Resource sharing, access method, electronic device and computer readable storage medium

Abstract

The present application discloses a resource sharing and access method, an electronic device and a computer-readable storage medium, and relates to the field of computer technology. By obtaining an access request sent by a client and a second identification information of the client stored in advance, extracting a ciphertext identification in the access request, obtaining a first signature information and a first identification information according to the ciphertext identification, generating a second signature information based on the first identification information and the second identification information, comparing the first signature information and the second signature information, and obtaining an initial request of the client according to the access request if the first signature information and the second signature information are the same, obtaining an initial request of the client according to the access request, and sharing resources with the client, the security of the cloud platform and the client in the process of sharing resource capabilities can be guaranteed, and the problem of resource capability leakage can be prevented.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a resource sharing, access method, electronic device and computer-readable storage medium. Background Art

[0002] With the development of network technology, the business capabilities of its cloud platform have gradually become richer. The cloud platform can provide a variety of resources, namely business capabilities, for third-party client systems, such as MMS, weather forecasts, games, etc. Third-party clients access the cloud platform to obtain corresponding resources, namely business capabilities.

[0003] Cloud platforms bring together a large number of resource capabilities, so the security management of cloud platforms is very important. However, third-party clients can often access cloud platform resources arbitrarily. This access method can easily lead to the cloud platform being accessed by unknown and insecure third-party clients, resulting in security issues such as resource capability leakage on the cloud platform. Summary of the invention

[0004] The present application aims to solve at least one of the technical problems existing in the prior art. To this end, the present application proposes a resource sharing method that can ensure the security of the cloud platform and the client in the process of sharing resource capabilities and prevent the problem of resource capability leakage.

[0005] The present application also proposes a resource access method having the above resource sharing method.

[0006] The present application also proposes an electronic device having the above-mentioned resource sharing method and resource access method.

[0007] The present application also proposes a computer-readable storage medium having the above-mentioned resource sharing method and resource access method.

[0008] According to the first aspect of the present application, the resource sharing method includes:

[0009] Obtain an access request sent by a client; extract a ciphertext identifier in the access request; parse the ciphertext identifier to obtain first signature information and first identification information; generate second signature information based on the first identification information and pre-stored second identification information; compare the first signature information and the second signature information; if the first signature information and the second signature information are the same, obtain the initial request of the client according to the access request, and share resources with the client.

[0010] The resource sharing method according to the embodiment of the present application has at least the following beneficial effects: by obtaining an access request sent by a client and extracting a ciphertext identifier in the access request, obtaining first signature information and first identification information according to the ciphertext identifier, generating second signature information based on the first identification information and pre-stored second identification information of the client, comparing the first signature information and the second signature information, and if the first signature information and the second signature information are the same, obtaining the initial request of the client according to the access request, obtaining the initial request of the client according to the access request, and sharing resources with the client, the security of the cloud platform and the client in the process of sharing resource capabilities can be guaranteed, and the problem of resource capability leakage can be prevented.

[0011] According to some embodiments of the present application, the parsing of the ciphertext identifier to obtain the first signature information and the first identification information includes: decoding the ciphertext identifier to obtain encrypted information; and decrypting the encrypted information to obtain the first signature information and the first identification information.

[0012] According to some embodiments of the present application, it also includes: obtaining application information of the ciphertext identifier pre-stored in a database according to the ciphertext identifier; judging whether the ciphertext identifier is available according to the application information; if the ciphertext identifier is not available, not sharing resources with the client.

[0013] According to some embodiments of the present application, it also includes: obtaining timestamp information in the first identification information; judging whether the access request is valid according to the timestamp information; if the access request is invalid, not sharing resources with the client.

[0014] According to the resource access method of the second aspect embodiment of the present application, it includes: generating an initial request for requesting access to a server; generating a ciphertext identifier based on preset second identification information; generating an access request based on the ciphertext identifier and the initial request; and sending the access request to the server for resource access.

[0015] The resource access method according to the embodiment of the present application has at least the following beneficial effects: by generating an initial request for requesting access to a server, generating a ciphertext identifier according to preset second identification information, generating an access request according to the ciphertext identifier and the initial request, and sending the access request to the server for resource access, the security of the cloud platform and the client in the process of sharing resource capabilities can be guaranteed, and the problem of resource capability leakage can be prevented.

[0016] According to some embodiments of the present application, generating a ciphertext identifier based on preset second identification information includes: generating first signature information based on preset first identification information; encrypting the first signature information and the first identification information to generate encrypted information; encoding the encrypted information to generate encoded information; and generating the ciphertext identifier based on the encoded information.

[0017] According to some embodiments of the present application, the first identification information includes a sequence identifier and timestamp information; correspondingly, generating the first signature information based on the preset first identification information includes: encrypting and generating the first signature information based on the sequence identifier, the timestamp information and a preset system code.

