TWI853750B - Proximity digital authorization sharing system, method and computer-readable medium combining selfie image - Google Patents

Abstract

The invention discloses a proximity digital authorization sharing system, method and computer-readable medium combining selfie image. A designator inspected device requests a digital identification cloud server to execute a sharing request to reply a share code, and notifies the share code to an assignee inspected device, and then the assignee inspected device submits the share code to the digital identification cloud server to request to download a digital authorization. Next, when the assignee wants to activate the digital authorization, the assignee completes capturing the assignee's selfie image through a selfie lens of the assignee inspected device, and uses a hash value of a file of the selfie image as part of sensing data, and the assignee inspected device and a proximity sensor machine double-sign the sensing data. The selfie image of the assignee captured by the selfie lens of the assignee inspected device will be used as proof of presence, so that the designator can use the selfie image to confirm that the assignee has indeed completed capturing the selfie image on-site at the proximity sensor machine.

Description

Near-end digital authorization sharing system, method and computer-readable medium combined with selfie images

The present invention relates to a near-end digital authorization sharing technology, and more particularly to a near-end digital authorization sharing system, method and computer-readable medium combined with selfie images.

Near Field Communication (NFC) technology used by general organizations (such as enterprises/companies/institutions/communities) to provide digital identity services for users has the following problems in various applications such as short-term users (such as visitors) and outsourced access control.

First, in order to correctly identify users, users are required to submit personal information sufficient to guarantee their true identity when joining the identification service. This requirement does not have a negative impact on users within an organization (such as a company) (such as full-time employees), but for short-term users who are not users within the organization (such as visitors), they must bear the risk of personal information leakage themselves, resulting in the risk of personal information leakage often becoming a key factor for short-term users to refuse to join the digital identification service.

Secondly, with digital identity service as the entrance, short-term users can use authorized applications (such as access control permissions) only after completing the identification. For short-term users who only need partial access control permissions (such as visitors), they need to go through the same complete process as users (such as full-time employees) within the organization (such as enterprises) to obtain this access control permission. This process is obviously too cumbersome for short-term users (such as visitors).

Furthermore, once the user's mobile phone is cracked, the data provided by the existing positioning technology in the detection module of the mobile phone cannot be trusted. Satellite positioning information can be forged on the user's mobile phone, and both wireless network and Bluetooth positioning can use the middleman attack method to create absent positioning. In the past, the known technology may use multiple positioning technologies such as satellite, wireless network and Bluetooth at the same time to avoid the fraud of a single positioning technology and solve the reliability problem, but the cost of using multiple positioning technologies such as satellite, wireless network and Bluetooth at the same time is very high and has its difficulties.

Therefore, how to provide an innovative near-end digital authorization sharing technology to solve any of the above problems and provide a related system or method has become a major research topic for technical personnel in this field.

The near-end digital authorization sharing system combined with self-portrait images described in the present invention includes: a digital identification cloud server; a delegator verified device, which requires the digital identification cloud server to execute a sharing request, so that the digital identification cloud server replies a sharing code to the delegator verified device; at least one dispatched verified device, which is a communication link to the delegator verified device, so that the delegator verified device notifies the digital identification cloud server of the sharing code replied to the dispatched verified device, and then the dispatched verified device submits the sharing code to the digital identification cloud server, so that the dispatched verified device uses the sharing code to request the digital identification cloud server to download the digital authorization; and a near-end sensor, which is a communication link The dispatchee is provided with a device for inspection, and the dispatchee holds the device for inspection close to the proximity sensor for proximity sensing. When the dispatchee wants to activate the digital authorization downloaded from the digital identification cloud server by the dispatchee's device for inspection, the dispatchee completes the capture of the dispatchee's selfie image through the selfie camera of the dispatchee's device for inspection, and uses the hash value of the selfie image file as part of the sensing data. The dispatchee's device for inspection and the proximity sensor both double-sign the sensing data, and the dispatchee's selfie image captured by the selfie camera of the dispatchee's device for inspection is used as a proof of presence, so that the delegator can confirm based on the selfie image that the dispatchee has indeed completed the capture of the selfie image at the proximity sensor.

The method for sharing near-end digital authorization combined with self-portrait images of the present invention comprises: a delegator's detected device requests a digital identification cloud server to execute a sharing request, so that the digital identification cloud server replies with a sharing code to the delegator's detected device; the delegator's detected device notifies the sharing code replied by the digital identification cloud server to at least one dispatched detected device, and then the dispatched detected device submits the sharing code to the digital identification cloud server, so that the dispatched detected device uses the sharing code to request the digital identification cloud server to download the digital authorization; and the dispatched person holds the dispatched detected device close to a near-end sensor. The dispatcher shall use the selfie camera of the dispatcher’s inspection device to capture the dispatcher’s selfie image when the dispatcher wants to activate the digital authorization downloaded from the digital identification cloud server by the dispatcher’s inspection device. The hash value of the selfie image file is used as part of the sensing data. The dispatcher’s inspection device and the near-end sensor both double-sign the sensing data. The dispatcher’s selfie image captured by the selfie camera of the dispatcher’s inspection device is used as a proof of presence, so that the delegator can confirm that the dispatcher has indeed completed the capture of the selfie image at the near-end sensor based on the selfie image.

The computer-readable medium of the present invention is applied to a computing device or a computer, and stores instructions to execute the aforementioned near-end digital authorization sharing method combined with selfie images.

Therefore, the present invention provides an innovative near-end digital authorization sharing system, method and computer-readable medium combined with self-portrait images, which provides a digital authorization sharing mechanism, that is, the delegator can delegate his own activated digital authorization to at least one (such as multiple) assignees, and this digital authorization sharing mechanism can be combined with the near-end sensor signature method of the assignee's self-portrait image, so that when the assignee activates the digital authorization, he must first completely capture the assignee's self-portrait image through the self-portrait camera of the assignee's verification device, so as to use the hash value of the self-portrait image file as part of the sensing data, and the assignee's verification device and the near-end sensor both double-sign the sensing data to ensure the integrity and credibility of the double-signed data.

In addition, the double signature of the present invention may refer to the signature of the sensor data by the dispatched person's verification device, and then the signature and the sensor data are signed by the proximal sensor, so that the double-signed data cannot be unilaterally modified by either the dispatched person's verification device or the proximal sensor, thereby ensuring the integrity and credibility of the double-signed data.

Furthermore, the present invention can provide the dispatched person with a self-portrait image taken during the sensing process as a concrete proof of presence, and can also enable the delegating person to effectively confirm based on the self-portrait image that the dispatched person has indeed completed the capture of the self-portrait image at the site of the proximal sensor.

In order to make the above features and advantages of the present invention more clearly understandable, the following examples are given and detailed descriptions are provided in conjunction with the attached drawings. The following description will partially explain the additional features and advantages of the present invention, and these features and advantages will be partially known from the description or can be learned through the practice of the present invention. It should be understood that both the general description above and the detailed description below are exemplary and explanatory, and are not intended to limit the scope of the present invention.

