WO2004054172A1 - A method of data protection for information provider - Google Patents

Abstract

The present invention discloses a method of data protection for information provider. It relates to the field of data security, adopts a data manage server to achieve management to applicant’s cordword: data manage server distributes a cordword to each applicant which is accredited by information provider, the data manage server accomplishes identity validation according to the cordword provided by applicant; the data manage server is also able to logout and modify the applicant’s cordword according to the indication of information provider. During accrediting, information provider only accredits the applicant at the data manage server, and distributing cordword to the applicant accomplished by data manage server, while information provider needn’t distribute cordword to the applicant by itself, so that accrediting process is improved. During validating, data manage server checks up and validates the applicant’s cordword when applicant sends access request to information provider, in order to improve applicant access efficiency to information provider.

Description

 Method for data protection of information provider

Technical field

 The invention relates to the field of data security, in particular to a method for data protection of an information provider. Background of the invention

 In the field of communications, password protection is usually adopted for the security protection of data such as information and resources at the information provider. An access password is assigned to each requester that needs to access information data. The requester must verify the access password before accessing the data of the information provider. The requester can only be accessed after the access password verification is passed. The access password If the authentication fails, the access of the requesting end is denied, that is, the access of the requesting end to the data of the information providing end is controlled by the protection of the access password to prevent illegal access and illegal access. Here, the information provider refers to the interviewee who provides certain information and resources, and the requester refers to the access terminal that points to the information provider to request access to its information, resources, and other data.

Specifically, in the location service (LCS, Location Service) of the mobile communication network, in the process of obtaining the geographic location of the information provider, the information provider needs the requester to provide an access password (cordword) to verify whether the requester is authorized. In the Rel 6 TS2071-610 specification of the Third Generation Partnership Project (3GPP), two access password authentication methods are proposed: One authentication method is that the information provider assigns an access password to each requester, and When requesting the geographic location of the information provider, the requester provides the access password to the mobile communication network, and the mobile communication network provides the access password along with the requested information to the information provider, and the information provider verifies the access password. This verification method is usually called Full-service management of the information provider. Another verification method is that the information provider registers the access password of each requester in advance on the mobile communication network, and the mobile communication network verifies the access password provided by the requester. This verification method is usually called a password verification service Management mode.

 At present, in the full-service management mode of the information provider, when the information provider authorizes and verifies the requester A, the information provider assigns an access password to the requester A, and notifies the request of the access password corresponding to the requester A When the requester A requests access to the data of the information provider, the requester A provides the access password to the supplier; when the access provider verifies the access password, the information provider assigns the access password provided by the requester A with itself to the request The access passwords of the terminal A are compared and checked. If they are the same, the access password is verified and the access request is accepted; otherwise, the access password is not verified and the access request is denied.

 In the full management mode of the information provider, the assignment, comparison, verification and management of access passwords are all done by the information provider. In this way, for a case where there are a large number of requesters, the information provider needs to allocate a large number of different access passwords to the requester, and needs to store the correspondence between each access password and the requester. For the modification and cancellation of the access password, it is also necessary for the information provider to allocate and manage the corresponding access password. The workload is large and it takes up a lot of storage resources at the information provider.

 In the password verification server management mode, the information provider assigns an access password to the requesting end B, and registers the access password in advance with the password verification server of the mobile communication network, and then the information providing end or the password verification server will request the access of the requesting end B. The password notifies the requesting end B; when the requesting end B requests to access the data of the information providing end, it provides its own access password to the password verification server. When the password verification server verifies the access password, the password verification server compares and checks the access password provided by the requesting end B with the access password corresponding to the requesting end B registered in advance by the information providing end. If they are consistent, the access password verification is performed. Pass and accept the access request; otherwise, the access password does not pass the verification and the access request is rejected.

The password authentication server described above is a server capable of storing different access passwords assigned by the information provider to different requesters, and capable of performing authentication based on the access passwords provided by the requester. The crypto face ID server can stand alone as a physical entity or as a physical entity. Functional modules are integrated in other entities.

 The password authentication server management method simplifies the access to the password insurance part of the information provider than the information provider's full management method, and the access password verification part is completed by the password verification server. However, the assignment and management of access passwords are also completed by the information provider. The information provider also needs to store the correspondence between each access password that has been assigned and the requester to avoid misuse. For the modification and cancellation of the access password, the information provider needs to allocate and manage the corresponding access password. It also has the problem of heavy workload on the information provider. Summary of the Invention

 In view of this, an object of the present invention is to provide a method for data protection of an information providing end, which centralizes the assignment, management, and security verification of an access password in a data management server, thereby realizing the improvement of the authorization verification mechanism.