[0018] According to some embodiments of the present application, encrypting and generating encrypted information according to the first signature information and the first identification information includes: generating the encrypted information according to the sequence identifier, the timestamp information and the first signature information.

[0019] An electronic device according to an embodiment of the third aspect of the present application includes: at least one processor, and a memory communicatively connected to the at least one processor; wherein the memory stores instructions, and the instructions are executed by the at least one processor so that when the at least one processor executes the instructions, the resource sharing method described in the first aspect and the resource access method described in the second aspect are implemented.

[0020] The electronic device according to the present application has at least the following beneficial effects: by executing the resource sharing method mentioned in the first aspect and the resource access method mentioned in the second aspect, the security of the cloud platform and the client in the process of sharing resource capabilities can be guaranteed, and the problem of resource capability leakage can be prevented.

[0021] According to the computer-readable storage medium of the fourth aspect embodiment of the present application, the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable a computer to execute the resource sharing method described in the first aspect and the resource access method described in the second aspect.

[0022] The computer-readable storage medium according to the present application has at least the following beneficial effects: by executing the resource sharing method mentioned in the first aspect and the resource access method mentioned in the second aspect, the security of the cloud platform and the client in the process of sharing resource capabilities can be guaranteed, and the problem of resource capability leakage can be prevented.

[0023] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 A schematic diagram of a process of a resource sharing method in an embodiment of the present application;

[0025] Figure 2 Another schematic diagram of the resource sharing method in the embodiment of the present application;

[0026] Figure 3 A flowchart of step S130 of the resource sharing method in the embodiment of the present application;

[0027] Figure 4 A schematic diagram of a process of a resource access method in an embodiment of the present application;

[0028] Figure 5 Another flowchart of step S220 of the resource access method in the embodiment of the present application;

[0029] Figure 6 This is a specific application example diagram of the resource sharing method and resource access method in the embodiments of the present application. DETAILED DESCRIPTION

[0030] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be understood as limiting the present application.

[0031] It should be noted that the logical order is shown in the flowchart, but in some cases, the steps shown or described can be performed in different orders in the flowchart. If there is a description of first and second, it is only for the purpose of distinguishing technical features, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features or implicitly indicating the order of the indicated technical features.

[0032] It should be noted that, unless otherwise specified, the singular forms of "a", "said" and "the" used in the embodiments are also intended to include plural forms, unless the context clearly indicates other meanings. In addition, unless otherwise defined, all technical and scientific terms used herein have the same meanings as those generally understood by those skilled in the art. The terms used in this specification are only for describing specific embodiments, not for limiting this application. The term "and / or" used herein includes any combination of one or more related listed items.

[0033] With the development of network technology, the business capabilities of its cloud platform have gradually become richer. The cloud platform can provide a variety of resources, namely business capabilities, for third-party client systems, such as MMS, weather forecasts, games, etc. Third-party clients access the cloud platform to obtain corresponding resources, namely business capabilities.

[0034] Cloud platforms bring together a large number of resource capabilities, so the security management of cloud platforms is very important. However, third-party clients can often access cloud platform resources arbitrarily. This access method can easily lead to the cloud platform being accessed by unknown and insecure third-party clients, resulting in security issues such as resource capability leakage on the cloud platform.

[0035] Based on this, the embodiments of the present application provide a resource sharing and access method, an electronic device and a computer-readable storage medium, which can ensure the security of the cloud platform and the client in the process of sharing resource capabilities and prevent the problem of resource capability leakage.

[0036] It should be noted that the client mentioned in the embodiment of the present application is a third-party client system, which is used to access resources; the server, namely the cloud platform, is used to manage the resource capabilities and resource information it owns, and can share the resource capabilities and resource information with the connected client, namely the third-party system.

[0037] In a first aspect, an embodiment of the present application provides a resource sharing method applied to a server.

[0038] In some embodiments, reference Figure 1 , shows a schematic diagram of the process of the resource sharing method in the embodiment of the present application. It specifically includes the steps:

[0039] S110, obtaining an access request sent by the client;

[0040] S120, extracting the ciphertext identifier in the access request;

[0041] S130, parsing the ciphertext identifier to obtain first signature information and first identifier information;

[0042] S140, generating second signature information based on the first identification information and pre-stored second identification information;

[0043] S150, comparing the first signature information and the second signature information to see whether they are the same;

[0044] S160: If the first signature information and the second signature information are the same, obtaining the initial request of the client according to the access request, and sharing resources with the client.