1: Near-end digital authorization sharing system

10: The delegate is inspected by the device

11: First Sense App

20: The assigned person is inspected for equipment

21: Second Sense Application

22: Selfie camera

30: Proximal sensor

31: Security element

32: Processing module

33: Proximal sensing module

40: Digital identification of cloud servers

41: Database

A: Delegator

B: Assignee

B1: Selfie image

C: User identification number

D: External communication channels

E: Share code

F: Proximal sensing channel

P1 to P5: Procedure

S11 to S13, S21 to S24: Steps

S31 to S36, S41 to S49: Steps

Figure 1 is a schematic diagram of the architecture of the near-end digital authorization sharing system combined with selfie images described in the present invention.

Figure 2 is a schematic diagram of the initialization process of the first sensing application and the second sensing application in the near-end digital authorization sharing method combined with the selfie image described in the present invention.

FIG3 is a schematic diagram of the process of executing the digital authorization sharing procedure in the near-end digital authorization sharing method combined with the selfie image described in the present invention.

FIG4 is a schematic diagram of the process of "composing a digital authorization activation notification" in the execution of the digital authorization activation procedure in the near-end digital authorization sharing method combined with selfie images described in the present invention.

FIG5 is a schematic diagram of the process of executing the digital authorization activation procedure in the near-end digital authorization sharing method combined with the selfie image described in the present invention.

The following describes the implementation of the present invention through a specific concrete implementation form. People familiar with this technology can understand other advantages and effects of the present invention from the content disclosed in this manual, and can also implement or use it through other different specific equivalent implementation forms.

FIG1 is a schematic diagram of the structure of the near-end digital authorization sharing system 1 combined with self-portrait images of the present invention. As shown in FIG1, the near-end digital authorization sharing system 1 combined with self-portrait images at least includes a delegator verification device 10 of a delegator A, at least one (such as multiple) delegate verification device 20 of a delegate B, at least one (such as multiple) near-end sensor 30 and at least one digital identification cloud server 40.

In one embodiment, the delegator A may be a long-term/permanent user, boss, full-time employee, conference organizer, resident, landlord, etc., and the assignee B may be a short-term/temporary user, outsourced employee, visitor, traveler, backpacker, etc., who does not have the authority. The delegator's inspected device 10 may be a mobile device (such as a smart phone), a computer (such as a tablet/laptop/desktop computer), a user device (such as a personal digital assistant PDA), etc., and the assignee's inspected device 20 may be a mobile device (such as a smart phone), a computer (such as a tablet/laptop), a user device (such as a personal digital assistant PDA), an image capture device (such as a digital camera), etc. The near-end sensor 30 may be a near field communication (NFC) sensor, a Bluetooth sensor, an ultra-wideband (UWB) sensor, a wireless network (Wi-Fi) sensor, etc., and the digital identification cloud server 40 may be a cloud server with a digital identification function, a cloud server host, etc.

Furthermore, the delegate's verified device 10 may have a first sensing application 11, the delegate's verified device 20 may have a second sensing application 21 and a selfie camera 22, the near-end sensor 30 may have a security element 31, a processing module 32 and a near-end sensing module 33, and the digital identification cloud server 40 may have at least one (e.g., multiple) databases 41.

In one embodiment, the first sensing application 11 or the second sensing application 21 may be sensing software, etc., the processing module 32 may be a processor, a processing chip, a processing circuit, a processing software, a processing program, etc., the proximal sensing module 33 may be a near field communication (NFC) sensing module, a Bluetooth sensing module, an ultra-wideband (UWB) sensing module, a wireless network (Wi-Fi) sensing module, etc., and the database 41 may be a digital authorization database, a user database, a sensing record database, a proximal sensor database, etc.

The term "at least one" in the present invention means more than one (such as one, two or three), "plurality" means more than two (such as two, three, four, ten or one hundred), "communication link" means communication or connection through various means such as data, signal, electrical, wired (such as wired network) or wireless (such as wireless network), and "organization" can be an enterprise, company, agency, institution, unit, community, etc. However, the present invention is not limited to those mentioned in the embodiments.

Specifically, the delegator A can share the activated digital authorization with the assignee B. That is, the delegator A can obtain the user identification number C of the assignee B through the delegator verified device 10, and request the digital identification cloud server 40 to execute the sharing request and reply through the first sensing application 11 of the delegator verified device 10 (see process P1 in FIG. 1 ). The reply (such as reply message) of the digital identification cloud server 40 to the delegator's verified device 10 may have a sharing code E, so that the delegator's verified device 10 of the delegator A notifies the sharing code E to the delegate's verified device 20 of the assignee B through an external communication channel D (such as email/SMS/Instant Message), and then the second sensing application 21 of the delegate's verified device 20 submits the sharing code E to the digital identification cloud server 40, so that the second sensing application 21 of the delegate's verified device 20 uses the sharing code E to request the digital identification cloud server 40 to download the digital authorization (see process P3 in Figure 1).

At this time, the digital authorization downloaded from the digital identification cloud server 40 to the dispatchee's inspection device 20 needs to be activated, and the second sensing application 21 can guide the dispatchee B to use the selfie camera 22 of the dispatchee's inspection device 20 to automatically capture the dispatchee B's selfie image B1, and then complete the sensing signature through the proximal sensing channel F between the dispatchee's inspection device 20 and the proximal sensor 30. The second sensing application 21 of the dispatcher's inspected device 20 executes uploading the sensing record (see process P4 in FIG. 1 ) to the digital identification cloud server 40 , and the sensing record forms a digital authorization activation notification, so that the digital identification cloud server 40 executes pushing the digital authorization activation notification and reply (see process P2 in FIG. 1 ) to the delegator's inspected device 10 of the delegator A.

Next, the delegator's verified device 10 transmits the delegator A's confirmation result of the digital authorization activation notification back to the digital identification cloud server 40, so that the digital identification cloud server 40 pushes the delegator A's activation decision (see process P5 in Figure 1) to the second sensing application 21 of the delegate's verified device 20 according to the confirmation result of the digital authorization activation notification, so that the second sensing application 21 of the delegate's verified device 20 can mark the digital authorization to activate or delete the digital authorization according to the delegator A's activation decision, whether to agree to activate or not.

In the near-end digital authorization sharing system 1 combined with self-portrait images of the present invention, when performing sensing identification, the dispatched person B can hold the dispatched person verification device 20 close to the near-end sensor 30 to perform near-end sensing. The security element 31 of the near-end sensor 30 can be used to store the decryption key and the sensor key, wherein the decryption key and the sensor key have been written into the security element 31 before the near-end sensor 30 leaves the factory, and the processing module 32 of the near-end sensor 30 can be used for decryption, signature verification and signing, etc. The proximal sensing module 33 of the proximal sensor 30 can be a near field communication sensing module using near field communication (NFC) technology, or a Bluetooth sensing module using Bluetooth technology, an ultra-wideband sensing module using ultra-wideband (UWB) technology, or a wireless network sensing module using wireless network (Wi-Fi) technology, so as to provide a wider sensing range.

The digital identification cloud server 40 can manage the digital authorizations of all delegators A and assignees B, the verified keys of delegators A and assignees B, and store (save) the sensing records at the same time. The digital identification cloud server 40 can also manage the proximal sensors 30, including managing the sensor keys and encryption and decryption keys of all proximal sensors 30. The above-mentioned records and management can be implemented through the database 41 of the digital identification cloud server 40. If the proximal sensor 30 is fixedly installed, the database 41 of the digital identification cloud server 40 can record the actual deployment location and administrator information of the proximal sensor 30.

