Business service secure connection method, device, computer equipment, and storage medium

Abstract

The present application relates to a method, device, computer equipment, storage medium and computer program product for secure docking of business services. The present application can realize business interaction between the local and the service access address, and realize the provision of safe and reliable business services to users. The method includes: using cloud virtual scene construction software to send a service approval application for the target business service to the control platform to obtain service approval information from the control platform; the service approval information includes the application authorization address; sending an authorization application corresponding to the target business service to the application authorization address; the control platform determines the authorization application to obtain an authorization determination result, and returns the authorization determination result; if the authorization determination result includes authorization success information, the service access address is obtained; the service access address is provided to the control platform by the service provider; using the authorization success information, the business information interaction corresponding to the target business service is implemented between the local and the service access address.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence virtual reality technology, and in particular to a method, device, computer equipment, storage medium and computer program product for secure connection of business services. Background Art

[0002] As Internet technology penetrates into all walks of life, the financial sector is also gradually moving towards digitalization. At present, various 3D digital banking applications have emerged in the financial sector. 3D digital banks consist of external 3D digital exhibition halls for customers (realized by cloud-based virtual scene construction software) and multiple internal financial service applications. Users do not need to spend a lot of time going to physical bank outlets to handle business. They only need to operate through network terminals to achieve a financial service experience that is like a real scene reproduction.

[0003] In the current 3D financial Internet application system, the external 3D digital exhibition hall facing customers is deployed on the public cloud with lower security requirements, and various internal financial service applications are deployed on the bank's private cloud with higher security requirements according to different financial business divisions. After the customer requests a service in the 3D digital exhibition hall, the internal financial service application completes the subsequent information interaction by judging whether the user's identity is legal.

[0004] However, with current technology, the 3D digital exhibition hall cannot securely transmit sensitive information to various internal financial service applications, and the internal financial service applications cannot accurately identify the caller. There is a lack of safe and reliable interaction methods between the 3D digital exhibition hall and the financial service applications. Summary of the invention

[0005] Based on this, it is necessary to provide a business service secure docking method, device, computer equipment, computer-readable storage medium and computer program product to address the above technical problems.

[0006] In a first aspect, the present application provides a method for securely connecting a business service, the method comprising:

[0007] Sending a service approval application for a target business service to a control platform to obtain service approval information from the control platform; the service approval information includes an application authorization address;

[0008] Sending an authorization application corresponding to the target business service to the application authorization address; the control platform is used to determine the authorization application to obtain an authorization determination result, and return the authorization determination result;

[0009] If the authorization determination result includes authorization success information, a service access address is obtained; wherein the service access address is provided to the control platform by a service provider;

[0010] The authorization success information is used to implement business information interaction corresponding to the target business service between the local computer and the service access address.

[0011] In one embodiment, the service approval information includes a local identity and a first key pair; and sending an authorization application for the target business service to the authorization application address includes:

[0012] Generate a plain text authorization application based on the local identity identifier;

[0013] Signing the authorization application in plain text using the first private key in the first key pair;

[0014] Using the first public key in the first key pair to encrypt the entire message of the signed authorization application to obtain the authorization application ciphertext;

[0015] Send the authorization application ciphertext to the application authorization address.

[0016] In one embodiment, the control platform is used to decrypt the authorization application ciphertext using the first public key to obtain the authorization application plaintext;

[0017] The control platform is further used to encrypt the communication parameters, access flags and the service access address using a symmetric encryption method after verifying that the authorization application is legal in plain text, obtain the authorization success information, and return the authorization success information.

[0018] In one embodiment, if the authorization determination result includes authorization success information, obtaining the service access address includes:

[0019] The authorization success information is decrypted to obtain the service access address.

[0020] In one embodiment, the authorization success information also includes the communication parameter and the access flag; and using the authorization success information to implement business information interaction corresponding to the target business service between the local and the service access address includes:

[0021] In response to a user request for the target business service, generating corresponding request parameters;

[0022] Encrypting the request parameter using the communication parameter to obtain the encrypted request parameter;

[0023] The encrypted request parameters, the access token and the local identity are sent to the service access address so that the service provider verifies the validity of the access token and provides corresponding business services according to the local identity and the request parameters.