[0045] In step S110, the server intercepts the access request sent by the client through the service gateway to obtain the second identification information pre-stored in the database of the server. The access request refers to the HTTP (HyperText Transfer Protocol) request generated by the client in the form of URL (Uniform Resource Locator), which is used to request the resource capabilities to be accessed by the client. The client sends the HTTP request to the server through the service interface connected to the server, and the service gateway of the server intercepts and obtains it. The second identification information refers to the system information of the client currently connected to the service interface for resource request, including the system code of the client, the encryption key used by the client, and the validity period of the client's access request; the system code is the unique identity information assigned to the client by the server, that is, the identity information of the current client, which is used by the server to identify the current client; the encryption key is the key used by the client in the process of generating the access request, which can be used to encrypt the request. In actual applications, the encryption key can be negotiated and adjusted by the client and the server; the validity period is the effective time of the access request of the client to request the resource. If it exceeds the preset validity period, the client needs to regenerate the access request to access the resource.

[0046] In step S120, after receiving the access request, the server will extract the ciphertext identifier of the access request, wherein the ciphertext identifier is the parameter information carried in the access request of the client, and the parameter information is generated by the client after encryption processing. In actual applications, the ciphertext identifier exists as a parameter of the HTTP request. For example, the parameter carried in the access request of the client is "sig=syscode$ciphertext identifier", wherein sig is the name of the parameter information; syscode is the system code of the client, which can be provided to the server to confirm the identity of the client; the ciphertext identifier is the information obtained by the server extracting the access request. In actual applications, after the client sends the access request through the service interface, the service gateway of the server can directly obtain the parameter information of the specified parameter name through the parameter acquisition method provided by the preset HTTP request after receiving the access request. For example, the preset parameter acquisition method: request.getParameter("sig") can be used to obtain the parameter information of the parameter name sig, that is, the parameter information can be obtained, and the ciphertext identifier that needs to be extracted can be obtained through the parameter information, and the extraction of the ciphertext identifier can be completed.

[0047] In some embodiments, Figure 2 As shown, after the server extracts the ciphertext identifier, the server further includes the following steps:

[0048] S121, obtaining application information of the ciphertext identifier pre-stored in the database according to the ciphertext identifier;

[0049] S122, judging whether the ciphertext identifier is available according to the application information;

[0050] S123: If the ciphertext identifier is not available, resources are not shared with the client.

[0051] In step S121, after the server extracts the ciphertext identifier, it will verify whether the ciphertext identifier is available, specifically by obtaining the application information corresponding to the ciphertext identifier pre-stored in the database, wherein the application information is the usage information of the ciphertext identifier or the available information of the ciphertext identifier, such as the number of times the ciphertext identifier is used or whether the ciphertext identifier has been used or not; the database refers to a database formed based on Redis (RemoteDictionary Server, remote dictionary service), in which application information corresponding to different access requests from different clients is pre-stored. In actual applications, when the client generates a ciphertext identifier, the application information corresponding to the ciphertext identifier will be stored in the Redis database, and the server can also connect to the Redis database, so when the server obtains the ciphertext identifier, the corresponding application information can be obtained from the Redis database.

[0052] In step S122, the server determines the availability of the ciphertext identifier based on the obtained application information to determine whether the ciphertext identifier is available, wherein whether it is available is specifically determined by the application information. For example, when the application information records that the ciphertext identifier has been used, it means that a client has used the ciphertext identifier to access resources; when the application information records that the ciphertext identifier has not been used, it means that no client has used the ciphertext identifier to access resources.

[0053] In step S123, if the application information records that the ciphertext identifier has been used, it means that the ciphertext identifier cannot be used, and the server will refuse to share resources with the client. Specifically, the server determines whether the client's resource access is a safe access by determining whether the ciphertext identifier in the access request is an unused ciphertext identifier. If it has been used, the server determines that the client's access request is an unsafe request and refuses to share resources with the client.

[0054] It should be noted that in the embodiment of the present application, by judging whether the ciphertext identifier is available, it can be determined through application information, and to determine whether the ciphertext identifier is available, the number of uses of the ciphertext identifier can be limited by setting a limit according to actual needs, for example, only allowing it to be used once or allowing it to be used multiple times, and the embodiment of the present application does not impose any restrictions.

[0055] In the embodiment of the present application, the availability of the ciphertext identifier is determined to ensure that the client accessing the resource is a security-approved client, thereby preventing illegal clients from making multiple accesses through the same ciphertext identifier and access request, thereby avoiding access security issues.

[0056] In step S130, after the server extracts the ciphertext identifier from the access request, it can process the ciphertext identifier to obtain the first signature information and first identification information of the client, wherein the first signature information is information generated by the client through the signature algorithm in the process of generating the ciphertext identifier; the first identification information is information required by the client when generating the first signature information, including the client's timestamp information, the client's system code and the client's sequence identifier, the timestamp information refers to the current time when the client generates the access request, and the timestamp information can identify the time when the client generates the access information, thereby determining the effective time of the access request; the sequence identifier refers to the serial number of the access request sent by the client to the server. For example, when the sequence identifier is 100, it can be identified as the 100th access request of the current client to access the server resources.