For example, the database 41 of the digital identification cloud server 40 may include at least one digital authorization database, at least one user database, at least one sensor record database and/or at least one proximal sensor database, so that the digital authorization database stores or manages the digital authorizations of all users (such as the delegator A and the assignee B), the user database stores or manages the verified keys of all users (such as the delegator A and the assignee B), the sensor record database stores or manages the sensor records, and the proximal sensor database stores or manages the sensor keys and encryption keys of all proximal sensors 40.

The near-end digital authorization sharing system 1 combined with self-portrait images described in the present invention discloses a digital authorization sharing mechanism, that is, a user delegates his own activated digital authorization to another user (such as multiple users) as a delegator A, and the other user accepts the digital authorization delegated by the delegator A as the assignee B.

The present invention also discloses a method for combining this digital authorization sharing mechanism with the near-end sensing signature method of the self-portrait image B1 of the assignee B, that is, when the assignee B activates the digital authorization, he must first complete the capture of the self-portrait image B1 of the assignee B through the self-portrait lens 22 of the assignee's verification device 20, so as to use the hash value of the self-portrait image B1 file as part of the sensing data, and the sensing data is signed by both the assignee's verification device 20 and the near-end sensor 30 (such as double signature). In addition, the self-portrait image B1 file together with the sensing data and signature are uploaded to the digital identification cloud server 40 for storage after the sensing is completed.

The near-end sensing signature method of the self-portrait image B1 of the assignee B enables the delegator A to determine whether the activation of the digital authorization is effective by viewing the signed and reliable self-portrait image B1 provided by the assignee B when activating the digital authorization, and the self-portrait image B1 in the digital identification cloud server 40 can also serve as a valid proof of the authorization activation. The above design enables the delegator A to know the activation of the shared digital authorization in detail, and the self-portrait image B1 with signature guarantee can have a higher credibility when the sharing delegation record is reviewed.

In other words, one feature of the present invention is to provide a digital authorization sharing mechanism, that is, a delegator A (such as a user) can delegate his own activated digital authorization to at least one (such as multiple) assignees B (such as another user) through the delegator verification device 10. In addition, this digital authorization sharing mechanism can be combined with the near-end sensing signature method of the self-portrait image B1 of the dispatchee B, that is, when the dispatchee B activates the digital authorization downloaded from the digital identification cloud server 40, the dispatchee B must first complete the capture of the self-portrait image B1 of the dispatchee B through the self-portrait camera 22 of the dispatchee's verification device 20, so as to use the hash value of the self-portrait image B1 file of the dispatchee B as part of the sensing data, and the dispatchee's verification device 20 and the near-end sensor 30 both sign the sensing data (referred to as double signature). Subsequently, the self-portrait image B1 file together with the sensing data and the signature are uploaded to the digital identification cloud server 40 for storage after the sensing is completed. The function of this feature is to provide the dispatchee B with the self-portrait image B1 taken during the sensing as a specific proof of presence, so that the delegator A can effectively confirm based on the self-portrait image B1 that the dispatchee B has indeed completed the capture of the self-portrait image B1 at the site of the proximal sensor 30.

The present invention does not use other existing positioning technologies in the sensing data. The main consideration is that once the user's mobile phone is cracked, the data provided by the existing positioning technology in the detection module of the mobile phone cannot be trusted. Satellite positioning information can be forged on the user's mobile phone, and both wireless network and Bluetooth positioning can use the middleman attack method to create absent positioning. In the past, the known technology may rely on multiple positioning technologies such as satellites, wireless networks, and Bluetooth to avoid the falsification of a single positioning technology and solve the reliability problem, but its cost is obviously much higher than the present invention and it is more difficult. Therefore, the near-end sensing signature method of the self-portrait image B1 of the assignee B of the present invention is not only more cost-effective and highly reliable than the conventional technology, but also has a higher credibility because the self-portrait image B1 is guaranteed by the signature and has been personally (manually) confirmed by the assignor A.

Furthermore, another feature of the present invention includes a third-party user authentication service that is compatible with the Open Authorization (OAuth) standard, so that the delegator A and the assignee B can use the self-portrait image-combined near-end digital authorization sharing system 1 with their own trusted and commonly used account password authentication service. The effect of this feature is that it is easy to quickly expand the number of assignees B (users), and the delegator A can also provide security guarantees for assignee B simultaneously through the digital authorization sharing mechanism. Therefore, the above-mentioned features are suitable for serving assignee B (such as temporary users) and short-term authorization application scenarios, but are not limited to this.

That is, the present invention takes into account the assignee B (such as a short-term or temporary user) and the application case of short-term authorization, and designs a third-party user authentication service that is compatible with the open authorization (OAuth) standard, so that the assignee B can use the account password authentication service that he trusts and is accustomed to to use this near-end digital authorization sharing system 1 combined with self-portrait images. The effect of this feature is that the assignee B does not need to register an account separately, nor does he need to provide a password separately, and can directly become a user of the near-end digital authorization sharing system 1 combined with self-portrait images described in the present invention through the third-party user authentication service.

After the assignee B completes the authentication of the third-party user authentication service, the digital identification cloud server 40 of the present invention can obtain a user identification number C and a valid access token that can identify the assignee B, and the digital identification cloud server 40 can obtain the required personal information of the assignee B from the third-party user authentication service using the user identification number C and the valid access token, such as the personal information including name, birthday, email address and/or phone number, etc. Then, the digital identification cloud server 40 can create a record about the dispatchee B (user) and generate a verification key belonging to the dispatchee B. The digital identification cloud server 40 then sends the verification key of the dispatchee B to the second sensing application 21 of the dispatchee's verification device 20 to be stored (saved) in the dispatchee's verification device 20.

The specific digital authorization in the present invention is a data structure containing encrypted data and a signature, which is used to record the external near-end application services that can be used by the delegator A and/or the assignee B. The external near-end application service may refer to an external application service related to near-end sensing, and the external application service may be an application service that adopts near-field communication (NFC) technology or non-near-field communication (NFC) technology. For example, the external application service may be an access control application service, attendance application service, and conference registration application service that adopts near-field communication (NFC) technology, or an access control application service, attendance application service, and conference registration application service that adopts non-near-field communication (NFC) technology such as a two-dimensional barcode, Bluetooth, ultra-wideband (UWB), and wireless network (Wi-Fi). If a delegator A (user) has an activated digital authorization, the digital authorization will be automatically sent to the first sensing application 11 of the delegator verification device 10 of delegator A (user).

The specific digital authorization sharing in the present invention refers to the mechanism of authorization sharing between the delegator A and the assignee B. When the delegator A requests the digital identification cloud server 40 to share a certain digital authorization through the delegator verified device 10, the digital identification cloud server 40 will generate a sharing code E for the digital authorization to the delegator verified device 10 of the delegator A, and then the delegator verified device 10 of the delegator A will notify (inform) the assignee verified device 20 of the assignee B of the sharing code E of the digital authorization through the external communication channel D, so that the sharing code E of the digital authorization is used as the basis for the assignee verified device 20 of the assignee B to confirm the acceptance of the delegation to the digital identification cloud server 40. For example, the external communication channel D may include email, Short Message Service (SMS), instant messaging (such as Line or Messenger), etc.

