CN1277366C - Method of information providing end data protection - Google Patents

Abstract

The invention discloses a data protection method for an information provider, which relates to the field of data security. A data management server is used to complete the management of the requester's access password: the data management server assigns an access password to each requester authorized by the information provider, and the data The management server performs identity verification according to the access password provided by the requester; the data management server can also log out and modify the access password of the requester according to the instructions of the information provider. In the authorization process, the information provider only needs to authorize the requester on the data management server, and the data management server completes the distribution of the requester's access password, and the information provider does not need to assign an access password to the requester by itself, so as to realize the authorization of the requester. Improvement of the authorization mechanism; in the verification process, when the requester sends an access request to the information provider, the data management server completes the verification and verification of the requester's access password to improve the access efficiency of the requester to the information provider's data.

Description

A method for protecting data at an information provider

technical field

The invention relates to the field of data security, in particular to a method for protecting data at an information provider.

Background technique

In the field of communication, password verification is usually adopted for the security protection of data such as information and resources at the information provider. Each requester that needs to access information data is assigned an access password. The requester must first verify the access password before accessing the information provider data. Only after the access password verification is passed can the requester be accessed. Access password If the verification fails, the access of the requesting end is rejected, that is, the access of the requesting end to the data of the information provider is controlled through access password protection to prevent illegal access and access. Here, the information provider refers to the interviewee who provides certain information and resources, and the requester refers to the access terminal that points to the information provider to request access to its information, resources and other data.

Specifically, in the location service (LCS, Location Service) of the mobile communication network, in the process of obtaining the geographic location of the information provider at the requesting end, the information provider needs the requesting end to provide an access password (cordword) to verify whether the requesting end is authorized. In the Rel 6TS2071-610 specification of the Third Generation Partnership Project (3GPP, Third Generation Partnership Project), two methods of verifying the access password are proposed: one method is that the information provider assigns the access password to each requesting end, and the location request At the same time, the requester provides the access password to the mobile communication network, and the mobile communication network provides the access password together with the request information to the information provider, and the information provider verifies the access password. This verification method is usually called the full authority management method of the information provider. . Another method is that the information provider registers the access password of each requester on the mobile communication network in advance, and the mobile communication network verifies the access password provided by the requester. This verification method is usually called password verification server management method.

At present, under the full management mode of the information provider, when the information provider authorizes and verifies the requester A, the information provider assigns an access password to the requester A, and notifies the requester of the access password corresponding to the requester A. When the requester A requests to access the data of the information provider, it provides its own access password to the information provider; when the information provider verifies the access password, it assigns the access password provided by the requester A and itself to the requester A The access passwords are compared and checked, and if they are consistent, the access password verification is passed and the access request is accepted; otherwise, the access request is rejected.

Under the full management mode of the information provider, the allocation, comparison, verification and management of access passwords are all completed by the information provider. In this way, for a large number of requesting ends, the information provider needs to assign a large number of different access passwords to the requesting ends, and needs to memorize the correspondence between each access password and the requesting end. For the modification and logout of access passwords, the information provider also needs to assign and manage the corresponding access passwords, which requires a large workload and occupies storage resources of the information provider.

In the password verification server management mode, the information provider assigns an access password to the requester B, and registers the access password on the password verification server in advance, and then the information provider or the password verification server notifies the requester of the access password of the requester B Terminal B; when the requesting terminal B requests access to the data of the information provider, it provides its own access password to the password verification server. When the password verification server performs access password verification, the password verification server compares and checks the access password provided by the requester B with the access password registered in advance by the information provider and corresponding to the requester B, and if they are consistent, the access password verification is passed. Accept the access request; otherwise, deny the access request.

The password verification server mentioned above is a server that can store different access passwords assigned by the information provider to different requesters, and can perform verification according to the access passwords provided by the requester. The password verification server can be independently formed as a physical entity, or can be integrated in other entities as a functional module.

The password verification server management method simplifies the access password verification part of the information provider compared with the full power management method of the information provider, and completes the access password verification part through the password verification server. However, the distribution and management of access passwords are also completed by the information provider, and the information provider also needs to memorize the corresponding relationship between each assigned access password and the requester, so as to avoid misuse. For the modification and logout of access passwords, the information provider also needs to assign and manage the corresponding access passwords, and there is also the problem of heavy workload at the information provider.

Contents of the invention

In view of this, the purpose of the present invention is to provide a method for data protection at the information provider, which centralizes the distribution, management and security verification of access passwords in the data management server, thereby improving the authorization verification mechanism.

In order to achieve the above object, the present invention provides a method for protecting data at an information provider, which is characterized in that the method includes:

A. Set up a data management server between the requester and the information provider in advance, and the information provider notifies the data management server of its authorized requester information, and the data management server assigns an access password to each requester authorized by the information provider , and notify the corresponding requester of the access password;

B. When the requester accesses the information provider, the data management server set in step A verifies its identity according to the access password provided by the requester.