[0057] In some embodiments, reference Figure 3 Step S130 specifically further includes the steps of:

[0058] S131, decoding the ciphertext identifier to obtain encrypted information;

[0059] S132, decrypt the encrypted information to obtain first signature information and first identification information.

[0060] In step S131, after the server extracts the ciphertext identifier, it decodes the ciphertext identifier and obtains the unencoded encrypted information from the ciphertext identifier, wherein the decoding process refers to the commonly used encoding and decoding methods, such as BASE64, BASE62X, URL method and ASCII code (American Standard Code for Information Interchange), etc. The embodiment of the present application takes BASE64 as an example for explanation. After decoding the ciphertext identifier based on the BASE64 algorithm, the corresponding encrypted information can be obtained. It should be noted that the decoding method adopted by the server side needs to be consistent with the encoding method adopted by the client in the process of generating the access request, so as to ensure that the server decodes the ciphertext identifier correctly, thereby obtaining the correct encrypted information, and avoiding the problem of incorrect decoding results due to different decoding methods adopted during the decoding process.

[0061] In step S132, after the server decodes the ciphertext identifier to obtain the encrypted information, it can decrypt the encrypted information to obtain the first signature information and the first identification information. The encrypted information is the information obtained by the client after encrypting the first signature information and the first identification information by using a preset encryption key and an encryption algorithm in the process of generating an access request, that is, the encrypted version of the first signature information and the first identification information; the decryption processing mentioned in the embodiment of the present application refers to decrypting the encrypted information based on a commonly used encryption and decryption algorithm, such as a symmetric encryption and decryption algorithm AES (Advanced Encryption Standard) algorithm, DES (Data Encryption Standard) algorithm and RC2 (traditional symmetric block encryption algorithm) algorithm, or an asymmetric encryption and decryption algorithm DSA (Digital Signature Algorithm) algorithm and RSA (RSA algorithm) algorithm, or a hash algorithm MD4 (Message Digest Algorithm) algorithm, MD5 (Message Digest Algorithm MD5) algorithm and SHA (Secure Hash Algorithm) series of algorithms. The encryption and decryption algorithm in the embodiment of the present application is described by taking the DES algorithm as an example. The embodiment of the present application is based on the DES algorithm and the encryption key of the client pre-stored in the database. After decrypting the encrypted information, the corresponding information, namely the first signature information and the first identification information, can be obtained. It should be noted that the encryption and decryption algorithm used by the server needs to be consistent with the encryption and decryption algorithm used by the client in the process of generating the access request, so as to ensure that the server correctly decrypts the encrypted information, thereby obtaining the correct first signature information, and avoiding the problem of incorrect decryption results due to different decryption algorithms used in the decryption process.

[0062] In step S140, the server recalculates the second signature information based on the first identification information obtained by decryption and the second identification information pre-stored in the database, wherein the calculated second signature information refers to the second signature information obtained by encrypting the first identification information and the second identification information based on a commonly used encryption algorithm. In the embodiment of the present application, the SHA1 encryption algorithm is used as an example, and the first identification information and the second identification information obtained are encrypted by the SHA1 (Secure Hash Algorithm 1) encryption algorithm to obtain the second signature information. It should be noted that the second signature information is not obtained in the same way as the first signature information. The first signature information is obtained by decoding and decrypting the ciphertext identification, and the second signature information is obtained by encrypting the first identification information obtained by decoding and decrypting the ciphertext identification with the same encryption algorithm as the client to generate the first signature information and the pre-stored second identification information.

[0063] In step S150, the comparison server extracts the first signature information obtained from the ciphertext representation and the second signature information regenerated by the first identification information and the second identification information to determine whether the two are consistent. Comparison refers to comparing whether the two are consistent or different, thereby obtaining a corresponding comparison result, and performing different execution steps according to different comparison results, such as Figure 1 As shown, if the first signature information and the second signature information are the same, step S160 is executed.

[0064] In step S160, if the first signature information and the second signature information are the same after comparing, then the initial request of the client is obtained according to the access request of the client, and resources are shared with the client according to the initial request. The initial request refers to the request made by the client when it actually accesses. The access request of the client received by the server is generated by the client generating a ciphertext identifier and adding the ciphertext identifier to the initial request, that is, the initial request adds the ciphertext identifier as a parameter. Therefore, the server clears the ciphertext identifier in the access request, thereby obtaining the initial request of the client for actual access. The client can access resources to the server according to the initial request, that is, the server shares resource capabilities with the client according to the initial request of the client.

[0065] In some embodiments, reference Figure 2 If the first signature information and the second signature information are different, the access request is judged to be an illegal request. Therefore, the server will reject the access request, that is, reject the client's resource access, that is, the server does not share resources with the client.