This digital authorization is not immediately effective after being sent to the dispatchee's verification device 20. The dispatchee B needs to activate the digital authorization through the proximity sensing device 20. In this regard, the proximity sensing activation method of the digital authorization of the present invention is a proximity sensing signature method combined with the self-portrait image B1 of the dispatchee B. That is, when activating the digital authorization, the dispatchee B must first follow the guidance of the second sensing application 21 of the dispatchee's verification device 20 to complete the automatic capture of the dispatchee's self-portrait image B1 on the spot, so as to use the hash value of the self-portrait image B1 file as part of the sensing data, and the dispatchee's verification device 20 and the proximity sensor 30 both perform double signatures on the sensing data. The double signature of the present invention refers to the signature of the sentee's verified device 20, and then the signature and the sensing data are signed by the proximal sensor 30. The double-signed data cannot be unilaterally modified by either the sentee's verified device 20 or the proximal sensor 30, thereby ensuring the integrity and credibility of the double-signed data. After the double signature, the sentee's verified device 20 combines the file of the selfie image B1 with the sensing data to form a sensing record (such as activating the sensing record), so that after the sensing is completed, the sentee's verified device 20 (such as a mobile device) uploads the sensing record (such as activating the sensing record) to the digital identification cloud server 40 for storage.

The target of the aforementioned self-portrait image B1 of the dispatchee B is mainly the face of the dispatchee B, or the dispatchee B can also hold a physical document that can prove his identity (such as an ID card/health insurance card) for image capture, that is, the dispatchee verification device 20 simultaneously captures the face and physical document of the dispatchee B as the self-portrait image B1. If the dispatchee B holds a physical document in the self-portrait image B1, the dispatchee verification device 20 of the dispatchee B or its second sensing application 21 can use optical character recognition (OCR) technology to perform quality identification on the physical document of the dispatchee B.

In addition to completely capturing the face of the dispatchee B or including physical documents and other elements, the dispatchee B's selfie image B1 may also include sufficient on-site background of the dispatchee B, so that the dispatchee B's on-site background can be captured by the dispatchee B's inspection device 20 at the same time. In order to ensure the quality of the above selfie image B1, the second sensing application 21 of the dispatchee B's dispatchee inspection device 20 can also use the augmented reality (AR) image recognition technology based on artificial intelligence (AI) to guide the dispatchee B to adjust the hand-held angle of the dispatchee B's inspection device 20 (such as a mobile device), so that the second sensing application 21 of the dispatchee B's inspection device 20 can automatically capture the selfie image B1 of the dispatchee B that meets the system requirements.

When the digital identification cloud server 40 receives the sensing record of the dispatchee B (such as the sensing record is enabled), the digital identification cloud server 40 can send the notification of the sensing record of the dispatchee B (such as the sensing record is enabled) and the file of the self-portrait image B1 to the dispatcher verification device 10 of the delegator A. The dispatchee B uses the self-portrait image B1 during the sensing as a specific proof of presence, so that the delegator A who receives the notification can confirm whether the dispatchee B is at the site of the proximal sensor 30 through the self-portrait image B1 of the dispatchee B.

Then, the first sensing application 11 of the delegator's verified device A can ask the delegator A to confirm whether the current digital authorization activation notification is established. If the delegator A confirms that the current digital authorization activation notification is established, the current digital authorization sharing activation is completed, and the digital identification cloud server 40 notifies the second sensing application 21 of the delegate's verified device 20 of the assignee B to obtain the authorization content defined by the digital authorization; on the contrary, if the delegator A confirms that the current digital authorization activation notification is not established, the current digital authorization sharing activation is not completed, and the digital identification cloud server 40 notifies the second sensing application 21 of the delegate's verified device 20 of the assignee B to delete the digital authorization.

In addition, the method for near-end sensing signature of the self-portrait image B1 of the assignee B described in the present invention may include the following technical contents [1] to [5].

[1] The assignee B specifies the digital authorization. That is, (1) the assignee B selects a digital authorization through the second sensing application 21 of the assignee verification device 20. (2) The second sensing application 21 obtains the digital authorization identification serial number of the digital authorization and the corresponding digital authorization encryption data.

[2] The second sensing application 21 guides the dispatchee B to capture the dispatchee B's selfie image B1 (such as a selfie screen) through the selfie camera 22 of the dispatchee's inspection device 20. That is, (1) the second sensing application 21 turns on the selfie camera 22 of the dispatchee's inspection device 20 and displays the selfie screen of the selfie camera 22 on the screen of the dispatchee's inspection device 20. (2) The second sensing application 21 automatically captures the image screen containing the dispatchee B's face, or the physical certificate, or the scene background into at least one selfie image B1 file, and the image format or file of the selfie image B1 can be a still picture or a dynamic video file.

[3] The dispatched person B turns on the near-end sensing. That is, (1) the second sensing application 21 of the dispatched person's verified device 20 calculates the hash value of the self-portrait image B1 file using the self-portrait image B1 file. (2) The second sensing application 21 of the dispatched person's verified device 20 combines the digital authorization identification serial number of the digital authorization, the encrypted data, the hash value of the self-portrait image B1 file and the current time into sensing data, and then uses the dispatched person B's verified key to sign the sensing data to generate a verified signature.

[4] The assignee B holds the assignee verification device 20 to sense the proximal sensor 30. That is, (1) the second sensing application 21 prompts the assignee B to hold the assignee verification device 20, so that the assignee verification device 20 enters the effective communication range of the proximal sensing module 33 of the proximal sensor 30 to establish at least one proximal sensing channel F. (2) The sensing data and the verified signature obtained by the assignee verification device 20 are transmitted to the proximal sensor 30 through the proximal sensing channel F. (3) The proximal sensor 30 uses the decryption key to decrypt the digital authorization encrypted data in the sensing data. After the decryption is successful, the digital authorization content can be obtained. The proximal sensor 30 uses its sensor key to sign the sensing data, the verified signature and the sensor identification serial number to generate a master verification signature. (4) The proximal sensor 30 transmits the digital authorization content, sensor identification serial number and master verification signature back to the assigned verification device 20 via the proximal sensor channel F.

[5] The second sensing application 21 uploads the sensing record including the file of the self-portrait image B1. That is, (1) the second sensing application 21 of the dispatched person's inspection device 20 stores the digital authorization content in the digital authorization. (2) The second sensing application 21 of the dispatched person's inspection device 20 combines all the files of the self-portrait image B1, sensing data, verification signature, sensor identification serial number and master verification signature into a sensing record, and uploads the sensing record to the digital identification cloud server 40.

FIG. 2 is a schematic diagram of the initialization process of the first sensing application 11 and the second sensing application 21 in the near-end digital authorization sharing method combined with the selfie image described in the present invention, wherein the process may include the following steps S11 to S13, and refer to FIG. 1 for a description thereof.

First, the second sensing application 21 operates in the dispatched person's tested device 20, so that the second sensing application 21 prompts the dispatched person B to hold the dispatched person's tested device 20 close to the near-end sensor 30 to perform (operate) near-end sensing, and then the dispatched person's tested device 20 stores (saves) the sensing record of this near-end sensing. Then, the following steps S11 to S13 are executed.

