Scheme request verification method, device and equipment

Abstract

The present disclosure provides a Scheme request verification method, apparatus, and device, wherein the Scheme request verification method includes: obtaining a Scheme request from a first application to a second application; generating a first random number, and encrypting the first random number through a first identifier to obtain first encrypted information, wherein the first identifier serves as a key, and the first identifier corresponds to the terminal and the first application; encrypting the first encrypted information and information of the first application to obtain second encrypted information; sending the Scheme request and the second encrypted information to the second application, so that the second application verifies the Scheme request based on the second encrypted information; receiving a response message to the Scheme request from the second application, the response message carrying the first encrypted information; decrypting the first encrypted information to obtain a first decryption result, and determining a Scheme request result based on the first decryption result.

Description

Technical Field

[0001] The present disclosure relates to the field of application management technology, and in particular to a Scheme request verification method, apparatus, and device. Background Art

[0002] Currently, the iOS URL (Uniform Resource Locator) Scheme is a method of inter-process communication established on the operating system. Applications can declare their own URL Schemes for external applications to call. Because URL Schemes cannot be exclusively used by an application, when multiple applications declare the same URL Scheme, one application can hijack the URL Scheme requests of another. After a malicious program preemptively registers an enterprise's original scheme, it can hijack other applications' URL Scheme requests for legitimate applications and send the requests to other devices for replay, thereby endangering the security of users' funds and accounts. Summary of the Invention

[0003] In view of this, the purpose of the present disclosure is to provide a Scheme request verification method, device and equipment.

[0004] According to a first aspect of the present disclosure, a Scheme request verification method is provided, which is applied to a terminal, and the method includes: obtaining a Scheme request from a first application to a second application; generating a first random number, and encrypting the first random number through a first identifier to obtain first encrypted information, wherein the first identifier serves as a key, and the first identifier corresponds to the terminal and the first application; encrypting the first encrypted information and information of the first application to obtain second encrypted information; sending the Scheme request and the second encrypted information to the second application, so that the second application verifies the Scheme request based on the second encrypted information; receiving a response message to the Scheme request from the second application, the response message carrying the first encrypted information; decrypting the first encrypted information to obtain a first decryption result, and determining a Scheme request result based on the first decryption result.

[0005] According to a second aspect of the present disclosure, a Scheme request verification method is provided, which is applied to a terminal, and the method includes: obtaining a Scheme request and second encrypted information from a first application to a second application, wherein the second encrypted information includes encrypted information of the first application and first encrypted information, and the first encrypted information is obtained by encrypting a first random number using a first identifier, and the first identifier corresponds to the terminal and the first application; decrypting the second encrypted information to obtain information of the first application; verifying the Scheme request according to the information of the first application to obtain a second verification result; in response to the second verification result being a passed verification, re-encrypting the first encrypted information and the information of the first application to obtain re-encrypted second encrypted information; and sending the re-encrypted second encrypted information to the first application, so that the first application verifies the Scheme request according to the re-encrypted second encrypted information.

[0006] According to a third aspect of the present disclosure, a Scheme request verification method is provided, which is applied to a terminal and includes: a first application obtains its Scheme request for a second application; the first application generates a first random number and encrypts the first random number through a first identifier to obtain first encrypted information, wherein the first identifier serves as a key and corresponds to the terminal and the first application; the first application encrypts the first encrypted information and the information of the first application to obtain second encrypted information; the first application sends the Scheme request and the second encrypted information to the second application; the second application decrypts the second encrypted information, verifies the Scheme request according to the information of the first application, and in response to successful verification, sends a response message of the Scheme request to the first application, wherein the response message carries the first encrypted information; the first application receives the response message of the Scheme request, decrypts the first encrypted information to obtain a first decryption result, and determines the Scheme request result according to the first decryption result.

[0007] According to a fourth aspect of the present disclosure, a Scheme request verification device is provided, which is applied to a terminal, and the device includes: a first acquisition module, used to obtain a Scheme request of a first application to a second application; a first generation module, used to generate a first random number, and encrypt the first random number through a first identifier to obtain first encrypted information, wherein the first identifier serves as a key, and the first identifier corresponds to the terminal and the first application; a first encryption module, used to encrypt the first encrypted information and the information of the first application to obtain second encrypted information; a first sending module, used to send the Scheme request and the second encrypted information to the second application, so that the second application verifies the Scheme request based on the second encrypted information; a first receiving module, used to receive a response message to the Scheme request from the second application, the response message carrying the first encrypted information; a first determination module, used to decrypt the first encrypted information to obtain a first decryption result, and determine the Scheme request result according to the first decryption result.

[0008] According to a fifth aspect of the present disclosure, a Scheme request verification device is provided, which is applied to a terminal, and the device includes: a second acquisition module, used to obtain a Scheme request of a first application to a second application and second encrypted information, wherein the second encrypted information includes the encrypted information of the first application and the first encrypted information, and the first encrypted information is obtained by encrypting a first random number using a first identifier, and the first identifier corresponds to the terminal and the first application; a first decryption module, used to decrypt the second encrypted information to obtain the information of the first application; a verification module, used to verify the Scheme request according to the information of the first application to obtain a second verification result; a second encryption module, used to re-encrypt the first encrypted information and the information of the first application in response to the second verification result being a passed verification, to obtain the re-encrypted second encrypted information; a second sending module, used to send the re-encrypted second encrypted information to the first application, so that the first application verifies the Scheme request according to the re-encrypted second encrypted information.

[0009] According to a sixth aspect of the present disclosure, a scheme request verification device is provided, which is applied to a terminal and includes: a third acquisition module, configured to obtain a scheme request of a first application to a second application through a first application; a second generation module, configured to generate a first random number through the first application, and encrypt the first random number through a first identifier to obtain first encrypted information, wherein the first identifier serves as a key and corresponds to the terminal and the first application; a third encryption module, configured to encrypt the first encrypted information and information of the first application through the first application to obtain second encrypted information; a fifth sending module, configured to send the scheme request and the second encrypted information to the second application through the first application; a second decryption module, configured to decrypt the second encrypted information through the second application, verify the scheme request based on the information of the first application, and in response to successful verification, send a response message to the scheme request to the first application, wherein the response message carries the first encrypted information; and a second receiving module, configured to receive the response message to the scheme request by the first application, decrypt the first encrypted information to obtain a first decryption result, and determine the scheme request result based on the first decryption result.