[0024] In one of the embodiments, the control platform is deployed in a private cloud; and the target business service includes financial services.

[0025] In a second aspect, the present application also provides a business service secure docking device, the device comprising:

[0026] A service approval application sending module is used to send a service approval application for a target business service to a control platform to obtain service approval information from the control platform; the service approval information includes an application authorization address;

[0027] The authorization application sending module is used to send the authorization application corresponding to the target business service to the application authorization address; the control platform is used to determine the authorization application to obtain an authorization determination result, and return the authorization determination result;

[0028] A service access address acquisition module, used to acquire a service access address if the authorization determination result contains authorization success information; wherein the service access address is provided to the control platform by a service provider;

[0029] The business information interaction module is used to utilize the authorization success information to implement business information interaction corresponding to the target business service between the local and the service access address.

[0030] In one of the embodiments, the service approval information includes a local identity and a first key pair;

[0031] The authorization application sending module is further used to generate a plaintext authorization application based on the local identity identifier; use the first private key in the first key pair to sign the plaintext authorization application; use the first public key in the first key pair to encrypt the entire message of the signed authorization application to obtain the ciphertext authorization application; and send the ciphertext authorization application to the application authorization address.

[0032] In one embodiment, the control platform is used to decrypt the authorization application ciphertext using the first public key to obtain the authorization application plaintext;

[0033] The control platform is further used to encrypt the communication parameters, access flags and the service access address using a symmetric encryption method after verifying that the authorization application is legal in plain text, obtain the authorization success information, and return the authorization success information.

[0034] In one embodiment,

[0035] The service access address acquisition module is further used to decrypt the authorization success information to obtain the service access address.

[0036] In one of the embodiments, the authorization success information also includes the communication parameter and the access flag;

[0037] The business information interaction module is further used to generate corresponding request parameters in response to a user request for the target business service; encrypt the request parameters using the communication parameters to obtain encrypted request parameters; send the encrypted request parameters, the access token and the local identity to the service access address, so that the service provider verifies the validity of the access token and provides corresponding business services based on the local identity and the request parameters.

[0038] In one of the embodiments, the control platform is deployed in a private cloud; and the target business service includes financial services.

[0039] In a third aspect, the present application further provides a computer device, wherein the computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, each step in the above-mentioned business service secure connection method embodiment is implemented.

[0040] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which implements each step in the above-mentioned business service secure connection method embodiment when the computer program is executed by a processor.

[0041] In a fifth aspect, the present application further provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, each step in the above-mentioned business service secure connection method embodiment is implemented.

[0042] Compared with the traditional interaction between a public cloud client and a private cloud backend service, the above-mentioned business service secure connection method, device, computer device, storage medium and computer program product can achieve the following technical effects:

[0043] By utilizing cloud virtual scene construction software, a service approval application for the target business service is sent to the control platform to obtain service approval information from the control platform; the service approval information includes an application authorization address; this step ensures that the application authorization address is legitimate and not impersonated by a hacker; at the same time, a service approval application is first sent to the control platform to obtain approval, rather than directly allowing the client to start the interaction process with the back-end service, thereby ensuring the security of the control platform; an authorization application corresponding to the target business service is sent to the application authorization address; the control platform is used to determine the authorization application to obtain an authorization determination result, and return the authorization determination result; if the authorization determination result includes authorization success information, the service access address is obtained; wherein, the service access address is provided to the control platform by the service provider; using the authorization success information, business information interaction corresponding to the target business service is implemented between the local and the service access address. This application can obtain the service access address of the business services on the user-oriented insecure cloud-based virtual scene construction software after approval and authorization by the control platform, and finally realize business interaction between the local and the service access address, opening up a secure channel between the cloud-based virtual scene construction software located in the public cloud and the service provider located in the bank's private cloud, thereby providing users with safe and reliable business services.