[0066] In some embodiments, reference Figure 2 , after step S150, the method further includes the following steps:

[0067] S151, obtaining timestamp information in the first identification information;

[0068] S152, determining whether the access request has expired according to the timestamp information and the second identification information;

[0069] In step S151, the server determines the timestamp information of the access request according to the acquired first identification information. The timestamp information indicates the time when the client generates the request. The request time of the client can be determined through the timestamp information.

[0070] In step S152, the server will obtain the second identification information, and determine whether the access information is within the validity period based on the second identification information and timestamp information pre-stored in the database. Specifically, the server obtains the validity period in the second identification information, which indicates the available time of the request generated by the client. The server determines the generation time of the access request through the timestamp information, and combines the validity period of the second identification information to determine whether the access request is expired at the current time point. If the access request is judged to be expired, step S123 is executed, and the server will deny the client's resource access, that is, the server does not share resources with the client. Resource access and resource sharing refer to the client requesting related business capabilities or resource capabilities from the server, or the server distributing the current business capabilities or resource capabilities to the client for use; if it is judged that the access request has not expired, step S160 is executed, that is, the server accepts the client's resource access.

[0071] In an embodiment of the present application, by obtaining an access request sent by a client and second identification information of a pre-stored client, extracting a ciphertext identification in the access request, obtaining first signature information and first identification information according to the ciphertext identification, generating second signature information based on the first identification information and the second identification information, comparing the first signature information and the second signature information, and if the first signature information and the second signature information are the same, obtaining an initial request of the client according to the access request, obtaining the initial request of the client according to the access request, and sharing resources with the client, the security of the cloud platform and the client in the process of sharing resource capabilities can be guaranteed, and resource capability leakage problems can be prevented.

[0072] In a second aspect, an embodiment of the present application provides a resource access method applied to a client.

[0073] In some embodiments, reference Figure 4 , shows a schematic diagram of the process of the resource sharing method in the embodiment of the present application. It specifically includes the steps:

[0074] S210, generating an initial request for requesting access to a server;

[0075] S220, generating a ciphertext identifier according to the preset first identifier information;

[0076] S230, generating an access request according to the ciphertext identifier and the initial request;

[0077] S240, sending the access request to the server to access the resource.

[0078] In step S210, when the client needs to access the server, a corresponding request, namely an initial request, is generated. It should be noted that the initial request is an HTTP request in the form of a URL. The client actually accesses resources on the server based on the initial request. The initial request indicates the resource capabilities that the client wants to request.

[0079] In step S220, the client generates a ciphertext identifier based on the preset first identification information, where the first identification information is the information required by the client when generating the first signature information, including the client's timestamp information, the client's system code, and the client's sequence identifier. The timestamp information refers to the current time when the client generates the access request. The timestamp information can identify the time when the client generates the access information, thereby determining the effective time of the access request; the sequence identifier refers to the serial number of the access request when the client sends it to the server.

[0080] In some embodiments, reference Figure 5 Step S220 specifically further includes the following steps:

[0081] S221, generating first signature information according to preset first identification information;

[0082] S222, encrypting and generating encrypted information according to the first signature information and the first identification information;

[0083] S223, encode the encrypted information to generate a ciphertext identifier.

[0084] In step S221, the client generates first signature information based on the preset first identification information. Specifically, the client signs based on the first identification information, where the first identification information is the information required by the client when generating the first signature information, including the client's timestamp information, the client's system code, and the client's sequence identifier. The timestamp information refers to the current time when the client generates the access request. The timestamp information can identify the time when the client generates the access information, thereby determining the effective time of the access request; the sequence identifier refers to the serial number of the access request when the client sends it to the server. For example, when the sequence identifier is 100, it can be identified as the 100th access request of the current client to access server resources.

[0085] In some embodiments, the client generates a first signature request by encrypting through an encryption algorithm based on the sequence identifier, timestamp information and system code of the client in the first identification information, wherein encryption refers to encrypting the sequence identifier, timestamp information and system code of the client in the first identification information based on a commonly used encryption and decryption algorithm, that is, the sequence identifier, timestamp information and system code of the client in the first identification information are used as input parameters of the encryption party. Commonly used encryption algorithms include but are not limited to symmetric encryption and decryption algorithms AES algorithm, DES algorithm and RC2 algorithm, or asymmetric encryption and decryption algorithms DSA algorithm and RSA algorithm, or hash algorithms MD4 algorithm, MD5 algorithm and SHA series algorithms. The encryption algorithm for generating the first signature information in the embodiment of the present application is illustrated by taking the SHA1 algorithm as an example.