[0010] According to a seventh aspect of the present disclosure, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and capable of running on the processor, wherein when the processor executes the program, any one of the scheme request verification methods described in the first to third aspects of the present disclosure is implemented. As can be seen from the above, the scheme request verification method of the embodiment of the present disclosure, the first application initiates a scheme request to the second application, and the scheme request sent to the second application carries a random number encrypted by an identifier corresponding to the terminal and the first application, after receiving the scheme request response message containing the random data, the scheme request result can be determined by decrypting the random number, since the first identifier corresponds to the terminal and the first application, other applications cannot know the first identifier, so if the encrypted random number fails to be decrypted, it means that the current scheme request has been hijacked, and it can be determined that the scheme request has failed, and if the encrypted random number is successfully decrypted, it can be determined that the scheme request is successful, so the scheme request verification method of the embodiment of the present disclosure can avoid malicious applications hijacking and replaying scheme requests, and improve the security of scheme requests between applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0012] Figure 1 is a flowchart illustrating a scheme request verification method according to an exemplary embodiment of the present disclosure;

[0013] Figure 2 is a flowchart of a Scheme request verification method according to an exemplary embodiment of the present disclosure;

[0014] Figure 3 is a flowchart of a Scheme request verification method according to an exemplary embodiment of the present disclosure;

[0015] Figure 4 is a block diagram of a Scheme request verification device according to an exemplary embodiment of the present disclosure;

[0016] Figure 5 is a block diagram of a Scheme request verification device according to an exemplary embodiment of the present disclosure;

[0017] Figure 6 FIG. 4 is a schematic diagram showing a hardware structure of an electronic device according to an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0018] In order to make the objectives, technical solutions and advantages of the present disclosure more clearly understood, the present disclosure is further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings.

[0019] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present disclosure should have the usual meanings understood by people with ordinary skills in the field to which the present disclosure belongs. The "first", "second" and similar words used in the present disclosure do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "comprise" and similar words mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0020] In an exemplary embodiment of the present specification, the first application in the terminal requests to call the second application. When the second application receives the URL Scheme request (hereinafter referred to as the Scheme request) of the first application, it will obtain the bundle id of the calling source (i.e., the first application) through the system callback notification (the bundle id is the unique identifier of the iOS application. In the AppStore, each application has one and only one bundle id), and make a network request to the server of the second application so that the server of the second application can determine whether the bundle id is in the list controlled by the server. If the server does not have the corresponding information for the collected bundle id, it will return a verification failure. However, in the iOS13 operating system, the operating system will retract the ability to obtain the bundle id through system notifications. Therefore, after the release of the iOS13 operating system, there is a risk of failure in the prevention and control of the verification of the Scheme request in the above manner.

[0021] In an exemplary implementation scenario of the present specification, a first application initiates a URL Scheme request to a second application. The first application takes a shopping app as an example, and the second application takes a payment app as an example. When a user shops through the shopping app, he needs to select the payment app on the payment page to make a payment. The shopping app needs to initiate a Scheme request to the payment app. At this time, the payment app and the payment app's server need to verify the Scheme request. The shopping app can send the shopping app's Scheme request to the payment app. The payment app and the payment app's server verify the Scheme request. If the verification is successful, the payment app can authorize the shopping app to log in. If either the payment app or the payment app's server fails to verify the Scheme request, the payment app does not authorize the shopping app to log in.

[0022] Figure 1 is a flowchart of a Scheme request verification method according to an exemplary embodiment of the present disclosure. The method can be applied to a terminal, for example, it can be executed by a Scheme SDK (Software Development Kit) in the terminal, wherein the Scheme SDK is a module in the first application, such as Figure 1 As shown, the method includes:

[0023] Step 101: Obtain a Scheme request from a first application to a second application;

[0024] Step 102: Generate a first random number, and encrypt the first random number using a first identifier to obtain first encrypted information, wherein the first identifier serves as a key, and the first identifier corresponds to the terminal and the first application;

[0025] The first identifier may be, for example, identifierForVendor, which is an attribute of the iOS UDID and is bound to the device (i.e., the terminal) and the application (i.e., the first application). identifierForVendor may be an alphanumeric string that uniquely identifies the device of the application vendor. UDID refers to the iOS system unique device identifier.

[0026] Step 103: Encrypt the first encrypted information and the information of the first application to obtain second encrypted information;

[0027] Before step 103 , a digest calculation may be performed on the Scheme request using SHA256 to obtain digest information of the Scheme request, and the information of the first application may include the digest information.

[0028] Step 104: Send the Scheme request and the second encryption information to the second application, so that the second application verifies the Scheme request based on the second encryption information;

[0029] For example, the second encrypted information may be appended to the end of the Scheme request, so that the Scheme request and the second encrypted information are sent to the second application together.

[0030] Step 105: Receive a response message to the Scheme request from the second application, wherein the response message carries the first encryption information;

[0031] Step 106: Decrypt the first encrypted information to obtain a first decryption result, and determine a Scheme request result based on the first decryption result.

[0032] In step 105 and step 106, according to the response message received from the second application to the Scheme request, determining the Scheme request result may include the following situations:

[0033] Case 1: The response message does not contain encrypted data. In this case, it can be determined that the Scheme request has failed.

[0034] Case 2: The response message contains the second encrypted information, but when decryption of the second encrypted information fails, it can be determined that the Scheme request fails.

[0035] Case 3: The response message contains the second encrypted information. The second encrypted information is successfully decrypted. The decrypted information includes the encrypted random number. The decryption of the random number fails, indicating that the Scheme request has failed.

[0036] Case 4: After successfully decrypting the second encrypted information in the response message, the decrypted first encrypted information is decrypted. The decrypted random number obtained is consistent with the pre-stored random number, and it can be determined that the Scheme request is successful.

[0037] In the Scheme request verification method of the embodiment of the present disclosure, a first application initiates a Scheme request to a second application, and the Scheme request sent to the second application carries a random number encrypted by an identifier corresponding to the terminal and the first application. After receiving the Scheme request response message containing the random data, the Scheme request result can be determined by decrypting the random number. Since the first identifier corresponds to the terminal and the first application, other applications cannot know the first identifier. Therefore, if the decryption of the encrypted random number fails, it means that the current Scheme request has been hijacked, and it can be determined that the Scheme request has failed. However, if the decryption of the encrypted random number is successful, it can be determined that the Scheme request is successful. Therefore, the Scheme request verification method of the embodiment of the present disclosure can avoid malicious applications from hijacking and replaying Scheme requests, thereby improving the security of Scheme requests between applications.

[0038] In one or more embodiments of the present specification, encrypting the first encrypted information and the information of the first application to obtain the second encrypted information may include: encrypting the first encrypted information and the information of the first application by a second identifier to obtain the second encrypted information, wherein the second identifier includes: the application identifier of the first application and the name of the terminal, wherein the application identifier is used to identify the merchant or developer corresponding to the first application. For example, the application identifier of the application is, for example, an App ID, wherein the App ID may be, for example, a unique ID issued by the platform to the developer and merchant, used to mark the application applied for by the developer / merchant. The name of the terminal is, for example, xxx's iPhone, wherein xxx may be the user's name or nickname. In the above step 103, the identifier of the first application and the device identifier may be spliced ​​together, and the spliced ​​field may be used as a key to encrypt the summary information of the Scheme request, the first encrypted information, and the bundle ID of the first application to obtain the second encrypted information.

[0039] In one or more embodiments of the present specification, encrypting the first encrypted information and the information of the first application to obtain the second encrypted information may include: encrypting the summary information, the first encrypted information, the timestamp, and the bundle ID of the first application using the second identifier to obtain the second encrypted information. That is, the data encrypted in step 103 may also include the timestamp. In addition, the summary information of the scheme request, the first encrypted information, the timestamp, and the bundle ID of the first application may be encrypted using the AES256 encryption algorithm and the second identifier.

