacting with the service unit, and providing the receiving of the personal information access response message and the notification message and the sending of the personal information access request message; and a service unit: interacting with the agent unit, and providing the receiving of the personal information access request message and the sending of the response message and the notification message; according to the content in the personal information access request message, verifying the identity of the requester; the personal information access request is processed in an automatic or semi-automatic mode; preferably, the content in the request message is the requester type, the request type and the corresponding identification card information.

In one embodiment, the agent unit comprises an agent unit and personal information access request unit interface module, a message processing engine module, a service registration management module, an agent unit and service unit interface module; the agent unit and personal information access request unit interface module: providing a uniform access entrance for the personal information access request unit, interacting with the personal information access request unit, receiving a personal information access request message, and sending a response message and a notification message; the message processing engine module: analyzing, preprocessing, packaging and distributing messages from the agent unit and personal information access request unit interface module and the agent unit and service unit interface module, interacting with the service registration management module, and providing or inquiring service registration information from the service unit; a service registration management module: storage, updates and queries for providing service registration information from the service unit; the service registration module is also used for manually configuring a service provider, supported request types and corresponding service access address information so as to realize storage, update and query of service registration information of a service access module which does not support the initiation of a service registration request; and a proxy unit and service unit interface module: and providing a uniform access entrance for the service unit, interacting with the service unit, and providing the receiving of the service registration request message, the personal information access response message and the notification message and the sending of the service registration response message and the personal information access request message.

In one embodiment, the message processing engine module interacts with the service registration management module, verifies parameters carried in a personal information access request message, and carries one or more parameters related to identity authentication in a response message to require a requester to supplement identity authentication related information; and/or the message processing engine module is used for recording the message receiving and sending statistical information of the personal information access request unit and the service unit and calculating the related statistical indexes of the personal information access request.

In one embodiment, the service unit comprises a service access module, an identity authentication module and a personal information management module; a service access module: a service registration request is sent to the agent unit, so that the agent unit can conveniently route the personal information access request message to the service access module; receiving the personal information access request forwarded by the agent unit, and sending a personal information access response message and a notification message to the agent unit; sending an identity authentication request message to the identity authentication module, and receiving an identity authentication response message sent by the identity authentication module; sending a personal information processing request message to the personal information management module, and receiving a personal information processing response message sent by the personal information management module; an identity authentication module: providing personal information access identity authentication service, receiving an identity authentication request of the service access module, and returning an identity authentication result to the service access module; and a personal information management module: and receiving the personal information processing request message of the service access module, processing the personal information according to the content of the request message, and sending a personal information processing response message to the service access module.

In one embodiment, the service access module receives a notification feedback message forwarded by the proxy unit; summarizing the receiving and sending statistical information of the status inquiry message; and counting the notification feedback result conditions of each request type, and feeding back the counting result to the personal information management module.

In one embodiment, the identity authentication module verifies the identity of the requester according to the type of the requester, the request type and the corresponding identity authentication information in the personal information access request message.

In one embodiment, the personal information management module provides personal information processing of device information query, account information update and/or account information deletion.

In one implementation, the personal information management module receives a status query processing request message of the service access module, analyzes a transaction identifier in the message, searches for a corresponding personal information access request according to the identifier, and acquires a current processing status of the access request; according to the processing progress of the access request, adjusting the processing priority of the access request, and re-evaluating the predicted completion time for completing the subsequent processing; and sending a state query processing response message to the service access module, wherein the message carries a transaction identifier, the current processing state, the progress state and the predicted completion time of the personal information access request.

In one embodiment, the agent unit is independently deployed in a third party, the personal information access request unit is deployed on the terminal equipment, and the personal information access request unit is connected to a service unit of a service provider through the agent unit of the third party; or, the personal information access request unit and the agent unit are both deployed on the terminal device, and the personal information access request unit is directly connected to the service unit on the service provider device through the agent unit on the terminal device, preferably, the agent unit is deployed on the terminal device as a background service, or is integrated into the personal information access request unit in an SDK manner; alternatively, the agent unit and the service unit are both deployed on a device of the service provider of the service unit, and the personal information access request unit is directly connected to the agent unit of the service provider.

In one embodiment, the present invention provides a method of using the above system, the method comprising: the first stage, service registration process: before the agent unit receives the personal information access request message, the service unit initiates service registration to the agent unit, or the agent unit manually configures and/or actively discovers the service unit to ensure that the agent unit can select a proper service unit; and in the second stage, the routing and authentication process of the access request is as follows: the access request message sent by the personal information access request unit in the process is routed to the service unit through the proxy unit; in addition, the service unit performs identity authentication on the request message to ensure that the identity of the access request initiator is legal; and a third stage, personal information processing, notification and feedback flow: the process implements the processing of the personal information according to the access request, notifies the requester of the processing result, and receives a notification feedback message of the user.

In one embodiment, the first stage comprises the steps of: s101, a service access module of a service unit periodically initiates a service registration request to an agent unit, and provides a service provider, a supported request type and corresponding service access address information; s102, after receiving a service registration request message of a service access module, an agent unit and service unit interface module of the agent unit analyzes a service provider, a supported request type and corresponding service access address information in the message through a message processing engine module, records the state of the service access module as online, and stores the information into a service registration management module; and S103, the message processing engine module of the proxy unit constructs a response message, and sends a service registration response message to the service access module through the proxy unit and the service unit interface module.