[0086] In actual applications, taking the serial identifier of 100, the timestamp information of 20201222101056, and the system code of 200 as an example, the timestamp information indicates 10:10:56 on December 12, 2020, the serial identifier indicates that the request is the 100th request of the client, and the system code indicates that the identity code of the client is 200. The specific encryption method used is SHA1 (serial identifier + timestamp information + system code), that is, SHA1 (10020201222101056200). The first signature information obtained by encrypting the second identification information with the SHA1 encryption algorithm is 02838b4639d1c863b518f196e810a5653c87606f.

[0087] In step S222, after encrypting the first signature information, the client encrypts according to the first signature information and the preset first identification information to obtain the corresponding encrypted information. The encrypted information is the information obtained by the client after encrypting the first signature information and the first identification information by using the preset encryption key and encryption algorithm in the process of generating the access request, that is, the encrypted version of the first signature information and the first identification information; the encryption processing mentioned in the embodiment of the present application refers to decrypting the first signature information and the first identification information based on the commonly used encryption and decryption algorithm, such as the symmetric encryption and decryption algorithm AES algorithm, DES algorithm and RC2 algorithm, or the asymmetric encryption and decryption algorithm DSA algorithm and RSA algorithm, or the hash algorithm MD4 algorithm, MD5 algorithm and SHA series algorithm. The encryption and decryption algorithm in the embodiment of the present application is described by taking the DES algorithm as an example.

[0088] In some embodiments, the client specifically encrypts the sequence identifier and timestamp information in the first identification information in combination with the first signature information generated in step S221 to generate corresponding encrypted information.

[0089] In practical applications, the input parameters of the encryption algorithm are the sequence identifier, the timestamp information, the first signature information, and the preset encryption key. For example, the sequence identifier is 100, the timestamp information is 20201222101056, the first signature information is 02838b4639d1c863b518f196e810a5653c87606f, the encryption algorithm is DES, and the encryption key is abc. Specifically, based on the DES encryption algorithm and the encryption key abc, that is, DES (encryption key (first signature information + sequence identifier + timestamp information) )=DES(abc(02838b4639d1c863b518f196e810a5653c87606f10020201222101056)), and the encrypted information obtained after the client performs encryption processing is "U2FsdGVkX19B+jjppxt9YJsGiYiEmXFbIBsP61QLlIRiMVBfnsg+ZbtpzBvdnwZ9s3f+Shualu / ByM7QkkEUYmfb9pHQb8IdmUsD6EeirMg=".

[0090] In step S223, the client performs encoding processing on the encrypted information obtained in step S222 to generate a corresponding ciphertext identifier, wherein the ciphertext identifier refers to the client encoding the encrypted information through a commonly used encoding method, such as BASE64, BASE62X, URL method and ASCII code. In the embodiment of the present application, the BASE64 encoding method is taken as an example, and the encrypted information is encrypted based on BASE64 to generate a ciphertext identifier. The ciphertext identifier is the parameter information carried in the client's access request, and the parameter information is generated by the client after encryption processing. In actual applications, the ciphertext identifier exists as a parameter of the HTTP request. For example, the parameter carried in the client's access request is "sig=syscode$ciphertext identifier", where sig is the name of the parameter information; syscode is the client's system code, which can be provided to the server to confirm the identity of the client; the ciphertext identifier is the information obtained by the server extracting the access request. In actual applications, after the client sends an access request through the service interface, the service gateway of the server can directly obtain the parameter information of the specified parameter name through the parameter acquisition method provided by the preset HTTP request after receiving the access request. For example, the preset parameter acquisition method: request.getParameter("sig") can be used to obtain the parameter information with the parameter name sig, that is, the parameter information can be obtained, and the ciphertext identifier that needs to be extracted can be obtained through the parameter information, thereby completing the extraction of the ciphertext identifier.

[0091] In practical applications, the encoding method of this application is BASE64 (based on 64 printable characters to represent binary data) and the encrypted information is "U2FsdGVkX19B+jjppxt9YJsGiYiEmXFbIBsP61QLlIRiMVBfnsg+ZbtpzBvdnwZ9s3f+Shualu / ByM7QkkEUYmfb9pHQb8IdmUsD6EeirMg=" as an example, encoding is based on the BASE64 encoding method, that is, BASE64(U2FsdGVkX19B+jjppxt9YJsGiYiEmXFbIBsP61QLlIRiMVBfnsg+ZbtpzBvdnwZ9s3f+Shualu / ByM7QkkEUYmfb9pHQb8IdmUsD6EeirMg=" lIRiMVBfnsg+ZbtpzBvdnwZ9s3f+Shualu / ByM7QkkEUYmfb9pHQb8IdmUsD6EeirMg=), and finally the ciphertext identifier is "VTJGc2RHVmtYMTlCK2pqcHB4dDlZSnNHaVlpRW1YRmJJQnNQNjFRTGxJUmlNVkJmbnNnK1pidHB6QnZkbndaOXMzZitTaHVhbHUvQnlNN1Fra0VVWW1mYjlwSFFiOElkbVVzRDZFZWlyTWc9".