[0040] In one or more embodiments of the present specification, the information of the first application includes the summary information of the Scheme request and the bundle id of the first application. The above-mentioned Scheme request verification method may further include: after receiving a response message to the Scheme request from the second application, determining whether the response message includes the second encrypted information; when the response message does not include the second encrypted information, determining that the Scheme request result is that the Scheme request fails; when the response message includes the second encrypted information, decrypting the second encrypted information, for example, decrypting the second encrypted information using the above-mentioned second identifier to obtain the summary information of the Scheme request, the bundle id of the first application, and the first encrypted information; decrypting the first encrypted information to obtain a first decryption result, and determining the Scheme request result based on the first decryption result, including: when the decrypted summary information is consistent with the pre-stored summary information, and the decrypted bundle id of the first application is consistent with the pre-stored bundle id of the first application, decrypting the first encrypted information using the first identifier to obtain a second random number, wherein the pre-stored summary information is, for example, Scheme. When the SDK performs digest calculation on the Scheme request, it obtains digest information; if the decrypted digest information is inconsistent with the pre-stored digest information, and / or the decrypted bundle ID of the first application is inconsistent with the pre-stored bundle ID of the first application, it is determined that the Scheme request result is the Scheme request failure; if the first random number is consistent with the second random number, it is determined that the Scheme request result is the Scheme request success; if the first random number is inconsistent with the second random number, it is determined that the Scheme request result is the Scheme request failure. Wherein, when the Scheme request fails, the first application cannot log in to the second application, and when the Scheme request succeeds, the first application can log in to the second application.

[0041] In one or more embodiments of the present specification, the above-mentioned Scheme request verification method may further include: after sending the Scheme request and the second encrypted information to the second application, receiving the decryption failure result of the second application on the second encrypted information, and determining that the Scheme request has failed based on the decryption failure result; when the first application receives the decryption failure result of the second application on the second encrypted information, it can be determined that the Scheme request has failed, and a Scheme request failure notification can be sent to the first application. Alternatively, after sending the Scheme request and the second encrypted information to the second application, receiving the verification failure result of the summary information obtained by decrypting the second encrypted information by the second application, determining that the Scheme request has failed based on the verification failure result, and sending a Scheme request failure notification to the first application. By having the second application verify the summary information of the Scheme request, unauthorized applications can be prevented from hijacking the Scheme request and tampering with the data.

[0042] Figure 2 is a flowchart of a Scheme request verification method according to an exemplary embodiment of the present disclosure, which can be applied to a terminal. For example, the method can be executed by the second application, such as Figure 2 As shown, the method includes:

[0043] Step 201: Obtain a scheme request from a first application to a second application and second encrypted information, wherein the second encrypted information includes the encrypted information of the first application and the first encrypted information, and the first encrypted information is obtained by encrypting the pair of random numbers using a first identifier, and the first identifier corresponds to the terminal and the first application;

[0044] Since the first identifier has been explained above, it will not be described in detail here.

[0045] Step 202: Decrypt the second encrypted information to obtain information of the first application;

[0046] As mentioned above, the second identifier may include the App id and the terminal name. After obtaining the above-mentioned Scheme request, the second application may obtain the App id and the terminal name of the first application. For example, the second application may obtain the terminal name through the system API (Application Programming Interface) [UIDevice currentDevice]. The App id is agreed upon by the second application and the first application, and only the first application and the second application may know the value of the App id.

[0047] Step 203: Verify the Scheme request according to the information of the first application to obtain a second verification result;

[0048] For example, after receiving the bundle ID of the first application, the server can perform a whitelist check on the bundle ID. For example, it can determine whether there is a trusted relationship between the bundle ID of the first application and the App ID of the second application. If the two do have a trusted relationship, the verification is determined to have passed, and the second verification result is verification passed; otherwise, the second result is verification failed. Performing this check can prevent unauthorized applications from calling the services of the second application. The whitelist check, for example, determines whether the bundle ID of the first application is on a whitelist. Applications identified by bundle IDs in the whitelist can access the second application.

[0049] Step 204: In response to the second verification result being a passed verification, re-encrypt the first encrypted information and the information of the first application to obtain re-encrypted second encrypted information;

[0050] It should be noted that, when the second verification result indicates that the verification is successful, the Scheme SDK re-encrypts the first encrypted information and the information of the first application to obtain the re-encrypted second encrypted information. When the second verification result indicates that the verification fails, the second application can send a verification failure message to the Scheme SDK, and the Scheme SDK can notify the first application that the current Scheme request has failed based on the verification failure message.

[0051] Step 205: Send the re-encrypted second encrypted information to the first application, so that the first application verifies the Scheme request according to the re-encrypted second encrypted information.

[0052] For example, after the second application requests the server of the second application to perform a second verification on the bundle ID of the first application, the original SECRAND, timestamp, and the second verification result returned by the server of the second application can be digested using SHA256, and then this information as a whole can be encrypted using the AES256 encryption algorithm with the App ID and device name as the key to generate encrypted data, which is appended to the end of the Scheme request and returned to the Scheme SDK.

[0053] The operation of the Scheme SDK verifying the Scheme request according to the re-encrypted second encryption information may refer to the above step 105 and the detailed explanation of this step.

[0054] In one or more embodiments of the present specification, the information of the first application includes the bundle ID of the first application. Based on this, verifying the Scheme request according to the information of the first application to obtain a second verification result may include: sending the bundle ID to the server of the second application, so that the server of the second application verifies the Scheme request based on the bundle ID. The bundle ID is, for example, an ID issued by the terminal operating system to the application, and the App ID is, for example, an ID used by the service provider to mark the application. For example, 200017 corresponds to the Suning App (an example of the first application), for example, com.suning.iphone = Suning App. The Suning App requests to call the payment app (an example of the second application). The relationship on the payment app's server is App ID = bundle ID = Suning App. Since the Scheme SDK only contains the bundle ID, it is necessary to verify whether the call source is trustworthy. The bundle ID can be transmitted to the payment app's server, and the server will search for the corresponding relationship of the bundle ID. Assume the call source captured by the Scheme SDK is com.weixin.phone, where weixin is the bundle ID of the payment app. Since the payment app server does not have this corresponding relationship, the payment app server will determine that the verification has failed. It should be noted that if the terminal pre-stores the mapping between app IDs and bundle IDs, the terminal can verify the Scheme request based on the information of the first application and obtain a second verification result.

[0055] In one or more embodiments of the present specification, the information of the first application includes the summary information of the Scheme request. Based on this, the Scheme request verification method may further include: after decrypting the second encrypted information, if the decryption fails, sending a decryption failure result to the first application, so that the first application determines that the Scheme request has failed based on the decryption failure result; if the summary information is obtained by decryption, verifying the summary information of the Scheme request based on the summary information obtained by decryption, and if the verification fails, sending the verification failure result to the first application, so that the first application determines that the Scheme request has failed based on the verification failure result. It should be noted that after the second application fails to decrypt the second encrypted information, it can be determined that the Scheme request has failed. In this case, the second application cannot obtain the summary information of the Scheme request, so the second application does not need to verify the Scheme request.