In one embodiment, the second stage comprises the steps of: s104, the personal information access request unit initiates a personal information access request to the agent unit, and the personal information access request carries the necessary parameters and optional parameter information; s105, the agent unit and the personal information access request unit interface module of the agent unit receive the personal information access request message of the personal information access request unit, analyze the optional and optional request parameter information in the message through the message processing engine module, and inquire the service access address from the service registration management module according to the optional request parameter information; the service registration management module returns service access address information; s106, the agent unit and service unit interface module of the agent unit sends a personal information access request message to the service access module according to the inquired service access address information; s107, the service access module receives the personal information access request message sent by the agent unit, analyzes the identity authentication information in the message and sends the identity authentication request message to the identity authentication module; s108, the identity authentication module receives the identity authentication request message of the service access module, analyzes the identity authentication information in the message and carries out identity authentication processing; s109, the identity authentication module sends an identity authentication response to the service access module; s110, after receiving the identity authentication response message, the service access module constructs a personal information access response message and sends the personal information access response message to the agent unit; s111, after the service access module receives the successful identity authentication response message, constructing a personal information processing request message and sending the personal information processing request message to the personal information management module; and S112, the agent unit and service unit interface module of the agent unit receives the personal information access response message of the service access module and forwards the personal information access response message to the personal information access request unit through the agent unit and personal information access request unit interface module.

In one embodiment, the third stage comprises the steps of: s113, the personal information management module receives the personal information processing request message sent by the service access module, analyzes the message content, inquires the personal information processing flow according to the request type and the requester type, and processes the corresponding personal information; s114, after finishing the personal information processing, the personal information management module constructs a personal information processing response message and sends the personal information processing response message to the service access module; s115, the service access module receives the personal information processing response message sent by the personal information management module, analyzes the content of the response message and constructs a notification message; s116, the service access module sends a notification message to the agent unit; s117, the agent unit and the service unit interface module of the agent unit receive the notification message sent by the service access module and forward the notification message to the personal information access request unit through the agent unit and the personal information access request unit interface module; s118, after the personal information access unit receives the notification message sent by the agent unit, the personal information access unit analyzes the message content and displays the notification result to the user through the user interface; s119, an applicant can input feedback information on a user interface of the personal information access unit, and the personal information access unit constructs a notification feedback message and sends the notification feedback message to the agent unit; and S120, the interface module of the agent unit and the personal information access request unit of the agent unit receives the notification feedback message sent by the personal information access request unit and sends the notification feedback message to the service access module through the interface module of the agent unit and the service unit.

According to the personal information access request system, the personal information access request unit provides a uniform operation interface, the agent unit provides a one-stop personal information access request by providing a uniform access entrance, so that the operation of a requester is simplified, and efficient and transparent personal information access request service is provided for the requester. The agent unit in the personal information access request system can be deployed in a neutral third party, such as a personal information supervision organization, can better supervise the implementation of the personal information access request, and ensure that the personal right is fully guaranteed.

According to the personal information access request system, the personal information access request unit can send the personal information access request to the agent unit again, and the access request carries required content according to the requirement of the response message, for example, the information required by user identity authentication is carried through an accessory, such as a certificate scanning piece, a legal document electronic piece and the like; the personal information access request unit can also send a state query request message of the request message to query the acceptance progress state of the personal information access request; the personal information access request unit can also send a service feedback message, and submits a service evaluation feedback result and service suggestion content input by the requester to the service provider so as to improve service efficiency and service quality.

In the present invention, the request message includes one or more transactions; the mandatory request parameters contained in each transaction comprise a requester type, a request type and a service provider; the optional request parameters contained in each transaction include device information, requester identity information, request purpose, request content description, time range, and space range.

The personal information access request system can more accurately match personal information access requirements of the requester through the limitations of the optional request parameters such as requester type, request type, service provider and the like and the optional request parameters such as time range, space range, request purpose, request content description and the like, reduces the processing amount of the service system and improves the processing efficiency.

In the present invention, the requester type includes one of the following: a data body; a guardian of the data subject; an agent of the data body; other personal or private agencies (validated by law enforcement agencies); government and law enforcement agencies; a personal information monitoring authority; other requestors.

The personal information access request system provided by the invention can realize the processing of the personal information access request under different scenes by providing the selection of different requester types, and meet the requirements of different laws and regulations on the personal information access.

In the present invention, the request type includes one or more of the following: a device information query request; an account information query request; an account information updating request; an account information deletion request; an account locking request; an account unlocking request; an account delete request, etc.

The personal information access request system provides the processing of the personal information access request under different scenes for the requester by providing the selection of different request types, meets the requirements of different laws and regulations on the personal information access, and improves the transparency of the personal information processing.

The personal information access request system of the invention binds the equipment information and the personal information, solves the problem that the processing of the personal information access request can be realized under the scene that no account user uses the internet service, and improves the transparency of the personal information processing.

The personal information access request system of the present invention, the requester identity information includes: one or more identity types can be resident identity card, passport, social security number, military officer card, student card, employee's card; one or more identity marks are personal identification numbers of specific identity types; the one or more contact ways may be a mobile phone number, an electronic mailbox, a fixed phone number, a communication address.