[0044] In addition, the embodiment of the present application also distributes key pairs to cloud-based virtual scene construction software through a credible control platform, and at the same time authenticates and authorizes the identity ID of cloud-based virtual scene construction software (such as a 3D digital exhibition hall) that wants to access private cloud services, further improving the credibility and standardization of cloud-based virtual scene construction software.

[0045] Furthermore, the present application also encrypts the transmission of the service access address provided by the service provider to prevent the service access address from being intercepted and tampered with by other illegal ports during transmission, thereby improving the confidentiality of the transmission process and providing a more secure technical environment for users to build software using cloud virtual scenes. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 An application environment diagram of a business service secure docking method in an embodiment;

[0047] Figure 2 A flowchart of a method for securely connecting a business service in one embodiment;

[0048] Figure 3 A flowchart of a method for securely connecting business services in another embodiment;

[0049] Figure 4 A structural block diagram of a business service security connection system in an embodiment;

[0050] Figure 5 It is a structural block diagram of a business service security connection device in an embodiment;

[0051] Figure 6 is an internal structure diagram of a computer device in one embodiment;

[0052] Figure 7 The internal structure diagram of the overall computer device of another embodiment. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0054] The business service secure connection method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the cloud virtual scene construction software 101 communicates with the control platform 102 through the network. The cloud virtual scene construction software 101 can be, for example, a 3D digital exhibition hall based on financial services. The control platform is also connected to one or more service providers 103, and the data storage system can store the data that the control platform 102 needs to process. The data storage system can be integrated on the control platform 102. The 3D digital exhibition hall is also called a 3D virtual exhibition hall, or a 3D cloud exhibition hall, which is located in the public cloud. It is a 3D virtual scene display software built based on the Internet and 3D modeling technology. Users do not even need to install any software or plug-ins. They only need to click on the URL link or scan the QR code to log in to the 3D digital exhibition hall located in the public cloud to explore the three-dimensional virtual environment and complete the user interaction behavior set in the virtual environment. The control platform is located in a private cloud, and the service provider can be located on a public cloud or a private cloud. Among them, the cloud virtual scene construction software 101 can display the 3D virtual scene on various personal computers, laptops, smart phones, tablets, IoT devices and portable wearable devices. The IoT devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The control platform 102 can be implemented with an independent server or a server cluster composed of multiple servers. The business services include financial services. The control platform is deployed in a private cloud; the cloud virtual scene construction software is deployed in a public cloud.

[0055] In one embodiment, Figure 2 As shown, a business service secure docking method is provided, which is applied to Figure 1 Taking the cloud virtual scene construction software 101 in the example as an example, the following steps are included:

[0056] Step S201, sending a service approval application for a target business service to a control platform to obtain service approval information from the control platform; the service approval information includes an application authorization address;

[0057] Among them, service approval application means that when a user needs to use the target business service, the cloud virtual scene construction software first applies to the control platform for the target business service to be approved. For example, if a user needs to conduct personal loan business or corporate loan business with a bank through the cloud virtual scene construction software, the cloud virtual scene construction software first needs to apply to the control platform for the target business service to be approved.

[0058] Specifically, the cloud-based virtual scene construction software sends a service approval application for the target business service to the control platform, such as a service approval application for the personal lending business of Bank A. The service approval application is used to obtain service approval information from the control platform; if approved, the service approval information contains an application authorization address; the application authorization address refers to the application authorization address provided by the control platform. Because the control platform concentrates multiple business departments, such as personal lending business, corporate lending business, etc., related authorization matters should be submitted to the corresponding business department for approval. The application authorization address in the above example can point to a personal lending business interface or a corporate lending business interface, etc.