[0056] In one or more embodiments of the present specification, re-encrypting the first encrypted information and the information of the first application may include: re-encrypting the first encrypted information and the information of the first application through a second identifier, wherein the second identifier may include: an application identifier of the first application and the name of the terminal, and the application identifier is used to identify the merchant or developer corresponding to the first application.

[0057] In one or more embodiments of the present specification, a Scheme request verification method is provided, which is applied to a terminal and includes: a first application obtains its Scheme request for a second application; the first application generates a first random number and encrypts the first random number through a first identifier to obtain first encrypted information, wherein the first identifier serves as a key and corresponds to the terminal and the first application; the first application encrypts the first encrypted information and information of the first application to obtain second encrypted information; the first application sends the Scheme request and the second encrypted information to the second application; the second application decrypts the second encrypted information, verifies the Scheme request according to the information of the first application, and in response to successful verification, sends a response message of the Scheme request to the first application, wherein the response message carries the first encrypted information; the first application receives the response message of the Scheme request, decrypts the first encrypted information to obtain a first decryption result, and determines the Scheme request result according to the first decryption result.

[0058] In one or more embodiments of the present specification, the above-mentioned Scheme request verification method may further include: after the first application receives a response message to the Scheme request from the second application, determining whether the response message includes the second encrypted information; when the response message does not include the second encrypted information, determining that the Scheme request result is that the Scheme request fails; when the response message includes the second encrypted information, decrypting the second encrypted information to obtain summary information of the Scheme request, the bundle ID of the first application, and the first encrypted information; the first application decrypts the first encrypted information to obtain a first decryption result, and determining the Scheme request result based on the first decryption result, including: when the decrypted summary information is consistent with the pre-stored summary information, and the decrypted bundle ID of the first application is consistent with the pre-stored bundle ID of the first application, decrypting the first encrypted information using the first identifier to obtain a second random number; when the decrypted summary information is inconsistent with the pre-stored summary information, and / or the decrypted bundle ID of the first application is consistent with the pre-stored bundle ID of the first application, When the ids are inconsistent, the Scheme request result is determined to be the Scheme request failure; when the first random number is consistent with the second random number, the Scheme request result is determined to be the Scheme request success; when the first random number is inconsistent with the second random number, the Sheme request result is determined to be the Scheme request failure.

[0059] Figure 3 FIG. 1 is a flow chart of a Scheme request verification method according to an exemplary embodiment of the present disclosure. Figure 3As shown, the method involves information interaction and information processing between a merchant app (i.e., an example of the above-mentioned first application), a Scheme SDK module (a module in the above-mentioned first application), an application module (i.e., an example of the above-mentioned second application, hereinafter referred to as the application), and an application security risk control module (i.e., an example of the server side of the second application, hereinafter referred to as the application security risk control). Among them, the business Scheme SDK module (hereinafter referred to as the Scheme SDK) is used to assemble the business Scheme request, accept the Scheme response, and collect data for security verification, which may include identifierForVendor, bundle id, timestamp, device name, Scheme summary (i.e., the summary information of the Scheme request above, hereinafter referred to as the Scheme summary), random numbers, and logic for verifying security, including decryption of encrypted data, timestamp verification logic, random number verification logic, and Scheme summary verification logic. The application module is used to route the decrypted data to the application security risk control for security verification; the application security risk control is used to provide security verification capabilities, including the bundle id whitelist verification function. As Figure 3 As shown, the Scheme request verification method includes:

[0060] Step 1: The merchant app sends a Scheme request to the Scheme SDK.

[0061] Step 2: After receiving the Scheme request, the Scheme SDK constructs the business Scheme;

[0062] Step 3: Perform SHA256 calculation on the Scheme request to obtain the digest of the Scheme request and obtain the Scheme digest (i.e., the summary information of the above Scheme request);

[0063] Step 4: Generate a random number, record the random number, use identifierForVendor as the AES key, encrypt the random number, and obtain SECRAND (ie, the first encrypted information).

[0064] Step 5: Collect the bundle ID, timestamp, Scheme summary, and SECRAND of the merchant App, and perform AES encryption using the device name and App ID (i.e., the terminal name) as the key to obtain the encrypted data (i.e., the second encrypted information).

[0065] Step 6: Append the encrypted data to the end of the Scheme request and add the current SDK version information for later compatibility;

[0066] Step 7: Send Scheme request to the application;

[0067] Step 8: After receiving the Scheme request from the business Scheme SDK, the application obtains the merchant App ID and device name, and uses the merchant App ID and device name as the key to decrypt the encrypted data concatenated at the end of the Scheme;

[0068] Step 9: If decryption fails in step 8, the application sends a decryption failure result to the business Scheme SDK;

[0069] Step 10: The Scheme SDK returns a message indicating that the Scheme request failed to the merchant app.

[0070] Step 11: The application verifies the Scheme digest decrypted in step 8 and obtains a verification result;

[0071] Step 12: If the verification fails in step 11, the application sends the verification failure result to the business Scheme SDK;

[0072] Step 13: The business Scheme SDK sends a Scheme request failure result to the merchant app;

[0073] Step 14: The application sends the bundle ID, Scheme summary, SECRAND, and Scheme request of the merchant app decrypted in step 8 to the application security risk control;

[0074] Step 15: Application security risk control determines whether the Scheme request is legal based on the received message. For example, it performs a whitelist check on the bundle ID of the merchant app.

[0075] Step 16: If the verification in step 15 passes, the application performs business routing, obtains the business data corresponding to the Scheme request, and encapsulates the Scheme business results;

[0076] Step 17: The application encrypts the encrypted SECRAND, Scheme digest, timestamp, App ID, and device name with AES.

[0077] Step 18: The application returns the business result to the Scheme SDK;

[0078] Step 19: The Scheme SDK determines whether the service result contains encrypted data. If the service result does not contain encrypted data, it determines that the service request has failed.

[0079] Step 20: The Scheme SDK sends a Scheme request failure result to the merchant app;

[0080] Step 21: The Scheme SDK decrypts the encrypted data in the service result using the App ID and device name. If the decryption fails, the service request is determined to have failed.

[0081] Step 22: The Scheme SDK sends a Scheme request failure result to the merchant app;

[0082] Step 23: The Scheme SDK decrypts the SECRAND obtained in step 21 using the merchant app's identifierForVendor. If the decryption fails, it is determined that the service request has failed, that is, the Scheme request has failed.

[0083] Step 24: The Scheme SDK sends a Scheme request failure result to the merchant app;

[0084] Step 25: The Scheme SDK verifies the Scheme summary. If the verification fails, the service request is determined to have failed.