Step S11: Use a third-party identity service to obtain third-party user identification information to establish a user digital identity, and generate user identification numbers C for both the delegator A and the assignee B. For example, the delegator A or the assignee B first inputs his/her personal information (such as name/birthday/email address/telephone number and other related information), and can use a third-party identity authentication service compatible with the open authorization (OAuth) standard. After logging into the third-party identity authentication service, the third-party user identification information and the third-party valid login token representing the validity of this login issued by the third-party identity authentication service are obtained, so that the first sensing application 11 of the delegator's verified device 10 and the second sensing application 21 of the assignee's verified device 20 can both establish the user's digital identity based on the third-party user identification information and the third-party valid login token and other data, and generate the user identification serial number C of both the delegator A and the assignee B.

Step S12: Submit the inspected device information (such as the inspected device identification serial number) of both the delegator's inspected device 10 and the assignee's inspected device 20 together with the user identification serial number C of both the delegator A and the assignee B to the digital identification cloud server 40.

Step S13: The digital identification cloud server 40 establishes the digital identity corresponding to the delegator A or the assignee B, and the first sensing application 11 of the delegator verification device 10 of the delegator A or the second sensing application 21 of the assignee verification device 20 of the assignee B queries the digital identification cloud server 40 to download the verification key and the activated digital authorization of the delegator A or the assignee B respectively from the digital identification cloud server 40.

FIG3 is a schematic diagram of the process of executing the digital authorization sharing procedure in the near-end digital authorization sharing method combined with the selfie image described in the present invention, wherein the process may include the following steps S21 to S24, and refer to FIG1 for explanation.

Step S21: Delegator A selects the external local application service to be shared and sets the sharing validity period and other options through the delegate tested device 10.

Step S22: The delegator A enters the user identification number C of the assignee B through the delegator verified device 10, so that the delegator verified device 10 sends a sharing request to the digital identification cloud server 40 according to the user identification number C of the assignee B (see process P1 in Figure 1), and then the delegator verified device 10 obtains the sharing code E indicating this sharing operation from the digital identification cloud server 40.

Step S23: The delegator's verified device 10 of the delegator A notifies the assigned person's verified device 20 of the assigned person B of the sharing code E through the external communication channel D. For example, the external communication channel D may include methods such as e-mail, short message service (SMS), and instant messaging to grant the assigned person B the right to use digital authorization.

Step S24: The dispatchee B requests the digital identification cloud server 40 to download the digital authorization by using the second sensing application 21 of the dispatchee's inspection device 20 and the sharing code E (see process P3 in Figure 1).

FIG. 4 is a schematic diagram of the process of "composing a digital authorization activation notification" in the execution of the digital authorization activation procedure in the near-end digital authorization sharing method combined with the selfie image described in the present invention, wherein this process may include the following steps S31 to S36, and refer to FIG. 1 for a description thereof.

Step S31: The dispatchee B specifies the digital authorization through the second sensing application 21 of the dispatchee's inspection device 20.

Step S32: The second sensing application 21 guides the dispatchee B to capture the dispatchee B's selfie image B1 (such as a selfie screen) through the selfie camera 22 of the dispatchee's inspection device 20. For example, this selfie image B1 can only be obtained by the dispatchee B on site through the selfie camera 22 of the dispatchee's inspection device 20 (selfie mode), and cannot be obtained by selecting other selfie images B1 not on site (such as the dispatchee B's selfie image B1 previously taken or stored by the dispatchee's inspection device 20).

Step S33: The second sensing application 21 of the dispatched person's inspected device 20 guides the dispatched person B to turn on the proximal sensing of the dispatched person's inspected device 20.

Step S34: The dispatchee B holds the dispatchee inspection device 20 to sense the proximal sensor 30.

Step S35: After the sensing is completed, the second sensing application 21 of the dispatched person's inspection device 20 will upload the sensing record including the file of the selfie image B1 to the digital identification cloud server 40 (see process P4 in Figure 1).

Step S36: The digital identification cloud server 40 combines (1) the file of the self-portrait image B1 of the dispatchee B, (2) the user information related to the user identification serial number C of the dispatchee B, and (3) the proximal sensor information related to the sensor identification serial number into a digital authorization activation notification. For example, the user information of the dispatchee B may include the personal information of the dispatchee B (such as name/birthday/email address/telephone number and other related information), and the proximal sensor information may include the name of the proximal sensor 30, the sensing time, the sensing location or the sensing code, etc.

FIG. 5 is a schematic diagram of the process of executing the digital authorization activation procedure in the near-end digital authorization sharing method combined with the selfie image described in the present invention. This process can be continued from step S36 of FIG. 4 above and includes the following steps S41 to S49, and refer to FIG. 1 for a description.

Step S41: The digital identification cloud server 40 pushes a digital authorization activation notification to the first sensing application 11 of the delegator's verified device 10 of delegator A.

Step S42: The first sensor application 11 of the delegate verification device 10 of the delegate A displays the self-portrait image B1 (such as a self-portrait screen) of the delegate B in the digital authorization activation notification, the user information related to the user identification serial number C of the delegate B, and the proximal sensor information related to the sensor identification serial number.

Step S43 to step S45: The first sensing application 11 of the delegator's detected device 10 obtains whether the delegator A agrees to activate the digital authorization. If yes (the delegator A's activation decision is to agree to activate the digital authorization), the first sensing application 11 of the delegator's detected device 10 returns the activation decision of the delegator A as "agree to activate the digital authorization" to the digital identification cloud server 40; otherwise, if no (the delegator A's activation decision is not to agree to activate the digital authorization), the first sensing application 11 of the delegator's detected device 10 returns the activation decision of the delegator A as "not to agree to activate the digital authorization" to the digital identification cloud server 40.

Step S46: The digital identification cloud server 40 pushes the activation decision of the delegator A, "agree to activate this digital authorization" or "disagree to activate this digital authorization", to the second sensing application 21 of the assigned person's detected device 20 of the assigned person B.

Step S47 to Step S49: If the activation decision of the delegator A is to agree to activate the digital authorization, the second sensing application 21 of the assigned person's detected device 20 of the assignee B marks the digital authorization as activated; on the contrary, if the activation decision of the delegator A is to disagree to activate the digital authorization, the second sensing application 21 of the assigned person's detected device 20 of the assignee B deletes the digital authorization.

At this point, according to the technical contents of Figures 3 to 5 above, the present invention has completed the digital authorization sharing procedure or digital authorization sharing mechanism.

In addition, the implementation of the above-mentioned digital authorization activation notification to the first sensing application 11 of the delegator's tested device 10 can specifically adopt a service that sends notifications to applications (Apps) through the cloud, such as cloud messaging services or push notification (PN) services. When the digital authorization sharing program is completed, regarding the confirmation of the digital authorization content, the second sensing application 21 of the delegator's tested device 10 can display the digital authorization content on the screen of the second sensing application 21 of the delegator's tested device 10 for the assignee B to confirm after activation.