[0059] Step S202: Send an authorization application corresponding to the target business service to the authorization application address; the control platform is used to determine the authorization application to obtain an authorization determination result, and return the authorization determination result;

[0060] Specifically, the cloud-based virtual scene construction software (also called the caller) obtains the authorization determination result of the control platform by sending a corresponding authorization application to the above-mentioned application authorization address (such as the above-mentioned personal loan business interface or corporate loan business interface, etc.).

[0061] Step S203: if the authorization determination result includes authorization success information, a service access address is obtained; wherein the service access address is provided to the control platform by the service provider;

[0062] The service provider refers to the unit that provides various business service capabilities to users, such as Bank A or Bank B.

[0063] Specifically, if the control platform passes the authorization application for the target business service, it returns authorization success information and a service access address, which is an address provided to the control platform by the service provider and has been reviewed and approved.

[0064] Step S204: using the authorization success information, implement business information interaction corresponding to the target business service between the local and the service access address.

[0065] Specifically, the above authorization success information also includes various communication parameters, keys, etc. used for secure communication. The caller (i.e., cloud-based virtual scene construction software or 3D digital exhibition hall) can use the authorization success information to implement corresponding business information interaction between the local and service access address.

[0066] In the above embodiment, the caller (i.e., cloud virtual scene construction software or 3D digital exhibition hall) sends a service approval application for the target business service to the control platform to obtain service approval information from the control platform; the service approval information includes the application authorization address; the authorization application corresponding to the target business service is sent to the application authorization address; the control platform is used to determine the authorization application to obtain the authorization determination result, and return the authorization determination result; if the authorization determination result includes authorization success information, the service access address is obtained; wherein the service access address is provided to the control platform by the service provider; using the authorization success information, the business information corresponding to the target business service is implemented between the local and the service access address. This application can obtain the service access address after the business service on the cloud virtual scene construction software that is not secure for users is approved by the control platform and authorized by the control platform, and finally realizes the business interaction between the local and the service access address, so as to provide users with safe and reliable business services.

[0067] In one embodiment, the service approval information includes the local identity and the first key pair; the step S202 includes:

[0068] Generate a plain text authorization application based on the above local identity identifier; use the first private key in the first key pair to sign the plain text authorization application; use the first public key in the above first key pair to encrypt the entire message of the signed authorization application to obtain a ciphertext authorization application.

[0069] The local identity is the caller identity, for example, it can be the identity of the cloud virtual scene construction software (3D digital exhibition hall).

[0070] Specifically, the service approval information returned by the control platform also includes the local identity ID and the first key pair, wherein the first key pair includes the first public key and the first private key. After receiving the approval information, the caller (e.g., 3D digital exhibition hall) starts to send an authorization application to the control platform. Specifically, the authorization application plaintext can be generated based on the local identity ID, and the authorization application plaintext can be signed with the first private key (i.e., private key 1), and the signed authorization application can be fully encrypted with the first public key (public key 1), and the ciphertext can be sent to the authorization application address specified by the control platform.

[0071] Optionally, the local identity and ciphertext may be sent separately to the control platform to specify an authorization application address.

[0072] Optionally, the above service approval information also includes a second public key, which is conducive to the subsequent use of a symmetric encryption algorithm to encrypt and decrypt the service access address.

[0073] In the above embodiment, authorization application is performed through a key pair and an identity ID allocated by a control platform (wherein the control platform is a credible platform), thereby further improving the credibility and standardization of authorization.

[0074] In one embodiment, the control platform is used to decrypt the authorization application ciphertext using the first public key to obtain the authorization application plaintext; the control platform is further used to encrypt the communication parameters, access flags and service access addresses using a symmetric encryption method after verifying that the authorization application plaintext is legal, to obtain authorization success information, and return the authorization success information.

[0075] Specifically, the control platform uses the first public key to decrypt the above ciphertext to obtain the plaintext of the authorization application, and reviews the authorization application based on its specific content. If the content in the plaintext of the authorization application is verified to be legal, the symmetric encryption method (the second public key, i.e., public key 2) is used to encrypt the communication parameters COMMUNICATION_KEY, the access flag ACCESS_TOKEN and the service access address to obtain the authorization success information, and the authorization success information is returned to the 3D digital exhibition hall (i.e., the caller).