Step A further includes:

A1. The information provider provides the data management server with a list of its authorized requester identifiers;

A2. The data management server assigns an access password to each requesting end, and notifies the corresponding requesting end of the access password; at the same time, the data management server stores the identity of the information provider, the identity of the requesting end, the access password and the correspondence between the three relation.

Step B further includes:

B1. When the requester requests access to the data of the information provider, provide the data management server with the identifier of the accessed information provider, the identifier of the requester and the access password of the requester;

B2. The data management server searches the information stored in itself for the access password of the requesting end corresponding to the information provider, and compares it with the access password provided by the current requesting end. If they are consistent, pass the password verification. Data management The server notifies the requesting end to accept its access request; otherwise, the data management server notifies the requesting end to reject its access request.

Preferably, the method further includes: when the information provider cancels the access password of the requester, the information provider provides the data management server with a list of requester identifiers that need to be canceled, and the data management server cancels the corresponding requester's original ID according to the cancellation requester identifier list. access password and notify the requesting end.

The method further includes: when the information provider modifies the access password of the requester, the information provider provides the data management server with a list of requester identifiers that need to be modified, and the data management server reassigns the access password for the corresponding requester according to the revised requester identifier list, At the same time, cancel the original access password of the requesting end, and notify the requesting end of the modified access password.

Step A further includes: presetting a data management server including a password random generator, a data storage database and a password verifier at the requesting end and the information providing end.

The invention centrally completes the distribution, verification and management operations of the access password of the requesting end through the data management server. In the whole process, the information provider only needs to authorize the requester on the data management server, and the data management server automatically assigns an access password to each requester, and completes the identification of the requester's identity and the management of the access password. Therefore, the access password is completely transparent to the information provider. The information provider does not need to assign an access password to the requester. Even the information provider does not need to know the content of the access password to complete the entire authorization process, which greatly simplifies the information Authorization mechanism on the provider side. When the requester sends an access request to the information provider, the data management server completes the checking and verification of the requester's access password, which improves the access efficiency of the requester to the information provider's data.

Description of drawings

Fig. 1 is a schematic structural diagram of the authorization verification system of the present invention;

Fig. 2 is a flow chart of the realization of authorization verification of the data management server of the present invention.

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings.

The invention improves the authorization verification mechanism through the method that the distribution, verification and management of access passwords are all completed by the data management server.

FIG. 1 is a schematic structural diagram of the authorization verification system of the present invention. As shown in FIG. 1 , the authorization verification system of the present invention is mainly composed of a requester 101 , a data management server 102 and an information provider 103 .

Wherein, the data management server 102 refers to a server that can allocate different access passwords according to different requester identifiers authorized by the information provider, and manage and verify the access passwords. The data management server 102 can be independently formed as a physical entity, or can be integrated in other entities as a functional module.

Functionally, the data management server 102 can be further divided into three parts: a password random generator 104 , a data storage database 105 and a password verifier 106 . The password random generator 104 is used for randomly generating passwords, requiring the use of a certain standard algorithm so that the generated passwords are different and irregular. The password generation algorithm used here can be selected arbitrarily, such as adding a random suffix according to the identification of the requesting end and so on. The data storage database 105 is used to save the identification of each information provider 103, the identification of the corresponding requesting end 101, the access password assigned by the password random generator for the requesting end 101, and the correspondence between the three. The password validator 106 is used to search the data storage database 105 for the access password corresponding to the requester of the current information provider, and compare it with the access password provided by the current requester 101 . It can be seen that the data management server can be a functional entity newly set in the authorization verification mechanism, or a password random generator part can be added to the password verification server in the prior art, so that all functions of the data management server can be realized. Function.

In the present invention, the information provider provides the data management server with a list of requester identifiers that need to be authorized. The requester identifier can be information that can uniquely identify the requester, such as the name of the requester, to distinguish the different requesters of the information provider. . The password random generator in the data management server randomly assigns an access password to each requester according to a preset standard algorithm. Different and irregular. The data management server notifies the corresponding requesting end of the access password. The identifier of the information provider, the identifier of each requester of the information provider and the assigned password, and the correspondence between the three are stored in the data storage database in the data management server. When the requester requests to access the data of the information provider, the requester provides the identifier of the accessed information provider, the identifier of the requester and the access password of the requester to the data management server. The password validator in the data management server searches the data storage database for the access password of the requester corresponding to the information provider, compares it with the access password provided by the requester of the information provider, and if they are consistent, then Through password verification, the data management server notifies the requesting end to accept its access request; if inconsistent, the data management server notifies the requesting end to reject its access request.