The personal information access request system can verify the identity of the requester and the legality of the request by binding the identity information of the requester with other parameters in the request message, and prevent the personal information from being illegally acquired by the requester. The contact information can be used for verifying the identity of the requester and the validity of the request, and can also be used as a destination address for a subsequent requester to send a notification message to the service system.

In the personal information access request system, the service unit only needs to initiate service registration to the agent unit, and provides the service provider, the supported request type and the corresponding service access address information without configuring on the terminal equipment, so that the deployment of the whole system is simplified, the operation of a requester is simplified, and the processing efficiency of personal information access is improved.

In the personal information access request system, the service unit can carry the predicted processing completion time in the response message after receiving the personal information access request message, check the processing progress state of the current request message after receiving the state query request message, and improve the processing priority of the request message, accelerate the processing progress and improve the user experience if the processing progress is delayed.

In the personal information access request system, the proxy unit can record service registration information provided by different service providers, the supported request types and the corresponding service access address information are bound, and the terminal equipment only needs to be connected to the proxy unit with default setting, so that the operation of a requester is simplified, and the processing efficiency of personal information access is improved.

In the personal information access request system of the invention, the agent unit can preprocess the personal information access request message to ensure that only legal messages can be accessed to the service unit. For example, parameters carried in the request message are verified, an incomplete request message is intercepted in advance, and the incomplete request message is prevented from influencing normal service processing of the service unit; and limiting the rate initiated by each personal information access request unit, and preventing the personal information access request unit from initiating DOS or DDOS attack to the service unit.

In the personal information access request system, the agent unit can count the relevant information of the state query, including the number of state query requests, the number of query responses, the current processing state of the personal information access request, the progress state information and the predicted completion time information, and generate a relevant processing progress report. The information can be provided for a personal information supervision mechanism, so that the service quantity and the service efficiency of the personal information access request of each service provider can be known, and a decision basis is provided for policy making and rule adjustment of personal information supervision.

In the personal information access request system of the invention, the agent unit can count the notification feedback result condition of each service unit and each request type. The information can be provided for a personal information supervision organization, so that the quality of service and user evaluation of personal information access requests of various service providers can be known, and decision bases are provided for policy making and rule adjustment of personal information supervision.

In the personal information access request system of the present invention, the terminal device includes one or more input/output modules (e.g., a display screen, a touch screen, a keyboard, a mouse, or a voice input/output module), one or more processors, one or more memories, one or more programs; wherein one or more programs are stored in the memory.

Drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the embodiments will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments described in the present application, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without creative efforts.

FIG. 1 is an architecture diagram of a personal information access request system of the present invention;

FIG. 2 is an architecture diagram of a personal information access request system in a first exemplary deployment scenario of the present invention;

FIG. 3 is an architecture diagram of a personal information access request system in a second exemplary deployment scenario of the present invention;

FIG. 4 is an architecture diagram of a personal information access request system in a third exemplary deployment scenario;

FIG. 5 is a schematic flow chart of a personal information access request of the present invention;

FIG. 6 is a schematic flow chart of the request status query of the present invention.

Detailed Description

In order to make those skilled in the art better understand the technical solutions in the present application, the present invention will be further described below with reference to the following embodiments, and it is obvious that the described embodiments are only a part of the embodiments of the present application, and not all embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.

The terminal device in the embodiment of the application can be a mobile phone, a tablet computer, a wearable device, a vehicle-mounted device, an augmented reality/virtual reality device, a notebook computer, a personal computer, a netbook, a personal digital assistant, an intelligent sound box and other devices. The specific type of the terminal device is not limited in this embodiment.

The type of the personal information access request in the embodiment of the present application may be a device information query request, an account information update request, an account information deletion request, and the like, and the specific type of the personal information access request in the embodiment of the present application is not limited at all.

The requester type in the embodiment of the present application may be a data subject, a guardian of the data subject, an agent of the data subject, a government and law enforcement agency, etc., and the specific type of the personal information access request in the embodiment of the present application is not limited in any way.

Fig. 1 is a system architecture diagram according to an embodiment of the present application. As shown in fig. 1, the personal-information-access-requesting system includes a personal-information-access-requesting unit, a proxy unit, and a service unit.

Personal information access request unit: the interface module of the agent unit and the personal information access request unit is used for providing a user information input and output interface of a personal information access request, packaging input information of a requester into a personal information access request message and sending the personal information access request message to the agent unit of the agent unit; and receiving the access response and the notification message returned by the proxy unit and showing the access response and the notification message to the requester.

The proxy unit: interacting with the personal information access request unit, and providing the receiving of the personal information access request message and the sending of the response message and the notification message; analyzing, preprocessing, packaging and distributing messages from a personal information access request unit and a service unit; and interacting with the service unit, and providing the reception of the personal information access response message and the notification message and the transmission of the personal information access request message.

A service unit: interacting with the agent unit, and providing the receiving of the personal information access request message and the sending of the response message and the notification message; verifying the identity of the requester according to the requester type, the request type and the corresponding identity authentication information in the personal information access request message; and the personal information access request is automatically or semi-automatically processed, so that personal information processing such as equipment information inquiry, account information update, account information deletion and the like is realized.

The agent unit comprises an agent unit and personal information access request unit interface module, a message processing engine module, a service registration management module, an agent unit and service unit interface module.

The agent unit and personal information access request unit interface module: the method comprises the steps of providing a uniform access entrance for a personal information access request unit, interacting with the personal information access request unit, receiving a personal information access request message, and sending a response message and a notification message.

