Plug-in downloading method, device, and electronic device

Abstract

Plug-in download method, device, and electronic device. The present application discloses a plug-in download method and device, which belongs to the field of computer technology and is used to solve security issues in the plug-in download process. The method includes: in response to a plug-in download operation for a target application, obtaining a timestamp of the plug-in download operation and initial interface parameters of a plug-in download interface corresponding to the plug-in download operation; based on the timestamp and the initial interface parameters, performing double-layer encryption processing to obtain encrypted interface parameters; using the encrypted interface parameters as interface parameters, accessing the plug-in download interface to send a plug-in download request to a server; in response to a temporary download address sent by the server for the plug-in download request, downloading the plug-in of the target application through the temporary download address. This method can effectively improve the plug-in security of the target application and avoid malicious plug-in downloading behaviors from occupying server resources.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a plug-in downloading method and device, an electronic device, and a computer-readable storage medium. Background Art

[0002] As the Android plug-in development model is used more and more widely, the security of plug-in downloads is often ignored during development and use, resulting in malicious downloads and tampering of plug-ins. It can be seen that there is a risk of exposing the plug-in source code when the plug-in is maliciously downloaded. If the downloaded plug-in is maliciously tampered with, it will also cause security issues for the application. In addition, malicious downloads of plug-ins will also occupy server resources. In order to solve the security problem of plug-in leakage, the download and update of plug-ins should be strictly controlled. In the prior art, a single hard encryption method for plug-ins is usually adopted, and the security needs to be improved. In addition, the problem of malicious downloads of plug-ins cannot be solved. Summary of the invention

[0003] The embodiments of the present application provide a plug-in downloading method, device, and electronic device, which can prevent the plug-in from being maliciously downloaded, protect the plug-in security from the source, and at the same time, solve the problem of malicious plug-in downloads that occupy server resources.

[0004] In a first aspect, an embodiment of the present application discloses a plug-in download method, which is applied to a client, and the method includes:

[0005] In response to a plug-in download operation for a target application, acquiring a timestamp of the plug-in download operation and initial interface parameters of a plug-in download interface corresponding to the plug-in download operation;

[0006] Based on the timestamp and the initial interface parameters, performing double-layer encryption processing to obtain encrypted interface parameters;

[0007] Using the encrypted interface parameter as an interface parameter, accessing the plug-in download interface to send a plug-in download request to the server;

[0008] In response to the temporary download address sent by the server in response to the plug-in download request, the plug-in of the target application is downloaded through the temporary download address.

[0009] Optionally, the decrypted interface data includes: first encryption information and second encryption information, and the double-layer encryption processing is performed based on the timestamp and the initial interface parameter to obtain the encrypted interface parameter, including:

[0010] Based on the timestamp, an encryption operation is performed using a first encryption algorithm to generate first encrypted information;

[0011] Generate encrypted verification information according to the timestamp and preset information associated with the plug-in download operation;

[0012] Based on the first encrypted information, the preset long vector, the encrypted verification information and the initial interface parameters, an encryption operation is performed using a second encryption algorithm to generate second encrypted information.

[0013] Optionally, the step of performing an encryption operation using a second encryption algorithm based on the first encryption information, the preset long vector, the encryption verification information and the initial interface parameter to generate the second encryption information includes:

[0014] Generate data to be encrypted according to the encryption verification information and at least part of the initial interface parameters;

[0015] Obtaining a dynamic encryption key according to the first encryption information and the preset long vector;

[0016] Based on the dynamic encryption key, the data to be encrypted is encrypted using a second encryption algorithm to generate second encrypted information.

[0017] Optionally, generating encrypted verification information according to the timestamp and preset information associated with the plug-in download operation includes:

[0018] The preset information associated with the timestamp and the plug-in download operation is encrypted to generate encrypted verification information.

[0019] Optionally, the step of performing an encryption operation based on the timestamp and using a first encryption algorithm to generate first encrypted information includes:

[0020] Performing forward zero padding on the milliseconds corresponding to the timestamp to obtain a digital string of a preset length;

[0021] An encryption operation corresponding to a first encryption algorithm is performed on the digital string based on a pre-acquired public key to generate first encrypted information.

[0022] Optionally, the temporary download address is generated by the server through the following method:

[0023] In response to a plug-in download request sent by a target application, obtaining encrypted interface parameters of a plug-in download interface corresponding to the plug-in download request;

[0024] Performing double-layer decryption verification on the encryption interface parameters to obtain a decryption verification result;

[0025] When the decryption verification result indicates that the verification is passed, the server sends a temporary download address for the plug-in download request to the target application.