When the information provider needs to cancel the access passwords of some requesters, it only needs to provide the data management server with a list of requester identifiers that need to be cancelled, and the data management server will automatically cancel the original access passwords of the requester according to the logout list of requester identifiers, and notify the requesting end. If the requester uses the original access password, it will not be able to pass the password verification and cannot access the information provider.

When the information provider needs to modify the access passwords of some requesters, it only needs to provide the data management server with the list of requester identifiers that need to be modified, and the data management server will automatically re-allocate the access passwords for the requester according to the revised requester identifier list, and at the same time The requester's original access password is logged out. The data management server will notify the requesting end of the modified access password. Using the original access password, the requester cannot pass the password verification and cannot access the information provider. Only by using the newly assigned access password can the requester pass the password verification and access the information provider.

Taking the location service in the mobile communication network as an example, the data management server is set in advance in the mobile communication network, then, the authorization verification process of the data management server when the requester obtains the geographic location of the information provider is shown in Figure 2, including the following step:

Step 201-Step 203: Authorization process. The information provider provides its authorized requester ID list to the data management server of the mobile communication network; the password random generator in the data management server assigns an access password to each requester of the information provider, and the data storage in the data management server The database stores the identifier of the information provider, the identifier of each requester of the information provider, the assigned access password, and the corresponding relationship between the three; the data management server notifies the corresponding requester of the assigned access password.

Step 204-Step 208: verification process. The requester sends a request to the data management server of the mobile communication network to access the location of the information provider, and the requester provides the data management server with the identifier of the accessed information provider, the identifier of the requester and the access password of the requester; the password verification in the data management server The server searches the data storage database for the access password of the requester corresponding to the information provider, compares it with the access password provided by the requester of the information provider, and if they are consistent, pass the password verification, and the data management server The requesting end is notified to accept its access request; otherwise, the data management server notifies the requesting end to reject its access request.

In this embodiment, when the information provider needs to cancel the access passwords of some requesting terminals, it only needs to provide the requesting terminal identification list that needs to be canceled to the data management server of the mobile communication network, and the data management server will automatically cancel according to the cancellation requesting terminal identification list. The requester's original access password, and notify the requester. If the requester uses the original access password, it will not be able to pass the password verification and cannot access the information provider.

In this embodiment, when the information provider needs to modify the access passwords of some requesting ends, it only needs to provide the requesting end identification list that needs to be modified to the data management server of the mobile communication network, and the data management server will automatically modify the requesting end identification list according to the modification. The requester reassigns the access password, and cancels the original access password of the requester. The data management server will notify the requesting end of the modified access password. Using the original access password, the requester cannot pass the password verification and cannot access the information provider. Only by using the newly assigned access password can the requester pass the password verification and access the information provider.

Of course, in practical applications, the authorization verification mechanism related to the data security of the information provider proposed by the present invention can also be applied to other various communication systems.

In a word, the above descriptions are only preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention.

Claims (6)

1, a kind of information provides the method for end data protection, it is characterized in that this method comprises:

A, provide in request end and information data management server is set between the end in advance, information provides the request end information of its mandate of end notification data management server, distribute an access code by this data management server for each request end that information provides end to authorize, and notify corresponding request end this access code;

B, when the request end visit information provides when end, its identity is verified according to the access code that the request end provides by the data management server that steps A is set.

2, method according to claim 1 is characterized in that steps A further comprises:

A1, information provide end that the request end sign list of its mandate is provided to data management server;

A2, data management server distribute an access code for each request end, and notify corresponding request end with this access code; Simultaneously, the data management server stored information provides the corresponding relation between end sign, request end sign and access code and the three.

3, method according to claim 1 is characterized in that step B further comprises:

B1, when request end request visit information provides end data, provide the access code of sign, request end sign and this request end that accessed information provides end to data management server;

B2, data management server search the access code that the corresponding request end of end is provided with information in self canned data, the access code that itself and current request end are provided compares to be checked, if it is consistent, then by password authentification, data management server notifies this request end to accept its access request; Otherwise data management server notifies this request end to refuse its access request.

4, method according to claim 1, it is characterized in that this method further comprises: when information provides the access code of end de-registration request end, information provides end to provide the request end that needs to nullify to identify list to data management server, data management server is nullified the original access code of respective request end according to this de-registration request end sign list, and notifies this request end.

5, method according to claim 1, it is characterized in that this method further comprises: when information provides the access code of end modification request end, information provides end to provide the request end that needs to revise to identify list to data management server, data management server is redistributed access code according to this modification request end sign list for the respective request end, nullify the original access code in this request end simultaneously, and notify this request end amended access code.

6, method according to claim 1 is characterized in that steps A further comprises: provide in request end and information to set in advance the data management server that comprises cipher random generator, storage database and password verifier between the end.

Images