The message processing engine module: analyzing, preprocessing, packaging and distributing the information from the interface module of the agent unit and the personal information access request unit and the interface module of the agent unit and the service unit, interacting with the service registration management module, and providing or inquiring the service registration information of the service access module. In this embodiment, the message processing engine module may interact with the service registration management module, verify a parameter carried in the personal information access request message, and carry one or more parameters related to the identity authentication in the response message, and request the requester to supplement the information related to the identity authentication. The message processing engine is also used for recording the message receiving and sending statistical information of the personal information access request unit and the service unit; and calculating the related statistical indexes of the personal information access requests according to the average dimensionality of each terminal, each service unit and the whole.

A service registration management module: the system comprises a storage module, an update module and a query module, wherein the storage, the update and the query are used for providing service registration information of a service access module; and the system is also used for manually configuring the service provider, the supported request types and the corresponding service access address information so as to realize the storage, the update and the query of the service registration information of the service access module which does not support the service registration request.

The agent unit and service unit interface module: the method comprises the steps of providing a uniform access entrance for a service access module, interacting with the service access module, receiving a service registration request message, a personal information access response message and a notification message, and sending the service registration response message and the personal information access request message.

The service unit comprises a service access module, an identity authentication module and a personal information management module.

A service access module: a service registration request is sent to the agent unit, so that the agent unit can conveniently route the personal information access request message to the service access module; receiving the personal information access request forwarded by the agent unit, and sending a personal information access response message and a notification message to the agent unit; sending an identity authentication request message to an identity authentication module, and receiving an identity authentication response message sent by the identity authentication module; sending a personal information processing request message to the personal information management module, and receiving a personal information processing response message sent by the personal information management module.

Optionally, the service access module may further receive a notification feedback message sent by the personal information access request unit or forwarded by the agent unit; summarizing the receiving and sending statistical information of the status inquiry message; and counting the notification feedback result conditions of each request type, and feeding back the counting result to the personal information management module.

An identity authentication module: the identity authentication service for providing personal information access receives the identity authentication request of the service access module and returns an identity authentication result to the service access module. The identity authentication module in the embodiment of the application can verify the identity of the requester according to the requester type, the request type and the corresponding identity authentication information in the personal information access request message.

The personal information management module: the method comprises the steps of receiving a personal information processing request message of a service access module, processing personal information according to the content of the request message, and sending a personal information processing response message to the service access module.

Optionally, the personal information management module may further receive a status query processing request message of the service access module, analyze a transaction identifier in the message, search a corresponding personal information access request according to the identifier, and obtain a current processing status of the access request; according to the processing progress of the access request, adjusting the processing priority of the access request, and re-evaluating the predicted completion time for completing the subsequent processing; and sending a state query processing response message to the service access module, wherein the message carries the transaction identifier, the current processing state, the progress state and the predicted completion time of the personal information access request.

Fig. 2, fig. 3 and fig. 4 are architecture diagrams of a personal information access request system in three typical deployment scenarios provided by an embodiment of the present application. The main difference between these three deployment scenarios is the deployment location of the agent unit, which is deployed in the third party, the terminal device and the service provider.

As shown in fig. 2, the agent unit is independently deployed in a third party. The personal information access request unit is disposed on the terminal device and is connected to a service unit of the service provider through a proxy unit of a third party. Since the messages sent and received by the personal information access request unit contain sensitive personal information, and the messages need to pass through the proxy unit of the third party, the third party should be an authenticated and authorized trusted third party. In addition to the personal information access request unit, one or more service applications App 1-App n exist on the terminal equipment. The service applications provide information such as a service provider, equipment information, account information, time range, space range and the like for the personal information access request unit as input of the personal information access request. In the embodiment of the application, the service application may also call an interface of the personal information access request unit to initiate the personal information access request.

As shown in fig. 3, the proxy unit is deployed on the terminal device. The personal information access request unit is directly connected to the service provider through the agent unit of the terminal equipment provider. The agent unit can be deployed on the terminal device as a background service, and can also be integrated into the personal information access request unit in an SDK manner. Because the method does not need to pass through a third party, the privacy of the user can be well protected.

As shown in fig. 4, the proxy unit is deployed at a service provider. In this way, the personal information access request unit is directly connected to the agent unit of the service provider without passing through a third party, so that the privacy of the user can be well protected.

Fig. 5 is a schematic flow chart of a personal information access request method 100 provided in an embodiment of the present application, and as shown in fig. 5, the method 100 includes three stages:

the first phase is a service registration process. The proxy unit before receiving the personal information access request message, the service unit needs to initiate service registration with the proxy unit to ensure that the proxy device can select an appropriate service unit. Alternatively, for the case that the service unit does not support the service registration procedure, the information of the service unit may be manually configured on the proxy unit, or the proxy unit actively probes and discovers the service unit.

The second phase is the routing and authentication process of the access request. The process ensures that the access request message sent by the personal information access request unit is routed to the service unit through the proxy equipment; in addition, the service unit performs identity authentication on the request message to ensure that the identity of the access request initiator is legal.

The third phase is the personal information processing, notification and feedback process. The process implements the processing of the personal information according to the access request, notifies the requester of the processing result, and receives a notification feedback message of the user.