[0085] Step 26: The Scheme SDK sends a Scheme request failure result to the merchant app;

[0086] Step 27: The Scheme SDK determines the timestamp obtained by decryption in step 21 and verifies it. If the timestamp is greater than a preset duration, it determines that the current Scheme request has timed out. The preset duration may be, for example, 60 seconds, 30 seconds, or 10 seconds, and the duration may be set according to the requested application.

[0087] Step 28: The Scheme SDK sends a Scheme request failure result to the merchant app;

[0088] Step 29: Determine whether all parameters are verified successfully;

[0089] Step 30: If all parameters are verified successfully in step 29, the response data of the Scheme request is returned to the merchant app.

[0090] Figure 4 is a block diagram of a Scheme request verification device according to an exemplary embodiment, which can be applied to a terminal, such as Figure 4 As shown, the device 40 includes:

[0091] A first acquisition module 41 is configured to acquire a Scheme request from a first application to a second application;

[0092] a first generation module 42 configured to generate a first random number and encrypt the first random number using a first identifier to obtain first encrypted information, wherein the first identifier serves as a key and corresponds to the terminal and the first application; and a first encryption module 43 configured to encrypt the first encrypted information and information of the first application to obtain second encrypted information;

[0093] a first sending module 44, configured to send the Scheme request and the second encryption information to the second application, so that the second application verifies the Scheme request based on the second encryption information;

[0094] A first receiving module 45 is configured to receive a response message to the Scheme request from the second application, wherein the response message carries the first encrypted information;

[0095] The first determining module 46 is configured to decrypt the first encrypted information to obtain a first decryption result, and determine a Scheme request result according to the first decryption result.

[0096] In one or more embodiments of the present specification, the information of the first application includes the summary information of the Scheme request and the bundle id of the first application. The above-mentioned iOS-based Scheme request verification device may further include: a first judgment module, configured to, after receiving a response message to the Scheme request from the second application, determine whether the response message includes the second encrypted information; a second determination module, configured to, when the response message does not include the second encrypted information, determine that the Scheme request result is that the Scheme request fails, and when the response message includes the second encrypted information, decrypt the second encrypted information to obtain the summary information of the Scheme request, the bundle id of the first application, and the first encrypted information; the first determination module includes: a decryption unit, configured to, when the decrypted summary information is consistent with the pre-stored summary information and the decrypted bundle id of the first application is consistent with the pre-stored bundle id of the first application, decrypt the first encrypted information using the first identifier to obtain a second random number; a first determination unit, configured to, when the decrypted summary information is inconsistent with the pre-stored summary information and / or the decrypted bundle id of the first application is consistent with the pre-stored bundle id of the first application, decrypt the first encrypted information using the first identifier to obtain a second random number. When the id is inconsistent with the pre-stored first-use bundle id, the Scheme request result is determined to be the Scheme request failure; the second determining unit is used to determine that the Scheme request result is the Scheme request success when the first random number is consistent with the second random number; the third determining unit is used to determine that the Sheme request result is the Scheme request failure when the random number obtained by decryption is inconsistent with the preset random number.

[0097] In one or more embodiments of the present specification, the first encryption module is used to: encrypt the first encrypted information and the information of the first application through a second identifier to obtain the second encrypted information, wherein the second identifier may include: the application identifier of the first application and the name of the terminal, wherein the application identifier is used to identify the merchant or developer corresponding to the first application.

[0098] In one or more embodiments of this specification, the encryption module may be configured to: encrypt the summary information, the first encryption information, the timestamp, and the bundle ID of the first application using the second identifier to obtain the second encryption information.

[0099] In one or more embodiments of the present specification, the above-mentioned Scheme request verification device may further include: a third determination module, configured to, after sending the Scheme request and the second encrypted information to the second application, receive a decryption failure result of the second application on the second encrypted information, and determine that the Scheme request has failed based on the decryption failure result; or, after sending the Scheme request and the second encrypted information to the second application, receive a verification failure result of the second application on the summary information decrypted from the second encrypted information, and determine that the Scheme request has failed based on the verification failure result.

[0100] Figure 5 is a block diagram of a Scheme request verification device according to an exemplary embodiment of the present disclosure, which can be applied to a terminal, such as Figure 5 As shown, the device 50 may include:

[0101] A second obtaining module 51 is configured to obtain a scheme request from a first application to a second application and second encrypted information, wherein the second encrypted information includes the encrypted information of the first application and the first encrypted information, the first encrypted information being obtained by encrypting a first random number using a first identifier, the first identifier corresponding to the terminal and the first application;

[0102] A first decryption module 52, configured to decrypt the second encrypted information to obtain information of the first application;

[0103] a verification module 53, configured to verify the Scheme request according to the information of the first application to obtain a second verification result;

[0104] a second encryption module 54 configured to re-encrypt the first encrypted information and the information of the first application in response to the second verification result being a passed verification, to obtain re-encrypted second encrypted information;

[0105] The second sending module 55 is configured to send the re-encrypted second encrypted information to the first application, so that the first application verifies the Scheme request according to the re-encrypted second encrypted information.

[0106] In one or more embodiments of this specification, the information of the first application includes the bundle ID of the first application, and the verification module is used to: send the bundle ID to the server of the second application, so that the server of the second application verifies the Scheme request based on the bundle ID.

[0107] In one or more embodiments of the present specification, the information of the first application includes summary information of the Scheme request, and the Scheme request verification device may further include: a third sending module, configured to, after the decryption module decrypts the second encrypted information, if decryption fails, send a decryption failure result to the first application, so that the first application determines that the Scheme request has failed based on the decryption failure result; and a fourth sending module, configured to, if the decryption module decrypts the summary information, verify the summary information of the Scheme request based on the decrypted summary information, and if the verification fails, send the verification failure result to the first application, so that the first application determines that the Scheme request has failed based on the verification failure result.

[0108] In one or more embodiments of the present specification, the second encryption module is used to re-encrypt the first encrypted information and the information of the first application through a second identifier, wherein the second identifier may include: the application identifier of the first application and the name of the terminal, wherein the application identifier is used to identify the merchant or developer corresponding to the first application, and the identifier may be the App ID mentioned above.

[0109] In one or more embodiments of the present specification, a scheme request verification device is provided. The device is applied to a terminal and includes: a third acquisition module, configured to obtain, through a first application, a scheme request of the first application for a second application; a second generation module, configured to generate a first random number through the first application and encrypt the first random number using a first identifier to obtain first encrypted information, wherein the first identifier serves as a key and corresponds to the terminal and the first application; a third encryption module, configured to encrypt, through the first application, the first encrypted information and information of the first application to obtain second encrypted information; a fifth sending module, configured to send, through the first application, the scheme request and the second encrypted information to the second application; a second decryption module, configured to decrypt the second encrypted information through the second application, verify the scheme request based on the information of the first application, and, in response to successful verification, send a response message to the scheme request to the first application, the response message carrying the first encrypted information; and a second receiving module, configured to receive the response message to the scheme request by the first application, decrypt the first encrypted information to obtain a first decryption result, and determine a scheme request result based on the first decryption result.