[0076] In the above embodiment, the control platform verifies the legitimacy of the authorization application by using relevant communication parameters and access flags to return to the caller, which is conducive to the subsequent verification of the legitimacy of the service access address and prevents tampering.

[0077] In one embodiment, the above step S203 includes: decrypting the authorization success information to obtain the service access address.

[0078] Specifically, after the cloud-based virtual scene construction software obtains the above-mentioned authorization success information from the control platform, it uses the above-mentioned second public key (ie, public key 2) to decrypt it (based on a symmetric encryption algorithm) to obtain the service access address.

[0079] In the above embodiment, the service access address is obtained by decryption, which further improves the system security and reduces the possibility that the service access address is sent by an unsafe party.

[0080] In one embodiment, the authorization success information also includes communication parameters and access flags; the step S204 includes:

[0081] In response to a user request for a target business service, corresponding request parameters are generated; the request parameters are encrypted using the communication parameters to obtain the encrypted request parameters; the encrypted request parameters, the access token, and the local identity are sent to the service access address so that the service provider can verify the validity of the access token and provide corresponding business services based on the local identity and the request parameters.

[0082] Specifically, after receiving the user's request, the caller (i.e., the cloud-based virtual scene construction software or 3D digital exhibition hall) generates corresponding request parameters based on the user's request, encrypts the request parameters using the above-mentioned communication parameters COMMUNICATION_KEY, and sends the encrypted request parameters, the above-mentioned access token ACCESS_TOKEN, and the caller's local identity ID to the above-mentioned service access address, so that the service provider can verify the validity of the access token ACCESS_TOKEN and provide corresponding business services based on the caller's local identity ID and request parameters.

[0083] In the above embodiment, by verifying the validity of ACCESS_TOKEN, it is determined that the request is sent by the caller rather than impersonated by another third party, and the request parameters are encrypted by the communication parameter COMMUNICATION_KEY, thereby reducing the possibility of user request parameters being hijacked and leaked during the communication process, and further improving system security.

[0084] The following uses the application of the above business service security connection method in a specific scenario as an example to further illustrate:

[0085] like Figure 3 As shown, Figure 3 A flowchart showing a method for securely connecting business services in a specific scenario.

[0086] This technical solution involves the following three roles:

[0087] Role 1: Financial service control platform (deployed in private cloud), as the coordination role between callers and service providers, provides service publishing, service application, and authorization application functions for callers and service providers.

[0088] Role 2: Financial service provider. According to (based on) business partitions, each financial service provider provides different financial service capabilities for online business processing and can publish services on the control platform. The services provided must be approved by the control platform, and the caller uses encryption to access them.

[0089] Role 3: The financial service caller, i.e. the cloud-based virtual scene construction software or 3D digital exhibition hall, is regarded as an untrusted role by the control platform and service providers (enterprises that connect or cooperate with the bank). It needs to apply to the control platform (the bank) for access services and initiate an authorization application. Only after obtaining the authorization information can it access the service provider.

[0090] The services and related parameters of the control platform configuration are as follows:

[0091] 3.1 Service parameters include the following information:

[0092] 1) Service provider number, used to identify the service provider information;

[0093] 2) Service number, used to identify the service provided by the service provider;

[0094] 3) Service access address, which is used to access the service provider's access address;

[0095] 4) Other service access parameters, which are used to transmit various parameters of the services provided by the service provider to achieve the required service effect;

[0096] 3.2 The caller (cloud-based virtual scene construction software or 3D digital exhibition hall) applies for services from the control platform and obtains authorization information, which specifically includes the following steps:

[0097] Step 3.2.1: The caller applies for service on the control platform and obtains approval, and obtains the caller ID and related keys: public key 1, private key 1, public key 2

[0098] Step 3.2.2: The caller sends an authorization application to the control platform. The application information is signed with private key 1, and the entire message is encrypted with public key 1. The ciphertext and the caller ID are sent to the authorization application address specified by the control platform.