In the first stage, the processing procedure of the service registration flow is described as follows:

s101, a service access module of a service unit periodically initiates a service registration request to an agent unit, and provides a service provider, a supported request type and corresponding service access address information. Wherein, one service provider can correspond to a plurality of request types and a plurality of service access addresses.

Optionally, the service access module may carry a registration period in the service registration request message, indicating a registration duration of the service access module. Before the registration period expires, the service access module needs to initiate registration again with the proxy unit.

Optionally, the service access module may further carry a preset requester type, a request type, and corresponding identity authentication mode information in the service registration request message.

Illustratively, a service provider of a news content provider news company001 is news app. news company001.com, supported request types are account information query, account information update, account information deletion, and a service access address is https:// personalinfo.

S102, after the interface module of the agent unit and the service unit receives the service registration request message of the service access module, the information of the service provider, the supported request type, the corresponding service access address and the like in the message is analyzed through the message processing engine module, the state of the service access module is recorded as online, and the information is stored in the service registration management module.

Alternatively, the proxy element may record registration period information within the service registration request message. When the registration period expires, if the service access module does not initiate registration again, the proxy unit updates the state of the service access module to be offline.

Alternatively, the proxy unit may record the requester type, the request type and the corresponding authentication information in the service registration request message.

S103, the message processing engine module of the agent unit constructs a response message, and sends a service registration response message to the service access module through the interface module of the agent unit and the service unit.

Optionally, the proxy unit may carry the authentication parameters in the response message, and request the service access module to reinitiate the service registration request message, carrying the corresponding authentication information.

In the second stage, the processing procedure of the routing and authentication flow of the access request is described as follows:

and S104, the personal information access request unit initiates a personal information access request to the proxy unit, and the personal information access request carries the necessary parameters and the optional parameter information.

S105, the agent unit and the personal information access request unit interface module of the agent unit receive the personal information access request message of the personal information access request unit, analyze the optional and optional request parameter information in the message through the message processing engine module, and inquire the service access address from the service registration management module according to the optional request parameter information; the service registration management module returns service access address information.

Optionally, the message processing engine module of the agent unit may check whether the necessary parameter information in the personal information access request message is complete, and if not, may directly return a failure response message to the personal information access request unit, and carry a failure reason.

Optionally, the message processing engine module of the agent unit may further check optional parameter information in the personal information access request message, compare the optional parameter information with the requester type, the request type, and the corresponding identity authentication mode information recorded in the service registration management module, check whether the carried identity authentication information is complete, and if the carried identity authentication information is incomplete, directly return a failure response message to the personal information access request unit, and carry a failure reason.

Alternatively, the agent unit may limit the rate of personal-information-access-request messages initiated by each personal-information-access-request unit, preventing the personal-information-access-request unit from initiating DOS or DDOS attacks.

Exemplarily, the mandatory parameter information carried in the personal information access request message sent by the personal information access request unit includes that the requester type is a data body, the request type is an account information query, and the service provider is news app. And the message processing engine module of the agent unit extracts and checks the necessary parameter information, and inquires the service registration management module to obtain the service access address of https:// personalinfo.

And S106, the agent unit and service unit interface module of the agent unit sends a personal information access request message to the service access module according to the inquired service access address information.

S107, the service access module receives the personal information access request message sent by the agent unit, analyzes the identity authentication information in the message, and sends the identity authentication request message to the identity authentication module.

S108, the identity authentication module receives the identity authentication request message of the service access module, analyzes the identity authentication information in the message and carries out identity authentication processing.

S109, the identity authentication module sends an identity authentication response to the service access module.

Optionally, when the identity authentication fails, the identity authentication module may carry a failure reason in the identity authentication response message.

Optionally, when the identity authentication is successful, if the contact information of the user is stored in the identity authentication module before, in particular, when the mobile phone number or the email is stored, a message may be sent to the mobile phone number or the email to notify the user that the personal information access request has been submitted; the user may confirm or cancel the message after receiving it.

S110, after the service access module receives the identity authentication response message, the service access module constructs a personal information access response message and sends the personal information access response message to the agent unit.

Optionally, when the service access module receives the failed identity authentication response message, from the perspective of access control security, a general failure reason may be carried in the personal information access response message, so as to prevent a malicious user from continuously attempting and attacking.

Optionally, when the service access module receives a successful identity authentication response message, the expected completion time of the personal information access request may be carried in the response message, and the time may be set according to the request type and the requester type.

And S111, after the service access module receives the successful identity authentication response message, constructing a personal information processing request message and sending the personal information processing request message to the personal information management module.

And S112, the agent unit and service unit interface module of the agent unit receives the personal information access response message of the service access module and forwards the personal information access response message to the personal information access request unit through the agent unit and personal information access request unit interface module.

In the third stage, the processing procedure of the personal information processing, notification and feedback flow is described as follows:

s113, the personal information management module receives the personal information processing request message sent by the service access module, analyzes the message content, inquires the personal information processing flow according to the request type and the requester type, and processes the corresponding personal information.

For example, table 1 shows a personal information processing flow lookup table listing correspondence between request types and requester types and personal information processing flows. The personal information processing flow shown in table 1 is described by taking a data body requester as an example.

Table 1 personal information processing flow lookup table

The request type can be a known request type provided by a system such as an account information query request, an account information update request, an account information deletion request and the like, and other request types can also be selected and subjected to custom expansion.