[0026] In a second aspect, an embodiment of the present application discloses a plug-in downloading device, which is applied to a client, and the device includes:

[0027] A timestamp and interface parameter acquisition module, configured to, in response to a plug-in download operation for a target application, acquire a timestamp of the plug-in download operation and initial interface parameters of a plug-in download interface corresponding to the plug-in download operation;

[0028] An encryption interface parameter acquisition module, used to perform double-layer encryption processing based on the timestamp and the initial interface parameters to obtain encryption interface parameters;

[0029] An interface access module, used to access the plug-in download interface using the encrypted interface parameter as an interface parameter, so as to send a plug-in download request to the server;

[0030] The plug-in download module is used to respond to the temporary download address sent by the server in response to the plug-in download request, and download the plug-in of the target application through the temporary download address.

[0031] Optionally, the encryption interface parameter includes: first encryption information and second encryption information, and the encryption interface parameter acquisition module further includes:

[0032] A first encrypted information generating submodule, configured to generate first encrypted information by performing an encryption operation based on the timestamp and adopting a first encryption algorithm;

[0033] An encrypted verification information generation submodule, used to generate encrypted verification information according to the timestamp and preset information associated with the plug-in download operation;

[0034] The second encryption information generation submodule is used to perform encryption operation using a second encryption algorithm based on the first encryption information, the preset long vector, the encryption verification information and the initial interface parameters to generate second encryption information.

[0035] Optionally, the second encryption information generating submodule is further used to:

[0036] Generate data to be encrypted according to the encryption verification information and at least part of the initial interface parameters;

[0037] Obtaining a dynamic encryption key according to the first encryption information and the preset long vector;

[0038] Based on the dynamic encryption key, the data to be encrypted is encrypted using a second encryption algorithm to generate second encrypted information.

[0039] Optionally, the encryption verification information generation submodule is further used to:

[0040] The preset information associated with the timestamp and the plug-in download operation is encrypted to generate encrypted verification information.

[0041] Optionally, the first encryption information generating submodule is further used to:

[0042] Performing forward zero padding on the milliseconds corresponding to the timestamp to obtain a digital string of a preset length;

[0043] An encryption operation corresponding to a first encryption algorithm is performed on the digital string based on a pre-acquired public key to generate first encrypted information.

[0044] Optionally, the temporary download address is generated by the server through the following method:

[0045] In response to a plug-in download request sent by a target application, obtaining encrypted interface parameters of a plug-in download interface corresponding to the plug-in download request;

[0046] Performing double-layer decryption verification on the encryption interface parameters to obtain a decryption verification result;

[0047] When the decryption verification result indicates that the verification is passed, the server sends a temporary download address for the plug-in download request to the target application.

[0048] In a third aspect, an embodiment of the present application discloses a plug-in download method, which is applied to a server, and the method includes:

[0049] In response to a plug-in download request sent by a target application, obtaining encrypted interface parameters of a plug-in download interface corresponding to the plug-in download request;

[0050] Performing double-layer decryption verification on the encryption interface parameters to obtain a decryption verification result;

[0051] When the decryption verification result indicates that the verification is passed, the server sends a temporary download address for the plug-in download request to the target application;

[0052] In the case where the decryption verification result indicates that the verification has failed, the server denies the target application from downloading the plug-in by accessing the plug-in download interface.

[0053] Optionally, the encryption interface parameters include: first encryption information and second encryption information, and the performing double-layer decryption verification on the encryption interface parameters to obtain a decryption verification result includes:

[0054] Decrypting the first encrypted information using a first decryption algorithm to obtain a digital string of a preset length;

[0055] Obtaining a first timestamp corresponding to the digital string;

[0056] Performing a timeout verification on the plug-in download operation according to the first timestamp to obtain a timeout verification result;

[0057] When the timeout verification result indicates that the verification is passed, decryption and authorization verification are performed according to the first encrypted information and the second encrypted information to obtain a decryption and encryption verification result;

[0058] In the case where the timeout verification result indicates verification failure, a decryption verification result indicating verification failure is obtained.

[0059] Optionally, performing decryption and authorization verification according to the first encrypted information and the second encrypted information to obtain a decryption and authorization verification result includes:

[0060] Obtaining a decryption key according to the first encrypted information and a preset long vector;

[0061] Based on the decryption key, using a second decryption algorithm to decrypt the second encrypted information to obtain first decrypted data, wherein the first decrypted data includes: encryption verification information and initial interface parameters;

[0062] Verifying the encrypted verification information based on the first timestamp and preset information associated with the plug-in download operation to obtain an encrypted information verification result;

[0063] When the encrypted information verification result indicates that the verification is successful, obtaining a decryption verification result indicating that the verification is successful;

[0064] In the case where the encrypted information verification result indicates a verification failure, a decryption verification result indicating a verification failure is obtained.