[0099] Step 3.2.3: The control platform uses the public key 1 obtained by the caller to decrypt and obtain the plain text of the authorization application. After the platform checks that the authorization application information is legal, it uses public key 2 to encrypt COMMUNICATION_KEY, ACCESS_TOKEN, and service access address and returns them to the caller.

[0100] Step 3.2.4: The caller uses public key 2 to decrypt and verify the communication key ciphertext, and obtains COMMUNICATION_KEY, ACCESS_TOKEN, and service access address plaintext

[0101] 3.3 The caller uses the authorization information to access the service

[0102] Step 3.3.1: The caller uses COMMUNICATION_KEY to encrypt the relevant request parameters and sends them to the access address of the service provider along with ACCESS_TOKEN and the caller ID.

[0103] Step 3.3.2: The service provider uses COMMUNICATION_KEY to decrypt, verify the validity of ACCESS_TOKEN, and then provides related services based on the caller ID and service parameters.

[0104] Compared with the prior art which generally can only perform simple link jumps and cannot securely transmit sensitive data of the digital exhibition hall to the financial service application, and the financial service application cannot securely identify the caller, the above-mentioned embodiment establishes a solution for docking a set of cloud-based virtual scene construction software with multiple financial service applications, which can prevent the interactive information between them from being illegally tampered with by a third party.

[0105] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0106] Based on the same inventive concept, the embodiment of the present application also provides a business service secure docking system 400 for implementing the above-mentioned business service secure docking method. Figure 4 The implementation scheme for solving the problem provided by the system 400 is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more business service secure docking system embodiments provided below can refer to the limitations on the business service secure docking method above, and will not be repeated here.

[0107] The system may include a 3D digital exhibition hall 401 and a control platform 402, and may also include a service provider 403.

[0108] The 3D digital exhibition hall 401 is used to send a service approval application for a target business service to the control platform;

[0109] The control platform 402 is used to return service approval information to the 3D digital exhibition hall in response to the service approval application; the service approval information includes an application authorization address;

[0110] The 3D digital exhibition hall 401 is further used to send an authorization application corresponding to the target business service to the application authorization address;

[0111] The control platform 402 is further used to determine the authorization application to obtain an authorization determination result, and return the authorization determination result to the 3D digital exhibition hall;

[0112] The 3D digital exhibition hall 401 is further used to obtain a service access address if the authorization determination result includes authorization success information; wherein the service access address is provided to the control platform by the service provider;

[0113] The 3D digital exhibition hall 401 is further used to implement business information interaction corresponding to the target business service between the local and the service access address using the authorization success information.

[0114] In one embodiment, the service approval information includes the local identity of the 3D digital exhibition hall and the first key pair;

[0115] The 3D digital exhibition hall 401 is further used to generate a plain text authorization application based on the local identity identifier; use the first private key in the first key pair to sign the plain text authorization application; use the first public key in the first key pair to encrypt the entire message of the signed authorization application to obtain the ciphertext of the authorization application; and send the ciphertext of the authorization application to the application authorization address.

[0116] In one embodiment,

[0117] The control platform 402 is used to decrypt the authorization application ciphertext using the first public key to obtain the authorization application plaintext;

[0118] The control platform 402 is further used to encrypt the communication parameters, access flag and the service access address using a symmetric encryption method after verifying that the authorization application is legal in plain text, obtain the authorization success information, and return the authorization success information.

[0119] In one embodiment,

[0120] The 3D digital exhibition hall 401 is further used to decrypt the authorization success information to obtain the service access address.

[0121] In one of the embodiments, the 3D digital exhibition hall 401 is further used to generate corresponding request parameters in response to a user request for the target business service; encrypt the request parameters using the communication parameters to obtain encrypted request parameters; send the encrypted request parameters, the access flag and the local identity to the service access address, so that the service provider verifies the validity of the access flag and provides corresponding business services based on the local identity and the request parameters.