The requester type can be a known requester type provided by a system such as a data body and the like, and other requester types can also be selected and subjected to custom expansion.

The personal information processing flow supports custom extensions. The service provider can specify the corresponding personal information processing flow aiming at different request types and requester type combinations according to the capability of the service unit and the personal information management requirement, and finally generate a personal information processing flow lookup table.

In the embodiment of the application, after the personal information processing system finishes the processing according to the flow of the lookup table, corresponding processing metadata information is recorded. Such as information relating to the type of personal information being processed, the amount of data, the time, etc.

And S114, after the personal information processing is finished, the personal information management module constructs a personal information processing response message and sends the personal information processing response message to the service access module.

Optionally, the response message may carry metadata information for personal information processing.

Optionally, the response message may carry link information of the personal information processing, such as a link for processing a report, a link for downloading the personal information, a link validity period, an access time limit, and the like.

According to the embodiment of the application, the risk of personal information leakage is reduced by providing the metadata information and setting the link validity period and the access times limit.

S115, the service access module receives the personal information processing response message sent by the personal information management module, analyzes the content of the response message and constructs a notification message.

Optionally, the notification message may carry metadata information for personal information processing.

Optionally, the notification message may carry link information of the personal information processing.

In the embodiment of the present application, in order to ensure the secure access of the personal information, when the user accesses the link information, the user needs to perform identity authentication again.

S116, the service access module sends a notification message to the proxy unit.

And S117, the agent unit and service unit interface module of the agent unit receives the notification message sent by the service access module, and forwards the notification message to the personal information access request unit through the agent unit and personal information access request unit interface module.

Alternatively, the agent unit may record statistical information related to the personal information access request, for example, count indexes such as an average processing time length of each request type, an average processing time length of each service access module, and an average number of personal information access requests per terminal.

For example, table 2 shows statistical information of personal-information access requests of each request type. The statistical information table shown in table 2 is described by taking the average processing time period statistical index as an example.

Table 2 statistical information table of personal information access requests

Type of request	Type of requester	Statistical index	Unit of	Statistical value
					Account information query request	Data body	Average processing duration	Hour(s)	97.68
Account information update request	Data body	Average processing duration	Hour(s)	75.21
					Account information deletion request	Data body	Average processing duration	Hour(s)	69.35

S118, after the personal information access APP receives the notification message sent by the agent unit, the content of the message is analyzed, and a notification result is displayed to the user through the user interface.

Illustratively, the method 100 further comprises:

s119, the applicant can input feedback information on a user interface of the personal information access APP, and the personal information access APP constructs a notification feedback message and sends the notification feedback message to the agent unit.

And S120, the interface module of the agent unit and the personal information access request unit of the agent unit receives the notification feedback message sent by the personal information access request unit and sends the notification feedback message to the service access module through the interface module of the agent unit and the service unit.

In the embodiment of the application, the agent unit may count the notification feedback result conditions of each service access module and each request type. The information can be provided for a personal information supervision organization, the service condition of the current personal information access request can be known, and decision basis is provided for supervision of the personal information.

In the embodiment of the application, the service access module can count the notification feedback result condition of each request type and feed the statistical result back to the personal information management module, so that a service provider can optimize a service unit and improve subsequent personal information access request service conveniently.

Fig. 6 is a schematic flow chart of a personal information access request method 200 according to an embodiment of the present application, which implements a processing status query on a submitted personal information access request, so that a requester can know the processing status of the access request in time. As shown in fig. 6, the method 200 includes:

s201, the personal information access request unit sends a state query request to the proxy unit, and the message carries a transaction identifier, service access address information and identity authentication information.

S202, the interface module of the agent unit and the personal information access request unit of the agent unit receives the state query request message of the personal information access request unit, analyzes the transaction identifier and the service access address in the message, and carries out routing according to the service access address.

S203, the interface module of the proxy unit and the service unit of the proxy unit forwards the status query request message to the service access address.

S204, the service access module receives the state inquiry request sent by the agent unit, analyzes the identity authentication information in the message and initiates an identity authentication request to the identity authentication module.

S205, the identity authentication module receives the identity authentication request message of the service access module, analyzes the identity authentication information in the message and carries out identity authentication processing.

S206, the identity authentication module sends an identity authentication response to the service access module.

It should be understood that the descriptions in S205-S206 may refer to the descriptions in S108-S109 described above.

For example, when the service access module receives the failed identity authentication response message, the service access module may send the failed status query response message to the proxy unit, and carry the failure reason in the message.

And S207, after receiving the successful identity authentication response, the service access module initiates a state query processing request to the personal information management module, and the message carries the transaction identifier.

S208, the personal information management module receives the state inquiry processing request message of the service access module, analyzes the transaction identifier in the message, searches the corresponding personal information access request according to the identifier, and acquires the current processing state of the access request.

Illustratively, the personal information management module, after obtaining the current processing state, compares it with the predicted progress state and evaluates the predicted completion time of the subsequent processing.

In the embodiment of the application, when the personal information management module compares with the predicted progress state, if the processing progress is delayed, the processing priority of the access request can be increased, and the predicted completion time for completing the subsequent processing can be re-evaluated.

S209, the personal information management module sends a status query processing result message to the service access module.

Illustratively, the personal information management module carries in the message a transaction identification, a current processing state, a progress state, and an expected completion time of the personal information access request.