In order to achieve the above-mentioned object, the present invention provides a method for data protection of an information provider. The present invention centrally completes the assignment, verification, and management operations of the access password of the requester through the data management server. During the entire process, the information provider only needs to authorize the requester on the data management server. The data management server will automatically assign an access password to each requester, and complete the authentication of the requester ’s identity and the access password. management. Therefore, the access password is completely transparent to the information provider. The information provider does not need to assign an access password to the requester by itself. The information provider does not need to know the content of the access password to complete the entire authorization process, which greatly simplifies the information provision. End authorization mechanism. When the requesting end sends an access request to the information providing end, the data management server checks and verifies the access password of the requesting end, thereby improving the efficiency of the requesting end's access to the data of the information providing end. Brief description of the drawings

 FIG. 1 is a schematic structural diagram of an authorization verification system according to the present invention;

 FIG. 2 is a flowchart of the authorization verification implementation of the data management server of the present invention. Mode of Carrying Out the Invention

 The present invention is described in detail below with reference to the drawings.

 The present invention improves the authorization verification mechanism by a method of allocating, verifying and managing access passwords performed by the data management server.

 FIG. 1 is a schematic structural diagram of an authorization verification system of the present invention, as shown in FIG. 1: The authorization verification system of the present invention is mainly composed of a requesting end 101, a data management server 102, and an information providing end 103.

 The data management server 102 refers to a server capable of allocating different access passwords and managing and verifying the access passwords according to the identifiers of different requesters 101 authorized by the information provider 103. The data management server 102 may stand alone as a physical entity, or may be integrated as a functional module in other entities.

The data management server 102 can be further divided into three parts in function: a random password generator 104, a data storage database 105, and a password validator 106. The random password generator 104 is used for randomly generating passwords, and requires using a certain standard algorithm to make the generated passwords different and irregular. The password generation algorithm used here can be arbitrarily selected, such as adding a random suffix based on the identity of the requesting end, and so on. The data storage database 105 is used to store the identifiers of the information providers 103, the identifiers of the requesters 101 corresponding thereto, the access passwords assigned by the random generator to the requesters 101, and the correspondence between the three. The password validator 106 is used to search the data storage database 105 for an access password corresponding to the current requester of an information provider, and compare and check the access password with the current access password provided by the current requester 101. It can be seen that the data management server 102 may be a newly set function in the authorization verification mechanism. The capable entity may also add a random password generator 104 part to the password verification server in the prior art. In this way, all the functions of the data management server 102 can be realized.

 In the present invention, the information providing end provides the data management server with a list of identifications of the requesting end. The identification of the requesting end may be information such as the name of the requesting end that can uniquely identify the requesting end, and is used to distinguish different requests corresponding to the information providing end. end. The random password generator in the data management server randomly assigns an access password to each requesting end according to a preset standard algorithm. For example, an algorithm for generating an access password based on the identification of the requesting end and a random suffix is used to ensure the access of each requesting end. The passwords are different and irregular. The data management server notifies the corresponding requester of the access password. The identification of the information providing end, the identification of each requesting end corresponding to the information providing end, the assigned access password, and the corresponding relationship between the three are stored in the data storage database of the data management server. When the requester requests data from the information provider, the requester provides the data management server with the identifier of the accessed information provider, the identifier of the requester, and the access password of the requester. The password validator in the data management server searches the data storage database for the access password of the requesting end corresponding to the information providing end, and compares and checks it with the access password provided by the requesting end of the information providing end. If they are the same, The requesting end passes password authentication, and the data management server notifies the requesting end to accept its access request. If the requesting end does not pass the password verification, the data management server notifies the requesting end of rejecting its access request.

 When the information provider needs to cancel the access passwords of some requesters, it only needs to provide the data management server with the requester ID list that needs to be canceled. The data management server automatically cancels the original access password of the corresponding requester according to the logout requester ID list, and notifies The corresponding requester. If these requesters use the original access password, they cannot pass the password verification and cannot access the information provider.

When the information provider needs to modify the access password of some requesters, it is only necessary to provide the data management server with the list of requester IDs that need to be modified. The data management server requests The client identification list automatically re-assigns the access password for the requesting end, and at the same time logs off the original access password of the corresponding requesting end. The data management server will then notify the corresponding requester of the modified access password. If these requesters use the original access password, they cannot pass the password verification and cannot access the information provider. These requesters can pass the password verification only by using the newly assigned access password to achieve access to the information provider.