The digital authorization may include a digital authorization identification serial number, digital authorization encrypted data and digital authorization content, and the digital authorization encrypted data will be decrypted into the digital authorization content only after the digital authorization is activated. In addition, the digital identification cloud server 40 can execute a digital authorization generation procedure, including: [1] combining at least one external proximal application service identification serial number, the user identification serial number C of the delegator A/the assignee B and the digital authorization validity period and other information into the digital authorization content; and [2] encrypting the digital authorization content with the encryption key of the proximal sensor 30 to generate digital authorization encrypted data, and generating a digital authorization identification serial number to represent the digital authorization encrypted data. The aforementioned external near-end application service identification serial number represents the external near-end application service that can be used after the digital license is activated. If the external near-end application service identification serial number is multiple, it means that multiple external near-end application services can be used after the digital license is activated.

The digital identification cloud server 40 can cooperate with the first sensing application 11 of the delegator's detected device 10 to execute the digital authorization sharing procedure. The first sensing application 11 of the delegator's detected device 10 sends a sharing request to the digital identification cloud server 40, so that the digital identification cloud server 40 generates a sharing code E for this sharing operation according to the sharing request, and then the digital identification cloud server 40 returns the sharing code E to the first sensing application 11 of the delegator's detected device 10, so that the first sensing application 11 of the delegator's detected device 10 can send the sharing code E to the assigned person's detected device 20. The digital identification cloud server 40 receives the sharing code E uploaded by the dispatched device 20 of the dispatched person B, and after confirming that the sharing code E uploaded (provided) by the dispatched person B is correct, the digital identification cloud server 40 notifies the dispatched device 20 of the dispatched device 20 to download the digital authorization corresponding to the sharing code E.

For example, "digital authorization" has many application forms, including digital authorization of digital ID cards or digital membership cards, such as: [1] digital ID cards are used to distribute digital temporary visitor cards, [2] digital ID cards are used to distribute outsourced ID cards, [3] digital membership cards are used to distribute shared spaces, etc., as explained below:

[1] Digital ID card issued as a digital temporary visitor card: Digital ID card issues a digital temporary visitor card in a digital authorization manner, so that the assignee B (such as a visitor) has the Near Field Communication (NFC) check-in and Near Field Communication (NFC) access control of the short-term meeting room. After obtaining authorization from the conference venue, a delegate A (such as a conference organizer) can use the digital ID card of the delegate A to share the use rights of the Near Field Communication (NFC) access control of the short-term meeting room with a digital temporary visitor card, and then delegate this digital temporary visitor card to the assignee B (such as a visitor). Unlike the delegator A (such as the conference organizer), the validity period of this digital temporary visitor card only needs to meet the meeting time requirements of the assignee B (such as the visitor). The assignee B (such as the visitor) needs to go through the activation procedure before using this digital temporary visitor card. The activation evidence of this digital temporary visitor card is the self-portrait image B1 (such as the self-portrait screen) taken by the assignee B (such as the visitor) when checking in at the venue of the conference to activate the near field communication (NFC) sensor as proof and notifying the delegator verification device 10 of the delegator A (such as the conference organizer) so that the delegator A (such as the conference organizer) completes the confirmation endorsement and records it in the system. This digital temporary visitor card can be used by the assignee B (such as a visitor) as a near field communication (NFC) access control for a short-term conference room after activation until its expiration date.

Taking the above-mentioned digital identification card distribution of digital temporary visitor card as an example, Figure 1 is used for explanation: the delegator A (such as the conference organizer) can share the activated digital authorization with the assignee B (such as the visitor), for example, this digital authorization is the use permission of the near field communication (NFC) access control of the short-term conference room. The delegator A (such as the conference organizer) obtains the user identification serial number C of the assignee B (such as the visitor) through the delegator verification device 10, and requests the digital identification cloud server 40 to execute the sharing request and reply through the first sensing application 11 of the delegator verification device 10 (see process P1 in Figure 1). The reply (such as a reply message) of the digital identification cloud server 40 may have a sharing code E, so that the delegator verified device 10 of the delegator A (such as the conference organizer) notifies the sharing code E to the delegate verified device 20 of the assignee B (such as the visitor) through the external communication channel D (such as email). The assignee B (such as the visitor) can submit the sharing code E to the digital identification cloud server 40 through the second sensing application 21 of the delegate verified device 20, so that the second sensing application 21 uses the sharing code E to request the digital identification cloud server 40 to download the digital authorization (see process P3 in Figure 1).

At this time, the digital authorization downloaded from the digital identification cloud server 40 to the dispatched person's inspection device 20 needs to be activated. The second sensing application 21 can guide the dispatched person B (such as a visitor) to automatically capture the dispatched person B's selfie image B1 through the selfie camera 22 of the dispatched person's inspection device 20, and then complete the sensing signature through the proximal sensing channel F between the dispatched person's inspection device 20 and the proximal sensor 30. The second sensing application 21 of the dispatched person's inspected device 20 executes uploading the sensing record (see process P4 in FIG. 1 ) to the digital identification cloud server 40 , and the sensing record forms a digital authorization activation notification, so that the digital identification cloud server 40 executes pushing the digital authorization activation notification and reply (see process P2 in FIG. 1 ) to the dispatched person's inspected device 10 of the delegator A (such as the conference organizer).

Next, the delegator's verified device 10 transmits the confirmation result of the delegator A (such as the conference organizer) on the digital authorization activation notification back to the digital identification cloud server 40, so that the digital identification cloud server 40 pushes the delegator A's activation decision (see process P5 in Figure 1) to the second sensing application 21 of the dispatchee's verified device 20 according to the confirmation result of the digital authorization activation notification, so that the second sensing application 21 of the dispatchee's verified device 20 can execute the marking activation or deletion of this digital authorization (such as the use right of the near field communication access control of the short-term conference room) according to the activation decision of the dispatchee B (such as the visitor). After this digital authorization is activated, the dispatchee B (such as a visitor) can download the relevant data of this usage permission on the dispatchee verification device 20 of the dispatchee B (such as a visitor) to enable the function of the near field communication (NFC) access control of the short-term conference room according to the usage permission of the near field communication (NFC) access control of the short-term conference room specified in the digital authorization content of this digital authorization, and then enter and exit the near field communication (NFC) access control of the short-term conference room within the validity period.

[2] Digital ID card distribution of outsourced ID cards: Digital ID cards are distributed through digital authorization, so that the assignee B (such as an outsourced employee) has the Near Field Communication (NFC) access control and attendance permissions of the organization (such as a company) within the validity period. After obtaining authorization from the organization (such as a company), a delegator A (such as a full-time employee) can use the digital ID card of delegator A to share the Near Field Communication (NFC) access control and attendance permissions he possesses into an outsourced ID card, and then delegate this outsourced ID card to assignee B (such as an outsourced employee). Unlike delegator A (such as a full-time employee), the validity period of this outsourced ID card only needs to meet the short-term needs of assignee B (such as a visitor). The dispatchee B (such as an outsourced employee) needs to go through the activation process before using this outsourced identification card. The activation evidence of this outsourced identification card is the self-portrait image B1 (such as a self-portrait screen) taken by the dispatchee B (such as an outsourced employee) when performing the near field communication (NFC) sensing for outsourced identification card activation at the site of the organization (such as an enterprise) as proof and notifying the dispatcher verification device 10 of the delegator A (such as a full-time employee) so that the delegator A (such as a full-time employee) can complete the confirmation and record it in the system. After the activation is completed until the expiration of the validity period, this outsourced identification card can be used by the dispatchee B (such as an outsourced employee) for access control attendance.