[0065] Optionally, verifying the encrypted verification information based on the first timestamp and preset information associated with the plug-in download operation to obtain an encrypted information verification result includes:

[0066] Performing preset encryption processing on the first timestamp and preset information associated with the plug-in download operation to generate reference encryption verification information;

[0067] When the encryption verification information and the reference encryption verification information are consistent, obtaining an encryption information verification result indicating successful verification;

[0068] In the case where the encryption verification information and the reference encryption verification information are inconsistent, an encryption information verification result indicating a verification failure is obtained.

[0069] Optionally, the using a first decryption algorithm to decrypt the first encrypted information to obtain a digital string of a preset length includes:

[0070] A decryption operation corresponding to a first decryption algorithm is performed on the first encrypted information based on a preset public key to obtain a digital string of a preset length.

[0071] Optionally, performing a timeout verification on the plug-in download operation according to the first timestamp to obtain a timeout verification result includes:

[0072] Obtaining the current timestamp of the server;

[0073] When the first timestamp is greater than or equal to the timeout threshold from the current timestamp, obtaining a timeout verification result indicating a verification failure;

[0074] In the case where the first timestamp is less than the timeout threshold from the current timestamp, a timeout verification result indicating that the verification is passed is obtained.

[0075] Optionally, obtaining a first timestamp corresponding to the digital string includes:

[0076] Perform forward zero removal processing on the digital string to obtain a first timestamp.

[0077] In a fourth aspect, an embodiment of the present application discloses a plug-in downloading device, which is applied to a server, and the device includes:

[0078] An encryption parameter acquisition module, used to respond to a plug-in download request sent by a target application and acquire an encryption interface parameter of a plug-in download interface corresponding to the plug-in download request;

[0079] A decryption verification module, used to perform double-layer decryption verification on the encryption interface parameters to obtain a decryption verification result;

[0080] An authorization download module, configured to cause the server to send a temporary download address for the plug-in download request to the target application if the decryption verification result indicates that the verification is passed;

[0081] The download rejection module is used to, when the decryption verification result indicates that the verification fails, cause the server to reject the target application from downloading the plug-in by accessing the plug-in download interface.

[0082] Optionally, the encryption interface parameters include: first encryption information and second encryption information, and the decryption verification module further includes:

[0083] A data string acquisition submodule, used to decrypt the first encrypted information using a first decryption algorithm to obtain a digital string of a preset length;

[0084] A timestamp acquisition submodule, used to acquire a first timestamp corresponding to the digital string;

[0085] A timeout verification submodule, used to perform a timeout verification on the plug-in download operation according to the first timestamp to obtain a timeout verification result;

[0086] A first verification result acquisition submodule is used to perform decryption and authorization verification according to the first encrypted information and the second encrypted information to obtain a decryption verification result when the timeout verification result indicates that the verification is passed;

[0087] The second verification result acquisition submodule is used to obtain a decryption verification result indicating verification failure when the timeout verification result indicates verification failure.

[0088] Optionally, the first verification result acquisition submodule is further used to:

[0089] Obtaining a decryption key according to the first encrypted information and a preset long vector;

[0090] Based on the decryption key, using a second decryption algorithm to decrypt the second encrypted information to obtain first decrypted data, wherein the first decrypted data includes: encryption verification information and initial interface parameters;

[0091] Verifying the encrypted verification information based on the first timestamp and preset information associated with the plug-in download operation to obtain an encrypted information verification result;

[0092] When the encrypted information verification result indicates that the verification is successful, obtaining a decryption verification result indicating that the verification is successful;

[0093] In the case where the encrypted information verification result indicates a verification failure, a decryption verification result indicating a verification failure is obtained.

[0094] Optionally, verifying the encrypted verification information based on the first timestamp and preset information associated with the plug-in download operation to obtain an encrypted information verification result includes:

[0095] Performing preset encryption processing on the first timestamp and preset information associated with the plug-in download operation to generate reference encryption verification information;

[0096] When the encryption verification information and the reference encryption verification information are consistent, obtaining an encryption information verification result indicating successful verification;

[0097] In the case where the encryption verification information and the reference encryption verification information are inconsistent, an encryption information verification result indicating a verification failure is obtained.

[0098] Optionally, the data string acquisition submodule is further used to:

[0099] A decryption operation corresponding to a first decryption algorithm is performed on the first encrypted information based on a preset public key to obtain a digital string of a preset length.

[0100] Optionally, the timeout verification submodule is further used to:

[0101] Obtaining the current timestamp of the server;

[0102] When the first timestamp is greater than or equal to the timeout threshold from the current timestamp, obtaining a timeout verification result indicating a verification failure;

[0103] In the case where the first timestamp is less than the timeout threshold from the current timestamp, a timeout verification result indicating that the verification is passed is obtained.

[0104] Optionally, the timestamp acquisition submodule is further used to:

[0105] Perform forward zero removal processing on the digital string to obtain a first timestamp.

[0106] In a fifth aspect, an embodiment of the present application further discloses an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the plug-in download method described in the embodiment of the present application when executing the computer program.