[0092] In step S230, after obtaining the corresponding ciphertext identifier, the client obtains the parameter information to be added according to the ciphertext second identifier information. Specifically, the ciphertext identifier is placed in the parameter. For example, in actual application, the ciphertext identifier is placed in the parameter information carried by the request, namely "sig=syscode$ciphertext identifier". Taking the system code as 200 as an example, the parameter information requested by the client is "sig=200$VTJGc2RHVmtYMTlCK2pqcHB4dDlZSnNHaVlpRW1YRmJJQnNQNjFRTGxJUmlNVkJmbnNnK1pidHB6QnZkbndaOXMzZitTaHVhbHUvQnlNN1Fra0VVWW1mYjlwSFFiOElkbVVzRDZFZWlyTWc9". After the above parameter information is added to the initial request, the corresponding access request can be obtained.

[0093] In step S240, after the client generates an access request through the initial information and the encrypted identifier, the access request is sent to the server through the service interface connected to the server. The server performs the processing mentioned in the first aspect embodiment according to the parameter information carried in the access request, thereby determining the legitimacy of the access request, so that the client can access the resources of the server through the access request sent.

[0094] It should be noted that the parameter information carried in the access request, i.e. the ciphertext identifier, is used to implement the security and legality verification of the interface access. Only when the parameter information is carried and verified by the server, can the access request be accepted by the server and determined to be a legal request, and finally the client is allowed to access the resources.

[0095] In an embodiment of the present application, by generating an initial request for requesting access to a server, generating a ciphertext identifier based on preset second identification information, generating an access request based on the ciphertext identifier and the initial request, and sending the access request to the server for resource method, the security of the cloud platform and the client in the process of sharing resource capabilities can be guaranteed, and the problem of resource capability leakage can be prevented.

[0096] In combination with the resource sharing method mentioned in the first aspect embodiment and the resource access method mentioned in the second aspect embodiment, in the application examples that may be implemented, reference is made to Figure 6After the client generates the initial request, the preset sequence identifier, timestamp information and client system code are signed by the SHA1 encryption algorithm to obtain the first signature information. The obtained first signature information, sequence identifier and timestamp information are encrypted by the DES encryption algorithm to obtain the encrypted information; the encrypted information is encoded by the BASE64 encoding method to obtain the ciphertext identifier, and the parameter information to be carried is generated according to the ciphertext identifier, that is, sig=syscode$ciphertext identifier, and the parameter information is added to the initial request for carrying, thereby obtaining the access request, and the client sends the access request to the server for receiving. The server intercepts the access request through the service gateway and obtains the second identification information of the client pre-stored in the database, namely, the client's system code, encryption key and validity period, etc.; the server extracts the ciphertext identification of the access request, extracts the ciphertext identification from the parameter information, and then goes to the preset Redis database to determine whether the ciphertext identification has been used. If it has been used, the client's resource access is denied; if it has not been used, the ciphertext identification is gradually decoded and decrypted to obtain the first signature information and the first identification information in the ciphertext identification; then the server recalculates and generates a new second signature information based on the obtained first identification information, and compares the first signature information with the second signature information. If the first signature information and the second signature information are different, the server denies the client's resource access; if the first signature information and the second signature information are consistent, the server determines whether the access request has expired based on the timestamp of the first identification information and the validity period of the second identification information. If the access request has expired, the server denies the client's resource access; if the access request has not expired, the ciphertext identifier is placed in the Redis database, and the ciphertext identifier and parameter information in the access request are removed to obtain the client's initial request. The server uses this to share resources with the client, that is, the client accesses resources on the server.

[0097] In a third aspect, an embodiment of the present application further provides an electronic device, comprising: at least one processor, and a memory communicatively connected to the at least one processor;

[0098] The processor is configured to execute the resource sharing method in the first aspect embodiment or the resource access method in the second aspect embodiment by calling the computer program stored in the memory.

[0099] The memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer executable programs, such as the resource sharing method in the first embodiment of the present application or the resource access method in the second embodiment. The processor implements the resource sharing method in the first embodiment or the resource access method in the second embodiment by running the non-transitory software programs and instructions stored in the memory.

[0100] The memory may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store and execute the resource sharing method in the first aspect embodiment or the resource access method in the second aspect embodiment. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0101] The non-transient software programs and instructions required to implement the resource sharing method in the first aspect embodiment or the resource access method in the second aspect embodiment are stored in a memory, and when executed by one or more processors, the resource sharing method in the first aspect embodiment or the resource access method in the second aspect embodiment is executed.