[3] Digital membership card distribution in shared spaces: Take the digital membership card as an example of digital authorization to share the near field communication (NFC) access control of shared spaces. A shared space management system (not shown) generates a digital membership card for this shared space and then assigns it to a delegator A (such as the lessee). After completing the activation process at the shared space, delegator A (such as the lessee) can use this digital membership card to enter and exit the shared space through the near field communication (NFC) access control. Delegator A (such as the lessee) can also submit a sharing request to the shared space management system, that is, to allow assignee B (such as a visitor) to enter and exit the shared space on his own. The delegator A (such as the lessee) can share his digital membership card with the assignee B (such as the visitor). The digital membership card of the assignee B (such as the visitor) is a short-term digital membership card with a shorter validity period. Before using this short-term digital membership card, the assignee B (such as the visitor) needs to go through the activation process, that is, submit the selfie image B1 (such as the selfie screen) taken by the assignee B (such as the visitor) when activating the near field communication (NFC) sensing on site as proof, and then the delegator A (such as the lessee) completes the confirmation endorsement and records it in the shared space management system. After the activation is completed until the expiration of the validity period, the assignee B (such as the visitor) can use this short-term digital membership card to enter and exit the near field communication (NFC) access control of the shared space.

In addition, the present invention also provides a computer-readable medium for a near-end digital authorization sharing method combined with a selfie image, which is applied to a computing device or a computer having a processor and a memory, and the computer-readable medium stores instructions, and the computing device or the computer can execute the computer-readable medium through the processor and the memory to execute the above content when executing the computer-readable medium. In one embodiment, the computer-readable medium is a non-transitory computer-readable storage medium.

In one embodiment, the processor may be a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MPU), a microcontroller (MCU), etc., the memory may be a random access memory (RAM), a read-only memory (ROM), a flash memory, a memory card, a hard drive (such as a cloud/network/external hard drive), an optical disk, a flash drive, a database, etc., and the computing device or computer may be a computer, a smartphone, a tablet computer, a personal computer, a laptop, a desktop computer, a server (such as a cloud/remote/network server), etc.

In summary, the near-end digital authorization sharing system, method and computer-readable medium combined with self-portrait images described in the present invention have at least the following characteristics, advantages or technical effects.

1. The present invention can provide a digital authorization sharing mechanism, that is, the delegator can delegate his/her activated digital authorization to at least one (or multiple) assignees, and this digital authorization sharing mechanism can be combined with the proximal sensing signature method of the assignee's selfie image, so that when the assignee activates the digital authorization, the selfie image of the assignee must be captured through the selfie camera of the assignee's verification device, and the hash value of the selfie image file is used as part of the sensing data. The sensing data is double-signed by both the assignee's verification device and the proximal sensor to ensure the integrity and credibility of the double-signed data.

2. The double signature of the present invention refers to the signature of the sensor data by the dispatched person's verification device, and then the signature and the sensor data are signed by the proximal sensor, so that the double-signed data cannot be unilaterally modified by either the dispatched person's verification device or the proximal sensor, thereby ensuring the integrity and credibility of the double-signed data.

3. The present invention can upload the self-portrait image file together with the sensing data and signature to the digital identification cloud server for storage after the sensing is completed, which is beneficial for providing the dispatched person with the self-portrait image taken during the sensing as a specific proof of presence, and also enables the delegator to effectively confirm that the dispatched person has indeed completed the capture of the self-portrait image at the site of the proximal sensor based on the self-portrait image.

4. The present invention can provide a near-end sensing signature method for the self-portrait image of the assignee, so that the delegator can determine whether the activation of the digital authorization is effective by viewing the signed and reliable self-portrait image provided by the assignee when activating the digital authorization. The self-portrait image in the digital identification cloud server can also be used as a valid proof of authorization activation. This design enables the delegator to specifically know the activation of the shared digital authorization, and the self-portrait image with signature guarantee can have a higher credibility when the shared delegation record is reviewed.

5. The present invention can provide a near-end sensing signature method for the self-portrait image of the dispatched person, which is not only cost-effective and highly reliable, but also has a higher credibility because the self-portrait image is guaranteed by the signature and is personally (manually) confirmed by the dispatcher.

6. The present invention can provide a third-party user authentication service that is compatible with the Open Authorization (OAuth) standard, so that the delegator and the assignee can use the account password authentication service that they trust and are accustomed to using to use this local digital authorization sharing system, so as to facilitate the rapid expansion of the number of assignees (users). The delegator can also provide security guarantees for the assignee simultaneously through the digital authorization sharing mechanism.

7. The invention is designed to be compatible with the third-party user authentication service of the open authorization (OAuth) standard, so that the assignee can use the account and password authentication service that he trusts and is accustomed to. It is beneficial for the assignee to become a user of this near-end digital authorization sharing system directly through the third-party user authentication service without having to register an account or provide a password.

8. The present invention can take into account the convenience of the assignee, allowing the assignee to use the digital identity service just like the principal. Through the sharing method with activation verification design, the entire execution process will be automatically recorded in the database of the digital identification cloud server, and the record contains the selfie image captured by the assignee at the time of sharing activation with a signature guarantee, so that the assignee can safely and quickly obtain the authority granted by the principal.

9. The industries to which this invention may be applied include, for example, enterprise digital parks, digital campuses, etc., and the products to which this invention may be applied include, for example, visitor management systems, conference check-in systems, shared offices, etc., but are not limited thereto.

The above implementation forms are only illustrative of the principles, features and effects of the present invention, and are not intended to limit the scope of implementation of the present invention. Anyone familiar with this technology can modify and change the above implementation forms without violating the spirit and scope of the present invention. Any equivalent changes and modifications completed using the content disclosed by the present invention should still be covered by the scope of the patent application. Therefore, the scope of protection of the present invention should be as listed in the scope of the patent application.

1: Near-end digital authorization sharing system

10: The delegate is inspected by the device

11: First Sense App

20: The assigned person is inspected for equipment

21: Second Sense Application

22: Selfie camera

30: Proximal sensor

31: Security element

32: Processing module

33: Proximal sensing module

40: Digital identification of cloud servers

41: Database

A: Delegator

B: Assignee

B1: Self-portrait image

C: User identification number

D: External communication channels

E: Share code

F: Proximal sensing channel

P1 to P5: Procedure

Claims (15)