 Taking a location service in a mobile communication network as an example, a data management server is set in the mobile communication network in advance. Then, when the requesting end obtains the geographic location of the information providing end, the data management server authorization verification process is shown in FIG. 2, where the authorization The verification process includes the following steps: Step 201 ~ Step 203: Authorization process. The information providing end provides the authorized requester identification list to the data management server of the mobile communication network; the random password generator in the data management server assigns an access password to each requesting end corresponding to the information providing end. The data storage database stores the identifier of the information provider, the identifier of each requester corresponding to the information provider, the assigned access password, and the relationship between the three; the data management server notifies the corresponding requestor of the assigned access password.

 Step 204 ~ Step 208: The verification process. The requesting end sends a request to the data management server of the mobile communication network to access the geographic location of the information providing end, and the requesting end provides the data management server with the identification of the accessed information providing end, the identification of the requesting end, and the access password of the requesting end; the password in the data management server The validator searches the data storage database for the access password of the requesting end corresponding to the information providing end, and compares and checks it with the access password provided by the requesting end corresponding to the information providing end. If they are consistent, the requesting end passes For password verification, the data management server notifies the requester to accept its access request; otherwise, the requester fails the password verification, and the data management server notifies the requester to reject its access request.

In this embodiment, when the information provider needs to cancel the access passwords of some requesters, it only needs to provide the data management server of the mobile communication network with the requester ID list that needs to be deregistered, and the data management server automatically deregisters according to the cancellation requester ID list. Corresponding request source Incoming access password, and notify the corresponding requester. If these requesters use the original access password, they cannot pass the password verification and cannot access the information provider.

 In this embodiment, when the information provider needs to modify the access password of some requesters, it only needs to provide the data management server of the mobile communication network with the requester identification list that needs to be modified, and the data management server automatically changes the requester identification list to The corresponding requesting end redistributes the access password and logs off the original accessing password of the corresponding requesting end. The data management server will notify the corresponding requester of the modified access password. If these requesters use the original access password, they cannot pass the password verification and cannot access the information provider. These requesters can use the newly assigned access password to pass the password verification and access the information provider.

 Of course, in practical applications, the authorization verification mechanism related to data security of the information provider according to the present invention can also be applied to other various communication systems.

 In short, the above descriptions are merely preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention.

Claims

Claim  1. A method for data protection of an information provider. When a requester wants to access data provided by the information provider, it must first verify its identity based on the access password. The method is characterized in that the method further includes:  A. A data management server is set in advance between the requesting end and the information providing end, and the data management server allocates an access password corresponding to each requesting end to each requesting end authorized by the information providing end;  B. When the requester accesses the information provider, the data management server set in step A verifies its identity according to the access password provided by the requester.  2. The method according to claim 1, wherein in step A, the data management server allocates an access password corresponding to each requesting end to each requesting end authorized by the information provider, further comprising: The requester ID list provided to it by the information provider, assigns each requester an access password corresponding to each requester, and notifies the corresponding requester of the access password; at the same time, the data management server stores the identifier of the information provider, the requester Identification and access password and the corresponding relationship between the three.  3. The method according to claim 1, wherein the step B further comprises:  Bl. When the requester requests access to the information provider data, it provides the data management server with the ID of the accessed information provider, the requester ID, and the access password of the requester; B2. The data management server searches for the access password of the requesting end corresponding to the information providing end in the information stored by the data management server, and compares it with the access password provided by the current requesting end. If they are the same, the requesting end uses the password. For verification, the data management server notifies the requesting end to accept its access request; otherwise, the requesting end fails the password verification, and the data management server notifies the requesting end to reject its access request. 4. The method according to claim 1, further comprising: when the information provider logs off the access password of the requester, the information provider provides the data management server with a list of identifications of the requesters that need to log out, and the data management server The cancellation requester identification list cancels the original access password of the corresponding requester, and notifies the corresponding requester.  5. The method according to claim 1, further comprising: when the information providing end changes the access password of the requesting end, the information providing end provides the data management server with a list of identifications of the requesting end to be modified, and the data management server according to the Modify the identification list of the requesting end to re-assign the access password to the corresponding requesting end, at the same time cancel the original access password of the corresponding requesting end, and notify the corresponding requesting end of the modified access password.  6. The method according to claim 1, wherein the step chicken A is: presetting data management including at least a random password generator, a data storage database, and a password validator between the requesting end and the information providing end. server.