[0110] In one or more embodiments of the present specification, the above-mentioned Scheme request verification device may further include: a second judgment module, configured to, after the first application receives a response message to the Scheme request from the second application, determine whether the response message includes the second encrypted information; if the response message does not include the second encrypted information, determine that the Scheme request result is that the Scheme request fails; if the response message includes the second encrypted information, decrypt the second encrypted information to obtain the summary information of the Scheme request, the bundle id of the first application, and the first encrypted information; the second decryption module is configured to: if the decrypted summary information is consistent with the pre-stored summary information, and the decrypted bundle id of the first application is consistent with the pre-stored bundle id of the first application, decrypt the first encrypted information using the first identifier to obtain a second random number; if the decrypted summary information is inconsistent with the pre-stored summary information, and / or the decrypted bundle id of the first application is consistent with the pre-stored bundle id of the first application, When the ids are inconsistent, the Scheme request result is determined to be the Scheme request failure; when the first random number is consistent with the second random number, the Scheme request result is determined to be the Scheme request success; when the first random number is inconsistent with the second random number, the Sheme request result is determined to be the Scheme request failure.

[0111] This specification also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, any of the above-mentioned Scheme request verification methods is implemented.

[0112] It should be noted that the method of the embodiments of the present disclosure can be performed by a single device, such as a computer or server. The method of the embodiments of the present disclosure can also be applied in a distributed scenario, where multiple devices cooperate to perform the method. In such a distributed scenario, one of the multiple devices may only perform one or more steps of the method of the embodiments of the present disclosure, and the multiple devices will interact with each other to complete the method.

[0113] The foregoing description of this specification describes specific embodiments. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different from that described in the embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order shown or the sequential order to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0114] The apparatus of the above embodiment is used to implement the corresponding method in the above embodiment and has the beneficial effects of the corresponding method embodiment, which will not be described in detail here.

[0115] Figure 6 1 is a more specific schematic diagram of the hardware structure of an electronic device according to an exemplary embodiment of the present disclosure. The device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are communicatively connected to each other within the device via the bus 1050.

[0116] The processor 1010 can be implemented using a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0117] The memory 1020 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage devices, dynamic storage devices, etc. The memory 1020 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 1020 and is called and executed by the processor 1010.

[0118] The input / output interface 1030 is used to connect input / output modules to implement information input and output. The input / output modules can be configured as components within the device (not shown in the figure) or can be externally connected to the device to provide corresponding functions. Input devices may include a keyboard, mouse, touch screen, microphone, various sensors, etc., and output devices may include a display, speaker, vibrator, indicator light, etc.

[0119] The communication interface 1040 is used to connect to a communication module (not shown) to enable communication between the device and other devices. The communication module can communicate via a wired method (such as USB, network cable, etc.) or a wireless method (such as mobile network, WiFi, Bluetooth, etc.).

[0120] The bus 1050 comprises a path for transmitting information between the various components of the device (eg, the processor 1010 , the memory 1020 , the input / output interface 1030 , and the communication interface 1040 ).

[0121] It should be noted that although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040, and the bus 1050, in a specific implementation, the device may also include other components necessary for normal operation. In addition, it will be understood by those skilled in the art that the above device may only include the components necessary to implement the embodiments of this specification, and does not necessarily include all the components shown in the figure.

[0122] The computer-readable media of this embodiment include permanent and non-permanent, removable and non-removable media that can be used to store information by any method or technology. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0123] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present disclosure (including the claims) is limited to these examples. Within the scope of the present disclosure, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the present disclosure as described above, which are not provided in detail for the sake of simplicity.

[0124] In addition, to simplify the description and discussion, and in order not to obscure the present disclosure, known power / ground connections to integrated circuit (IC) chips and other components may or may not be shown in the provided figures. In addition, devices may be shown in the form of block diagrams to avoid obscuring the present disclosure, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform on which the present disclosure is to be implemented (i.e., these details should be fully within the purview of those skilled in the art). Where specific details (e.g., circuits) are set forth to describe exemplary embodiments of the present disclosure, it will be apparent to those skilled in the art that the present disclosure may be implemented without these specific details or with variations in these specific details. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0125] Although the present disclosure has been described in conjunction with specific embodiments thereof, many alternatives, modifications, and variations of these embodiments will be apparent to those skilled in the art based on the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the embodiments discussed.

[0126] The embodiments of the present disclosure are intended to cover all such substitutions, modifications, and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present disclosure should be included in the scope of protection of the present disclosure.

Claims

1. A Scheme request verification method, characterized in that: Applied to a terminal and executed by a Scheme SDK module in the terminal, the method includes: Obtaining a Scheme request from the first application to the second application; Generate a first random number, and encrypt the first random number using a first identifier; wherein the first identifier serves as a key, and the first identifier corresponds to the terminal and the first application; sending the Scheme request, the encrypted first random number, and the information of the first application to the second application, so that the second application verifies the Scheme request based on the encrypted first random number and the information of the first application; receiving a response message to the Scheme request from the second application, wherein the response message carries the encrypted first random number; The encrypted first random number is decrypted to obtain a first decryption result, and a Scheme request result is determined according to the first decryption result.

2. The method according to claim 1, characterized in that Generating a first random number, encrypting the first random number using a first identifier, and sending the Scheme request, the encrypted first random number, and information about the first application to the second application include: encrypting the first random number using the first identifier to obtain first encrypted information; encrypting the first encrypted information and information about the first application to obtain second encrypted information, and sending the Scheme request and the second encrypted information to the second application; The response message carries the first encrypted information, and the decrypting the encrypted first random number to obtain a first decryption result includes: decrypting the first encrypted information to obtain the first decryption result.

3. The method according to claim 2, characterized in that The information of the first application includes summary information of the Scheme request and a bundle ID of the first application. The method further includes: After receiving a response message to the Scheme request from the second application, determining whether the response message includes the second encryption information; When the response message does not include the second encrypted information, the Scheme request result is that the Scheme request fails. When the response message includes the second encrypted information, decrypting the second encrypted information to obtain the summary information of the Scheme request, the bundle ID of the first application, and the first encrypted information; Decrypting the first encrypted information to obtain a first decryption result, and determining a Scheme request result based on the first decryption result, including: When the digest information obtained by decryption is consistent with the pre-stored digest information, and the bundle ID of the first application obtained by decryption is consistent with the pre-stored bundle ID of the first application, decrypting the first encrypted information using the first identifier to obtain a second random number; If the digest information obtained by decryption is inconsistent with the pre-stored digest information, and / or the bundle ID of the first application obtained by decryption is inconsistent with the pre-stored bundle ID of the first application, determining that the Scheme request result is that the Scheme request fails; If the first random number is consistent with the second random number, determining that the Scheme request result is successful; When the first random number is inconsistent with the second random number, it is determined that the Scheme request result is that the Scheme request fails.

4. The method according to claim 2, characterized in that Encrypting the first encrypted information and the information of the first application to obtain second encrypted information includes: The first encrypted information and the information of the first application are encrypted by a second identifier to obtain the second encrypted information, wherein the second identifier includes: an application identifier of the first application and the name of the terminal, and the application identifier is used to identify the merchant or developer corresponding to the first application.