[0102] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are used to: execute the resource sharing method in the embodiment of the first aspect or the resource access method in the embodiment of the second aspect;

[0103] In some embodiments, the computer-readable storage medium stores computer-executable instructions, which are executed by one or more control processors, for example, by a processor in an electronic device of the third aspect embodiment, so that the one or more processors can execute the resource sharing method in the first aspect embodiment or the resource access method in the second aspect embodiment.

[0104] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0105] It will be appreciated by those skilled in the art that all or some of the steps and systems in the disclosed method above may be implemented as software, firmware, hardware and appropriate combinations thereof. Some physical components or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor or a microprocessor, or may be implemented as hardware, or may be implemented as an integrated circuit, such as an application specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or a non-transitory medium) and a communication medium (or a temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, disk storage or other magnetic storage devices, or any other medium that may be used to store desired information and may be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0106] In the description of this specification, the description with reference to the terms "some embodiments", "examples", "specific examples", or "some examples" means that the specific features or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example.

[0107] Although the embodiments of the present application have been shown and described, those skilled in the art will appreciate that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present application, and that the scope of the present application is defined by the claims and their equivalents.

Claims

1. A resource sharing method, characterized in that: include: Get the access request sent by the client; Extracting the ciphertext identifier in the access request; Acquire application information of the ciphertext identifier pre-stored in a database according to the ciphertext identifier; wherein the application information records the number of times the ciphertext identifier is used or whether the ciphertext identifier has been used; Determining whether the ciphertext identifier is available and the number of times the ciphertext identifier is used according to the application information; If the application information records that the ciphertext identifier has been used and the number of times used exceeds the limit on the number of times used, then resources are not shared with the client; Parsing the ciphertext identifier to obtain first signature information and first identifier information; obtaining timestamp information in the first identifier information; wherein the timestamp information indicates the time when the client generates the access request; Determine whether the access request has expired according to the timestamp information and the pre-stored second identification information; wherein the second identification information includes the validity period of the access request; If the access request expires, no resource sharing is performed with the client; Generate second signature information based on the first identification information and the second identification information; Comparing the first signature information and the second signature information to see whether they are the same; If the first signature information and the second signature information are the same, an initial request of the client is obtained according to the access request, and resources are shared with the client.

2. The resource sharing method according to claim 1, characterized in that: The parsing of the ciphertext identifier to obtain the first signature information and the first identifier information includes: Decoding the ciphertext identifier to obtain encrypted information; The encrypted information is decrypted to obtain the first signature information and the first identification information.

3. Resource access method, characterized in that: include: generating an initial request for accessing a server; Generate a ciphertext identifier according to the preset first identifier information; Generate an access request according to the ciphertext identifier and the initial request; The access request is sent to the server to access the resource; wherein the server extracts the ciphertext identifier according to the access request, and obtains application information of the ciphertext identifier pre-stored in the database according to the ciphertext identifier; the application information records the number of times the ciphertext identifier is used or whether the ciphertext identifier has been used; Determining whether the ciphertext identifier is available and the number of times the ciphertext identifier is used according to the application information; If the application information records that the ciphertext identifier has been used and the number of times used exceeds the limit on the number of times used, resources will not be shared with the client; Parsing the ciphertext identifier to obtain first signature information and first identifier information; obtaining timestamp information in the first identifier information; wherein the timestamp information indicates the time when the client generates the access request; Determine whether the access request has expired according to the timestamp information and the pre-stored second identification information; wherein the second identification information includes the validity period of the access request; If the access request expires, no resource sharing is performed with the client; Generate second signature information based on the first identification information and the second identification information; Comparing the first signature information and the second signature information to see whether they are the same; If the first signature information and the second signature information are the same, the initial request of the client is obtained according to the access request, and resources are shared with the client.

4. The resource access method according to claim 3, characterized in that: The step of generating a ciphertext identifier according to the preset first identifier information includes: Generate first signature information according to preset first identification information; Encrypting and generating encrypted information according to the first signature information and the first identification information; The encrypted information is encoded to generate a ciphertext identifier.

5. The resource access method according to claim 4, characterized in that: The first identification information includes a sequence identifier and a timestamp information; Correspondingly, the step of generating the first signature information according to the preset first identification information includes: The first signature information is generated by encrypting the sequence identifier, the timestamp information and a preset system code.

6. The resource access method according to claim 5, characterized in that: The step of generating encrypted information by encrypting the first signature information and the first identification information includes: The encrypted information is generated according to the sequence identifier, the timestamp information and the first signature information.

7. An electronic device, characterized in that include: at least one processor, and a memory communicatively connected to the at least one processor; wherein, The memory stores instructions, and the instructions are executed by the at least one processor, so that when the at least one processor executes the instructions, the resource sharing method according to any one of claims 1 to 2 or the resource access method according to any one of claims 3 to 6 is implemented.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable a computer to execute the resource sharing method according to any one of claims 1 to 2, or the resource access method according to any one of claims 3 to 6.

Images