A near-end digital authorization sharing system combined with self-portrait images, comprising: A digital identification of the cloud server; A delegator's verified device requests the digital identification cloud server to execute a sharing request, so that the digital identification cloud server replies with a sharing code to the delegator's verified device; At least one dispatcher's verified device is connected to the delegator's verified device in communication, so that the delegator's verified device notifies the digital identification cloud server of the shared code replied to the dispatcher's verified device, and then the dispatcher's verified device submits the shared code to the digital identification cloud server, so that the dispatcher's verified device can use the shared code to request the digital identification cloud server to download the digital authorization; and A proximity sensor is connected to the dispatched person's inspection device, and the dispatched person holds the dispatched person's inspection device close to the proximity sensor for proximity sensing. When the dispatched person wants to activate the digital authorization downloaded from the digital identification cloud server by the dispatched person's inspection device, the dispatched person uses the selfie camera of the dispatched person's inspection device to capture the dispatched person's selfie image. The hash value of the self-portrait image file is used as part of the sensing data. The dispatched person's verification device and the near-end sensor both double-sign the sensing data, and the dispatched person's self-portrait image captured by the self-portrait camera of the dispatched person's verification device is used as a proof of presence, so that the delegator can confirm based on the self-portrait image that the dispatched person has indeed completed the capture of the self-portrait image at the near-end sensor. As described in claim 1, the sensing application of the delegator's verified device requests the digital identification cloud server to execute the sharing request and reply with the sharing code, and the delegator's verified device notifies the sharing code to the delegate's verified device through an external communication channel, and then the sensing application of the delegate's verified device submits the sharing code to the digital identification cloud server, so that the sensing application of the delegate's verified device uses the sharing code to request the digital identification cloud server to download the digital authorization. As described in claim 1, the near-end digital authorization sharing system, wherein when the digital authorization downloaded from the digital identification cloud server to the dispatched person's verified device needs to be activated, the sensing application of the dispatched person's verified device guides the dispatched person to capture the dispatched person's selfie image with the selfie camera of the dispatched person's verified device, and then completes the sensing signature through the near-end sensing channel between the dispatched person's verified device and the near-end sensor, and the sensing application of the dispatched person's verified device executes uploading the sensing record to the digital identification cloud server, so that the digital identification cloud server executes pushing the digital authorization activation notification formed by the sensing record to the delegator's verified device. As described in claim 1, the proximal digital authorization sharing system, wherein the delegator's verified device further transmits the delegator's confirmation result of the digital authorization activation notification back to the digital identification cloud server, and the digital identification cloud server pushes the delegator's activation decision to the sensing application of the assignee's verified device based on the confirmation result of the digital authorization activation notification, so that the sensing application of the assignee's verified device can mark the digital authorization execution to activate or delete the digital authorization based on the delegator's activation decision, whether to agree to activate or not to activate. As described in claim 1, the digital identification cloud server further obtains the user identification serial number and valid access token that can identify the assignee, so that the digital identification cloud server obtains the required personal data of the assignee from the third-party user authentication service based on the user identification serial number and the valid access token, and the digital identification cloud server generates a verification key belonging to the assignee, and then the digital identification cloud server sends the verification key of the assignee to the sensor application of the assignee's verification device to store it in the assignee's verification device. As described in claim 1, the proximal digital authorization sharing system, wherein the dispatched person verification device simultaneously captures the dispatched person's face and a physical certificate that can prove the dispatched person's identity as the selfie image, so that the dispatched person verification device or its sensing application can use optical character recognition technology to perform quality identification on the physical certificate of the dispatched person. As described in claim 1, the proximal digital authorization sharing system, wherein the dispatched person's verification device simultaneously captures the dispatched person's face, a physical certificate that can prove the dispatched person's identity, and the dispatched person's on-site background as the self-portrait image, and then the dispatched person's verification device's sensing application uses artificial intelligence-based augmented reality image recognition technology to guide the dispatched person to adjust the hand-held angle of the dispatched person's verification device, so that the dispatched person's verification device's sensing application automatically captures the dispatched person's self-portrait image. A near-end digital authorization sharing method combined with self-portrait images, including: A delegator's verified device requests a digital identification cloud server to execute a sharing request, so that the digital identification cloud server responds with a sharing code to the delegator's verified device; The delegator's verified device notifies at least one assigned person's verified device of the shared code replied by the digital identification cloud server, and the assigned person's verified device then submits the shared code to the digital identification cloud server, so that the assigned person's verified device uses the shared code to request the digital identification cloud server to download the digital authorization; and The dispatched person holds the dispatched person's inspection device close to a proximity sensor for proximity sensing. When the dispatched person wants to activate the digital authorization downloaded by the dispatched person's inspection device from the digital identification cloud server, the dispatched person uses the selfie camera of the dispatched person's inspection device to capture the dispatched person's selfie image, and the hash value of the selfie image file is used as As part of the sensing data, the dispatched person's inspection device and the near-end sensor both double-sign the sensing data, and the dispatched person's self-portrait image captured by the self-portrait camera of the dispatched person's inspection device is used as a proof of presence, so that the delegator can confirm based on the self-portrait image that the dispatched person has indeed completed the capture of the self-portrait image at the near-end sensor. The near-end digital authorization sharing method as described in claim 8 further includes the dispatched person selecting the digital authorization through the sensing application of the dispatched person's detected device, so that the sensing application of the dispatched person's detected device obtains the digital authorization identification serial number and the corresponding digital authorization encryption data of the digital authorization, and then the sensing application of the dispatched person's detected device guides the dispatched person to capture the selfie image of the dispatched person through the selfie camera of the dispatched person's detected device. The near-end digital authorization sharing method as described in claim 8 further includes the step of calculating the hash value of the self-portrait image file using the self-portrait image file by the sensing application of the dispatched person's verified device, and then combining the digital authorization identification serial number of the digital authorization, the encrypted data, the hash value of the self-portrait image file and the current time into the sensing data by the sensing application of the dispatched person's verified device, so as to use the dispatched person's verified key to sign the sensing data to generate a verified signature. The proximal digital authorization sharing method as described in claim 8 further includes the dispatched person holding the dispatched person's verified device entering the effective communication range of the proximal sensing module of the proximal sensor to establish at least one proximal sensing channel, and transmitting the sensing data and the verified signature obtained by the dispatched person's verified device to the proximal sensor through the proximal sensing channel, and then the proximal sensor uses the decryption key to decrypt the digital authorization encrypted data in the sensing data to obtain the digital authorization content, so that the proximal sensor signs the sensing data, the verified signature and the sensor identification serial number with its sensor key to generate a master verification signature. The near-end digital authorization sharing method as described in claim 8 further includes the delegator selecting the external near-end application service to be shared and setting the sharing validity period through the delegator's verified device, so that the delegator's verified device sends the sharing request to the digital identification cloud server according to the user identification serial number of the assignee, and the delegator's verified device obtains the sharing code indicating this sharing operation from the digital identification cloud server, and then the delegator's verified device of the delegator notifies the delegate's verified device of the delegate through an external communication channel, so that the delegate uses the sensing application of the delegate's verified device to request the digital identification cloud server to download the digital authorization with the sharing code. The near-end digital authorization sharing method as described in claim 8 further includes the step of guiding the dispatched person to turn on the near-end sensing of the dispatched person's device by the sensing application of the dispatched person's device, so that the dispatched person senses the near-end sensor with the dispatched person's device, and then uploading the sensing record including the self-portrait image file to the digital identification cloud server by the sensing application of the dispatched person's device, so that the digital identification cloud server combines the self-portrait image file of the dispatched person, the user information related to the user identification serial number of the dispatched person, and the near-end sensor message related to the sensor identification serial number into a digital authorization activation notification. The near-end digital authorization sharing method as described in claim 8 further includes the digital identification cloud server pushing a digital authorization activation notification to the sensor application of the delegator's verified device, so that the sensor application of the delegator's verified device displays the selfie image of the assignee in the digital authorization activation notification, the user information related to the user identification serial number of the assignee, and the near-end sensor information related to the sensor identification serial number. A computer-readable medium, used in a computing device or a computer, stores instructions for executing a near-end digital authorization sharing method combined with a selfie image as described in any one of claims 8 to 14.

Images