5. The method according to claim 3, characterized in that The method further comprises: After sending the Scheme request and the second encrypted information to the second application, receiving a decryption failure result of the second encrypted information by the second application, and determining that the Scheme request has failed based on the decryption failure result; Alternatively, after sending the Scheme request and the second encrypted information to the second application, a verification failure result of the second application on the summary information decrypted by the second encrypted information is received, and the Scheme request is determined to have failed based on the verification failure result.

6. A Scheme request verification method, characterized in that: Applied to a terminal and executed by a Scheme SDK module in the terminal, the method includes: Obtaining a Scheme request from the first application to the second application, an encrypted first random number, and information about the first application; wherein the encrypted first random number is obtained by encrypting a generated first random number using a first identifier; and the first identifier corresponds to the terminal and the first application; decrypting the encrypted first random number and the information of the first application, and verifying the Scheme request based on the decryption result to obtain a second verification result; In response to the second verification result being a pass, re-encrypting to obtain a re-encrypted first random number; The re-encrypted first random number and the information of the first application are sent to the first application, so that the first application verifies the Scheme request according to the re-encrypted first random number and the information of the first application.

7. The method according to claim 6, characterized in that The encrypted first random number includes second encrypted information; the second encrypted information includes the encrypted information of the first application and the first encrypted information, and the first encrypted information is obtained by encrypting the first random number using the first identifier; The decrypting the encrypted first random number and verifying the Scheme request based on the decryption result to obtain a second verification result includes: decrypting the second encrypted information to obtain information of the first application; and verifying the Scheme request based on the information of the first application to obtain the second verification result; In response to the second verification result being a passed verification, re-encrypting to obtain a re-encrypted first random number includes: in response to the second verification result being a passed verification, re-encrypting the first encrypted information and the information of the first application to obtain re-encrypted second encrypted information; and using the re-encrypted second encrypted information as the re-encrypted first random number.

8. The method according to claim 7, characterized in that The information of the first application includes the bundle ID of the first application. The Scheme request is verified according to the information of the first application to obtain a second verification result, including: The bundle ID is sent to the server of the second application, so that the server of the second application verifies the Scheme request based on the bundle ID.

9. The method according to claim 8, characterized in that The information of the first application includes summary information of the Scheme request, and the method further includes: After decrypting the second encrypted information, if the decryption fails, sending a decryption failure result to the first application, so that the first application determines that the Scheme request fails according to the decryption failure result; If the summary information is obtained by decryption, the summary information of the Scheme request is verified according to the decrypted summary information; if the verification fails, a verification failure result is sent to the first application, so that the first application determines that the Scheme request fails according to the verification failure result.

10. The method according to any one of claims 7 to 9, characterized in that Re-encrypting the first encrypted information and the information of the first application includes: The first encrypted information and the information of the first application are re-encrypted through a second identifier, wherein the second identifier includes: an application identifier of the first application and the name of the terminal, wherein the application identifier is used to identify the merchant or developer corresponding to the first application.

11. A Scheme request verification method, characterized in that: The method is applied to a terminal and executed by a Scheme SDK module in the terminal, and includes: The first application obtains its Scheme request for the second application; The first application generates a first random number and encrypts the first random number using a first identifier; wherein the first identifier serves as a key and corresponds to the terminal and the first application; The first application sends the Scheme request, the encrypted first random number, and the information of the first application to the second application; The second application decrypts the encrypted first random number and the information of the first application, verifies the Scheme request based on the decryption result, and sends a response message to the Scheme request to the first application in response to successful verification, where the response message carries the encrypted first random number; The first application receives a response message to the Scheme request, decrypts the encrypted first random number to obtain a first decryption result, and determines a Scheme request result according to the first decryption result.

12. The method according to claim 11, characterized in that The first application encrypts the first random number and sends the Scheme request, the encrypted first random number, and information about the first application to the second application, including: the first application generates a first random number and encrypts the first random number using a first identifier to obtain first encrypted information; the first application encrypts the first encrypted information and information about the first application to obtain second encrypted information; and the first application sends the second encrypted information together with the Scheme request to the second application. The second application decrypts and verifies the encrypted first random number, including: the second application decrypts the second encrypted information, verifies the Scheme request based on the information of the first application, and in response to successful verification, sends a response message to the Scheme request to the first application, where the response message carries the first encrypted information; The first application receives and decrypts the response message, including: the first application receives the response message of the Scheme request, decrypts the first encrypted information to obtain a first decryption result, and determines the Scheme request result according to the first decryption result.

13. The method according to claim 12, characterized in that The method further comprises: After receiving a response message to the Scheme request from the second application, the first application determines whether the response message includes the second encryption information; When the response message does not include the second encrypted information, determining that the Scheme request result is a failure of the Scheme request; and when the response message includes the second encrypted information, decrypting the second encrypted information to obtain summary information of the Scheme request, the bundle ID of the first application, and the first encrypted information; The first application decrypts the first encrypted information to obtain a first decryption result, and determines a Scheme request result according to the first decryption result, including: When the digest information obtained by decryption is consistent with the pre-stored digest information, and the bundle ID of the first application obtained by decryption is consistent with the pre-stored bundle ID of the first application, decrypting the first encrypted information using the first identifier to obtain a second random number; If the digest information obtained by decryption is inconsistent with the pre-stored digest information, and / or the bundle ID of the first application obtained by decryption is inconsistent with the pre-stored bundle ID of the first application, determining that the Scheme request result is that the Scheme request fails; If the first random number is consistent with the second random number, determining that the Scheme request result is successful; When the first random number is inconsistent with the second random number, it is determined that the Scheme request result is that the Scheme request fails.

14. A Scheme request verification device, characterized in that: The Scheme SDK module applied to the terminal comprises: A first acquisition module, configured to acquire a Scheme request from the first application to the second application; A first generating module, configured to generate a first random number and encrypt the first random number using a first identifier; wherein the first identifier serves as a key and corresponds to the terminal and the first application; a first sending module, configured to send the Scheme request, the encrypted first random number, and the information of the first application to the second application, so that the second application verifies the Scheme request based on the encrypted first random number and the information of the first application; A first receiving module is configured to receive a response message to the Scheme request from the second application, wherein the response message carries the encrypted first random number; The first determination module is configured to decrypt the encrypted first random number to obtain a first decryption result, and determine a Scheme request result according to the first decryption result.

15. The device according to claim 14, characterized in that A first generating module is configured to generate a first random number, encrypt the first random number using a first identifier to obtain first encrypted information, and encrypt the first encrypted information and information of the first application to obtain second encrypted information; The first sending module is configured to send the Scheme request and the second encryption information to the second application; The response message carries the first encrypted information. A first determination module is configured to decrypt the first encrypted information to obtain a first decryption result, and determine a Scheme request result based on the first decryption result.