[0122] In one embodiment, the control platform 402 is deployed in a private cloud; the 3D digital exhibition hall 401 is deployed in a public cloud; and the target business service includes financial services.

[0123] Based on the same inventive concept, the embodiment of the present application also provides a business service secure docking device 500 for implementing the above-mentioned business service secure docking method. Figure 5 As shown, the implementation solution for solving the problem provided by the device is similar to the implementation solution recorded in the above method. Therefore, the specific limitations in one or more business service security docking device embodiments provided below can refer to the limitations on the business service security docking method above, and will not be repeated here.

[0124] In one embodiment, Figure 5 As shown, a business service secure docking device 500 is provided, including: a service approval application sending module 501, an authorization application sending module 502, a service access address acquisition module 503 and a business information interaction module 504, wherein:

[0125] The service approval application sending module 501 is used to send a service approval application for a target business service to the control platform to obtain service approval information from the control platform; the service approval information includes an application authorization address;

[0126] The authorization application sending module 502 is used to send an authorization application corresponding to the target business service to the application authorization address; the control platform is used to determine the authorization application to obtain an authorization determination result, and return the authorization determination result;

[0127] A service access address acquisition module 503 is used to acquire a service access address if the authorization determination result includes authorization success information; wherein the service access address is provided to the control platform by a service provider;

[0128] The business information interaction module 504 is used to implement business information interaction corresponding to the target business service between the local and the service access address using the authorization success information.

[0129] In one of the embodiments, the service approval information includes a local identity and a first key pair;

[0130] The authorization application sending module 502 is further used to generate a plaintext authorization application based on the local identity identifier; use the first private key in the first key pair to sign the plaintext authorization application; use the first public key in the first key pair to encrypt the entire message of the signed authorization application to obtain the ciphertext of the authorization application; and send the ciphertext of the authorization application to the application authorization address.

[0131] In one embodiment,

[0132] The control platform is used to decrypt the authorization application ciphertext using the first public key to obtain the authorization application plaintext;

[0133] The control platform is further used to encrypt the communication parameters, access flags and the service access address using a symmetric encryption method after verifying that the authorization application is legal in plain text, obtain the authorization success information, and return the authorization success information.

[0134] In one embodiment, the service access address acquisition module 503 is further used to decrypt the authorization success information to obtain the service access address.

[0135] In one of the embodiments, the authorization success information also includes the communication parameter and the access flag;

[0136] The business information interaction module 504 is further used to generate corresponding request parameters in response to a user request for the target business service; encrypt the request parameters using the communication parameters to obtain encrypted request parameters; send the encrypted request parameters, the access token and the local identity to the service access address, so that the service provider verifies the validity of the access token and provides corresponding business services based on the local identity and the request parameters.

[0137] In one of the embodiments, the control platform is deployed in a private cloud; and the target business service includes financial services.

[0138] Each module in the above-mentioned business service security docking device can be implemented in whole or in part by software, hardware and their combination. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the corresponding operations of the above modules.

[0139] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 6 As shown. The computer device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store business service data, including user data and data sent by the business provider. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a business service security docking method is implemented.

[0140] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 7 As shown. The computer device includes a processor, a memory, a communication interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a method for secure docking of business services is implemented. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device housing, or an external keyboard, touchpad or mouse, etc.

[0141] Those skilled in the art will understand that Figure 6-7The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0142] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, each step in the above-mentioned business service secure connection method embodiment is implemented.

[0143] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, each step in the above-mentioned business service secure connection method embodiment is implemented.

[0144] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above-mentioned business service secure connection method embodiment when executed by a processor.

[0145] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0146] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited thereto. The processors involved in each embodiment provided in this application may be general-purpose processors, central processing units, graphics processors, digital signal processors, programmable logic devices, data processing logic devices based on quantum computing, etc., but are not limited thereto.