S210, after receiving the status query processing result message sent by the personal information management module, the service access module analyzes the content in the message, constructs a status query response message, and sends the status query response message to the agent unit.

Illustratively, the service access module carries the transaction identifier, the current processing state of the personal information access request, and the expected completion time of the personal information access request in the message, and summarizes the receiving and sending statistical information of the status query message.

S211, the agent unit and the service unit interface module of the agent unit receive the status query response message of the service access module, analyze the transaction identifier in the message, find the corresponding personal information access request unit according to the transaction identifier, and forward the status query response message to the personal information access request unit through the agent unit and the personal information access request unit interface module.

In the embodiment of the application, the agent unit may count the relevant information of the status query, including the number of status query requests, the number of query response, the current processing status of the personal information access request, the progress status information, and the predicted completion time information, and generate a relevant processing progress report.

For example, table 3 shows a table of statistics for the status query. The statistical information shown in table 3 is illustrated in tabular form.

Table 3 statistical information table for status queries

Number of inquiry requests	123456	Number of inquiry and inquiry responses	122345
				Current processing state	Percent (%)	Current processing state	Percent (%)
Data discovery	10.5％	Discovery result review	9.7％
				Data update auditing	16.1％	Performing data updates	2.1％
Data deletion auditing	13.8％	Performing data deletion	5.9％
				Data archiving	6.7％	Generating a treatment report	13.2％
Report review	18.6％	Others	3.4％
				State of progress	Percent (%)	State of progress	Percent (%)
Is normal	40.6％	Is finished on time	38.4％
				Delay	8.3％	Over time to complete	12.7％

In the embodiment of the present application, the statistical information of the status query may also be displayed in other visual forms, such as a bar chart, a pie chart, a thematic map, and the like.

And S212, after receiving the state query response message, the personal information access request unit displays a state query result including the current processing state and the predicted completion time to the user.

It is to be understood that the invention disclosed is not limited to the particular methodology, protocols, and materials described, as these may vary. It is also to be understood that the terminology used herein is for the purpose of describing particular embodiments only, and is not intended to limit the scope of the present invention which will be limited only by the appended claims.

Those skilled in the art will also recognize, or be able to ascertain using no more than routine experimentation, many equivalents to the specific embodiments of the invention described herein. Such equivalents are also encompassed by the appended claims.

Claims

1. A personal information access request system, comprising: the personal information access system comprises a personal information access request unit, an agent unit and a service unit;

personal information access request unit: providing a user information input and output interface of a personal information access request, packaging input information of a requester into a personal information access request message, and sending the personal information access request message to the agent unit; receiving an access response and a notification message returned by the agent unit, and showing the access response and the notification message to a requester;

the proxy unit: interacting with the personal information access request unit, and providing the receiving of a personal information access request message and the sending of a response message and a notification message; analyzing, preprocessing, packaging and distributing the messages from the personal information access request unit and the service unit; interacting with the service unit, and providing the receiving of the personal information access response message and the notification message and the sending of the personal information access request message; and

a service unit: interacting with the agent unit, and providing the receiving of the personal information access request message and the sending of the response message and the notification message; according to the content in the personal information access request message, verifying the identity of the requester; and the personal information access request is processed in an automatic or semi-automatic mode.

2. The system of claim 1, wherein the content in the request message is a requester type, a request type and corresponding identification card information.

3. The system of claim 1, wherein the agent unit comprises an agent unit and personal information access request unit interface module, a message processing engine module, a service registration management module, an agent unit and service unit interface module;

the agent unit and personal information access request unit interface module: providing a uniform access entrance for the personal information access request unit, interacting with the personal information access request unit, receiving a personal information access request message, and sending a response message and a notification message;

the message processing engine module: analyzing, preprocessing, packaging and distributing messages from the agent unit and personal information access request unit interface module and the agent unit and service unit interface module, interacting with the service registration management module, and providing or inquiring service registration information from the service unit;

a service registration management module: storage, updates and queries for providing service registration information from the service unit; the service registration module is also used for manually configuring a service provider, supported request types and corresponding service access address information so as to realize storage, update and query of service registration information of a service access module which does not support the initiation of a service registration request; and

the agent unit and service unit interface module: and providing a uniform access entrance for the service unit, interacting with the service unit, and providing the receiving of the service registration request message, the personal information access response message and the notification message and the sending of the service registration response message and the personal information access request message.

4. The system of claim 3, wherein the message processing engine module interacts with the service registration management module to verify parameters carried in the personal information access request message and to carry one or more parameters related to the identity authentication in the response message, requiring the requester to supplement the identity authentication related information; and/or the message processing engine module is used for recording the message receiving and sending statistical information of the personal information access request unit and the service unit and calculating the related statistical indexes of the personal information access request.

5. The system of claim 1, wherein the service unit comprises a service access module, an identity authentication module, and a personal information management module;

a service access module: a service registration request is sent to the agent unit, so that the agent unit can conveniently route the personal information access request message to the service access module; receiving the personal information access request forwarded by the agent unit, and sending a personal information access response message and a notification message to the agent unit; sending an identity authentication request message to the identity authentication module, and receiving an identity authentication response message sent by the identity authentication module; sending a personal information processing request message to the personal information management module, and receiving a personal information processing response message sent by the personal information management module;

an identity authentication module: providing personal information access identity authentication service, receiving an identity authentication request of the service access module, and returning an identity authentication result to the service access module; and

the personal information management module: and receiving the personal information processing request message of the service access module, processing the personal information according to the content of the request message, and sending a personal information processing response message to the service access module.