16. The device according to claim 15, characterized in that The information of the first application includes summary information of the Scheme request and a bundle ID of the first application. The apparatus further includes: A first determining module is configured to, after receiving a response message to the Scheme request from the second application, determine whether the response message includes the second encryption information; a second determining module, configured to, when the response message does not include the second encrypted information, determine that the Scheme request result is a failure of the Scheme request; and, when the response message includes the second encrypted information, decrypt the second encrypted information to obtain summary information of the Scheme request, the bundle ID of the first application, and the first encrypted information; The first determining module includes: a decryption unit configured to, when the decrypted summary information is consistent with the pre-stored summary information and the decrypted bundle ID of the first application is consistent with the pre-stored bundle ID of the first application, decrypt the first encrypted information using the first identifier to obtain a second random number; a first determining unit, configured to determine, when the digest information obtained by decryption is inconsistent with the pre-stored digest information and / or the bundle ID of the first application obtained by decryption is inconsistent with the pre-stored bundle ID of the first application, that the Scheme request result is a failure of the Scheme request; a second determining unit, configured to determine, when the first random number is consistent with the second random number, that the Scheme request result is a success of the Scheme request; The third determining unit is configured to determine, when the random number obtained by decryption is inconsistent with a preset random number, that the Scheme request result is that the Scheme request fails.

17. The device according to claim 15, characterized in that Also includes: The first encryption module is configured to: The first encrypted information and the information of the first application are encrypted using a second identifier to obtain the second encrypted information, wherein the second identifier includes: The application identifier of the first application and the name of the terminal, wherein the application identifier is used to identify the merchant or developer corresponding to the first application.

18. The device according to claim 16, characterized in that The device further comprises: a third determining module, configured to, after sending the Scheme request and the second encrypted information to the second application, receive a decryption failure result of the second encrypted information by the second application, and determine that the Scheme request has failed based on the decryption failure result; Alternatively, after sending the Scheme request and the second encrypted information to the second application, a verification failure result of the second application on the summary information decrypted by the second encrypted information is received, and the Scheme request is determined to have failed based on the verification failure result.

19. A scheme request verification device, characterized in that: The Scheme SDK module applied to the terminal comprises: a second acquisition module, configured to acquire a Scheme request from the first application to the second application, an encrypted first random number, and information about the first application; wherein the encrypted first random number is obtained by encrypting the generated first random number using a first identifier; and the first identifier corresponds to the terminal and the first application; a first decryption module, configured to decrypt the encrypted first random number and information of the first application, and verify the Scheme request based on the decryption result to obtain a second verification result; a second encryption module, configured to, in response to a second verification result indicating a passing verification, re-encrypt the random number to obtain a re-encrypted first random number; The second sending module is used to send the re-encrypted first random number and the information of the first application to the first application, so that the first application verifies the Scheme request according to the re-encrypted first random number and the information of the first application.

20. The device according to claim 19, characterized in that The encrypted first random number includes second encrypted information; the second encrypted information includes the encrypted information of the first application and the first encrypted information, and the first encrypted information is obtained by encrypting the first random number using the first identifier; a first decryption module, configured to decrypt the second encrypted information to obtain information of the first application; Verifying the Scheme request according to the information of the first application to obtain a second verification result; The second encryption module is used to re-encrypt the first encrypted information and the information of the first application in response to the second verification result being a passed verification, to obtain re-encrypted second encrypted information; the re-encrypted second encrypted information is used as the re-encrypted first random number.

21. The device according to claim 20, characterized in that The information of the first application includes the bundle ID of the first application; the device further includes: a verification module; The verification module is used for: The bundle ID is sent to the server of the second application, so that the server of the second application verifies the Scheme request based on the bundle ID.

22. The device according to claim 20, characterized in that The information of the first application includes summary information of the Scheme request, and the apparatus further includes: a third sending module, configured to send a decryption failure result to the first application if decryption fails after the decryption module decrypts the second encrypted information, so that the first application determines that the Scheme request fails according to the decryption failure result; a fourth sending module, configured to verify the summary information of the Scheme request based on the decrypted summary information if the decryption module decrypts the summary information; and if the verification fails, send a verification failure result to the first application, so that the first application determines that the Scheme request fails based on the verification failure result.

23. The device according to any one of claims 20 to 22, characterized in that The second encryption module is configured to re-encrypt the first encrypted information and the information of the first application using a second identifier, wherein the second identifier includes: The application identifier of the first application and the name of the terminal, wherein the application identifier is used to identify the merchant or developer corresponding to the first application.

24. A Scheme request verification device, characterized in that: The device is applied to a Scheme SDK module in a terminal, and includes: A third acquisition module is used to obtain a Scheme request from the first application to the second application through the first application; a second generating module, configured to generate a first random number through a first application, and encrypt the first random number through a first identifier; wherein the first identifier serves as a key, and the first identifier corresponds to the terminal and the first application; A fifth sending module, configured to send the Scheme request, the encrypted first random number, and the information of the first application to the second application through the first application; a second decryption module, configured to decrypt the encrypted first random number and the information of the first application through the second application, verify the Scheme request based on the decryption result, and send a response message to the Scheme request to the first application in response to successful verification, wherein the response message carries the encrypted first random number; The second receiving module is used to receive a response message of the Scheme request through the first application, decrypt the encrypted first random number to obtain a first decryption result, and determine the Scheme request result according to the first decryption result.

25. The device according to claim 24, characterized in that a second generation module, configured to generate a first random number through the first application, and encrypt the first random number through the first identifier to obtain first encrypted information; the first application encrypts the first encrypted information and information of the first application to obtain second encrypted information; and the first application sends the second encrypted information and the Scheme request to the second application; a second decryption module, configured to decrypt the second encrypted information using the second application, verify the Scheme request based on information of the first application, and, in response to successful verification, send a response message to the Scheme request to the first application, the response message carrying the first encrypted information; The second receiving module is configured to receive a response message to the Scheme request through a first application, decrypt the first encrypted information to obtain a first decryption result, and determine a Scheme request result according to the first decryption result.

26. The device according to claim 25, characterized in that The device further comprises: A second determination module is configured to determine, after the first application receives a response message to the Scheme request from the second application, whether the response message includes the second encryption information; When the response message does not include the second encrypted information, determining that the Scheme request result is a failure of the Scheme request; and when the response message includes the second encrypted information, decrypting the second encrypted information to obtain summary information of the Scheme request, the bundle ID of the first application, and the first encrypted information; The second decryption module is used for: When the digest information obtained by decryption is consistent with the pre-stored digest information, and the bundle ID of the first application obtained by decryption is consistent with the pre-stored bundle ID of the first application, decrypting the first encrypted information using the first identifier to obtain a second random number; If the digest information obtained by decryption is inconsistent with the pre-stored digest information, and / or the bundle ID of the first application obtained by decryption is inconsistent with the pre-stored bundle ID of the first application, determining that the Scheme request result is that the Scheme request fails; If the first random number is consistent with the second random number, determining that the Scheme request result is successful; When the first random number is inconsistent with the second random number, it is determined that the Scheme request result is that the Scheme request fails.

27. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the Scheme request verification method according to any one of claims 1 to 13 is implemented.

Images