[0147] The technical features of the above embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0148] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for securely connecting a business service, characterized in that: Applied to a 3D digital exhibition hall based on financial services deployed on a public cloud, the method includes: Sending a service approval application for a target business service to a control platform to obtain service approval information from the control platform; the service approval information includes an application authorization address; the application authorization address is provided by the control platform; the application authorization address points to a business interface of the target business service; the target business service belongs to the financial service; the service approval information includes the identity of the 3D digital exhibition hall, the first key pair and the second public key; Generate an authorization application plaintext based on the identity identifier; use the first public key in the first key pair to encrypt the signed authorization application plaintext to obtain the authorization application ciphertext; send the authorization application ciphertext to the application authorization address; the control platform is used to determine the authorization application plaintext to obtain an authorization determination result, and return the authorization determination result; If the authorization determination result includes authorization success information, the second public key is used to decrypt the authorization success information to obtain a service access address, communication parameters and access flag; wherein the service access address is provided to the control platform by the service provider; the authorization success information is obtained by the control platform by encrypting the communication parameters, the access flag and the service access address using the second public key when verifying that the authorization application is legal in plain text; The communication parameters are used to encrypt the request parameters to obtain encrypted request parameters, and the encrypted request parameters, the access token and the identity identifier are sent to the service access address so that the service provider can verify the validity of the access token and provide corresponding business services based on the identity identifier and the request parameters.

2. The method according to claim 1, characterized in that The method further comprises: The authorization application is plaintext signed using the first private key in the first key pair.

3. The method according to claim 2, characterized in that The control platform is used to decrypt the authorization application ciphertext using the first public key to obtain the authorization application plaintext.

4. The method according to claim 3, characterized in that Before the step of encrypting the request parameter by using the communication parameter to obtain the encrypted request parameter and sending the encrypted request parameter, the access flag and the identity identifier to the service access address, the step further includes: In response to a user request for the target business service, the corresponding request parameter is generated.

5. The method according to any one of claims 1 to 4, characterized in that: The control platform is deployed in a private cloud.

6. A business service secure docking device, characterized in that: The device is applied to a 3D digital exhibition hall based on financial services deployed in a public cloud, and comprises: A service approval application sending module is used to send a service approval application for a target business service to a control platform to obtain service approval information from the control platform; the service approval information includes an application authorization address; the application authorization address is provided by the control platform; the application authorization address points to a business interface of the target business service; the target business service belongs to the financial service; the service approval information includes the identity of the 3D digital exhibition hall, the first key pair and the second public key; An authorization application sending module is used to generate an authorization application plaintext based on the identity identifier; use the first public key in the first key pair to encrypt the signed authorization application plaintext to obtain the authorization application ciphertext; send the authorization application ciphertext to the application authorization address; the control platform is used to determine the authorization application plaintext to obtain an authorization determination result, and return the authorization determination result; A service access address acquisition module, configured to, if the authorization determination result includes authorization success information, use the second public key to decrypt the authorization success information to obtain a service access address, communication parameters and access flag; wherein the service access address is provided to the control platform by a service provider; the authorization success information is obtained by the control platform by encrypting the communication parameters, the access flag and the service access address using the second public key when verifying that the authorization application is legal in plain text; The business information interaction module is used to encrypt the request parameters using the communication parameters to obtain the encrypted request parameters, and send the encrypted request parameters, the access token and the identity identifier to the service access address so that the service provider can verify the validity of the access token and provide corresponding business services according to the identity identifier and the request parameters.

7. The device according to claim 6, characterized in that The authorization application sending module is further used to sign the authorization application plain text using the first private key in the first key pair.

8. The device according to claim 7, characterized in that The control platform is used to decrypt the authorization application ciphertext using the first public key to obtain the authorization application plaintext.

9. The device according to claim 8, characterized in that The business information interaction module is further used to generate the corresponding request parameters in response to a user request for the target business service.

10. The device according to any one of claims 6 to 9, characterized in that The control platform is deployed in a private cloud.

11. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 5 are implemented.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

13. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images