6. The system of claim 5, wherein the service access module receives the notification feedback message forwarded by the proxy unit; summarizing the receiving and sending statistical information of the status inquiry message; and counting the notification feedback result conditions of each request type, and feeding back the counting result to the personal information management module.

7. The system of claim 5, wherein the identity authentication module verifies the identity of the requestor according to the requestor type, the request type, and the corresponding identity authentication information in the personal information access request message.

8. The system of claim 5, wherein the personal information management module provides personal information processing for device information query, account information update, and/or account information deletion.

9. The system of claim 5, wherein the personal information management module receives a status query processing request message of the service access module, parses a transaction identifier in the message, searches for a corresponding personal information access request according to the identifier, and obtains a current processing status of the access request; according to the processing progress of the access request, adjusting the processing priority of the access request, and re-evaluating the predicted completion time for completing the subsequent processing; and sending a state query processing response message to the service access module, wherein the message carries a transaction identifier, the current processing state, the progress state and the predicted completion time of the personal information access request.

10. The system according to any one of claims 1 to 9, wherein the agent unit is independently disposed in a third party, and the personal information access request unit is disposed in the terminal device and connected to the service unit of the service provider through the agent unit of the third party; alternatively, the agent unit and the service unit are both deployed on a device of the service provider of the service unit, and the personal information access request unit is directly connected to the agent unit of the service provider.

11. The system according to any one of claims 1 to 9, wherein said personal information access request unit and said agent unit are disposed on a terminal device, said personal information access request unit being directly connected to the service unit on the service provider device through the agent unit on the terminal device.

12. The system according to claim 11, wherein the agent unit is deployed on the terminal device as a background service or integrated into the personal information access request unit by means of SDK.

13. Method for applying a system according to any of claims 1-12, characterized in that the method comprises:

the first stage, service registration process: before the agent unit receives the personal information access request message, the service unit initiates service registration to the agent unit, or the agent unit manually configures and/or actively discovers the service unit to ensure that the agent unit can select a proper service unit;

and in the second stage, the routing and authentication process of the access request is as follows: the access request message sent by the personal information access request unit in the process is routed to the service unit through the proxy unit; in addition, the service unit performs identity authentication on the request message to ensure that the identity of the access request initiator is legal; and

and in the third stage, the personal information processing, notification and feedback process comprises the following steps: the process implements the processing of the personal information according to the access request, notifies the requester of the processing result, and receives a notification feedback message of the user.

14. The method of claim 13, wherein the first stage comprises the steps of:

s101, a service access module of a service unit periodically initiates a service registration request to an agent unit, and provides a service provider, a supported request type and corresponding service access address information;

s102, after receiving a service registration request message of a service access module, an agent unit and service unit interface module of the agent unit analyzes a service provider, a supported request type and corresponding service access address information in the message through a message processing engine module, records the state of the service access module as online, and stores the information into a service registration management module; and

15. The method according to claim 13, characterized in that the second phase comprises the steps of:

s104, the personal information access request unit initiates a personal information access request to the agent unit, and the personal information access request carries the necessary parameters and optional parameter information;

s105, the agent unit and the personal information access request unit interface module of the agent unit receive the personal information access request message of the personal information access request unit, analyze the optional and optional request parameter information in the message through the message processing engine module, and inquire the service access address from the service registration management module according to the optional request parameter information; the service registration management module returns service access address information;

s106, the agent unit and service unit interface module of the agent unit sends a personal information access request message to the service access module according to the inquired service access address information;

s107, the service access module receives the personal information access request message sent by the agent unit, analyzes the identity authentication information in the message and sends the identity authentication request message to the identity authentication module;

s108, the identity authentication module receives the identity authentication request message of the service access module, analyzes the identity authentication information in the message and carries out identity authentication processing;

s109, the identity authentication module sends an identity authentication response to the service access module;

s110, after receiving the identity authentication response message, the service access module constructs a personal information access response message and sends the personal information access response message to the agent unit;

s111, after the service access module receives the successful identity authentication response message, constructing a personal information processing request message and sending the personal information processing request message to the personal information management module; and

16. The method according to claim 13, characterized in that the third phase comprises the steps of:

s113, the personal information management module receives the personal information processing request message sent by the service access module, analyzes the message content, inquires the personal information processing flow according to the request type and the requester type, and processes the corresponding personal information;

s114, after finishing the personal information processing, the personal information management module constructs a personal information processing response message and sends the personal information processing response message to the service access module;

s115, the service access module receives the personal information processing response message sent by the personal information management module, analyzes the content of the response message and constructs a notification message;

s116, the service access module sends a notification message to the agent unit;

s117, the agent unit and the service unit interface module of the agent unit receive the notification message sent by the service access module and forward the notification message to the personal information access request unit through the agent unit and the personal information access request unit interface module;

s118, after receiving the notification message sent by the agent unit, the personal information access unit analyzes the message content and displays the notification result to the user through the user interface;

s119, an applicant can input feedback information on a user interface of the personal information access unit, and the personal information access unit constructs a notification feedback message and sends the notification feedback message to the agent unit;