[0107] In a sixth aspect, an embodiment of the present application discloses a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the steps of the plug-in downloading method disclosed in the embodiment of the present application.

[0108] The plug-in download method disclosed in the embodiment of the present application obtains the timestamp of the plug-in download operation and the initial interface parameters of the plug-in download interface corresponding to the plug-in download operation in response to the plug-in download operation for the target application; performs double-layer encryption processing based on the timestamp and the initial interface parameters to obtain encrypted interface parameters; uses the encrypted interface parameters as interface parameters to access the plug-in download interface to send a plug-in download request to the server; and responds to a temporary download address sent by the server for the plug-in download request, downloads the plug-in of the target application through the temporary download address, which helps to improve the security of plug-in downloading.

[0109] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0110] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0111] Figure 1 It is one of the flow charts of the plug-in downloading method disclosed in the embodiment of the present application;

[0112] Figure 2 It is a double-layer encryption processing flow chart in the plug-in downloading method disclosed in the embodiment of the present application;

[0113] Figure 3 This is the second flowchart of the plug-in downloading method disclosed in the embodiment of the present application;

[0114] Figure 4 It is a double-layer decryption verification flow chart in the plug-in download method disclosed in the embodiment of the present application;

[0115] Figure 5 It is a schematic diagram of an application scenario of the plug-in downloading method disclosed in an embodiment of the present application;

[0116] Figure 6 This is one of the schematic diagrams of the plug-in downloading device structure disclosed in the embodiment of the present application;

[0117] Figure 7 This is the second structural diagram of the plug-in downloading device disclosed in the embodiment of the present application;

[0118] Figure 8 This is the third structural diagram of the plug-in downloading device disclosed in the embodiment of the present application;

[0119] Fig. 9 This is the fourth structural diagram of the plug-in downloading device disclosed in the embodiment of the present application;

[0120] Fig.10 A block diagram schematically shows an electronic device for executing the method according to the present application; and

[0121] Fig.11 A storage unit for holding or carrying a program code for implementing the method according to the present application is schematically shown. DETAILED DESCRIPTION

[0122] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0123] like Figure 1 As shown, a plug-in downloading method disclosed in an embodiment of the present application is applied to a client and includes: steps 110 to 140.

[0124] Step 110: In response to a plug-in download operation for a target application, a timestamp of the plug-in download operation and initial interface parameters of a plug-in download interface corresponding to the plug-in download operation are obtained.

[0125] The target application described in the embodiment of the present application is a client application, which runs on the client. The target application communicates through the network connection between the client and the preset server, for example, downloading a plug-in.

[0126] The target application is an application developed based on a plug-in SDK, and the target application may include one or more plug-ins, wherein each plug-in is developed based on the plug-in SDK. For example, developers split the target application into different modules according to different application businesses, and the program packages of these different modules together constitute the target application. For example, for some target applications of the Android operating system, the target application can be split into a login authentication main framework part and a main function plug-in part according to the functional modules, and each main function is developed based on the plug-in SDK, so that each main function can be updated separately.

[0127] The plug-in download method described in the embodiment of the present application can be applied to an application development system, wherein each main functional module of the target application is implemented by each plug-in developed based on a plug-in SDK, and the server can be a background server corresponding to the target application for downloading the update package of the target application.

[0128] For each plug-in developed based on the plug-in SDK, a unified plug-in download interface is set in the target application. The target application can access the preset server by calling the plug-in download interface to obtain the plug-in update information of the target application. For example, obtain the latest version of the target application and determine whether the local plug-in needs to be updated.

[0129] In the embodiment of the present application, the target application can carry one or more interface parameter information such as the target application's identification information (such as package name and / or ID), signature, current version number, update date, host operating system information (such as Android system version), etc. when accessing the preset server by calling the plug-in download interface. After receiving the target application's access, the server determines whether the target application needs to update the plug-in based on the one or more interface parameter information such as the identification information, signature, version number, etc. If necessary, the plug-in update information of the target application is fed back to the target application.

[0130] When the target application determines that the local plug-in needs to be updated, it further assigns values ​​to the parameters of the plug-in download interface according to the preset interface access rules to generate initial interface parameters, and then accesses the plug-in download interface based on the generated initial interface parameters.

[0131] In an embodiment of the present application, the target application performs encryption processing on the plug-in download interface according to a preset encryption method, and accesses the server through the encrypted plug-in download interface. The server is preset with a decryption method that matches the encryption method. The server performs decryption verification on the encrypted plug-in download interface sent by the target application through the decryption method, and after the decryption verification passes, allows the target application to download the corresponding plug-in, so as to improve the security of plug-in acquisition and prevent the plug-in from being maliciously downloaded.

[0132] Therefore, after receiving the plug-in update information fed back by the server, the target application confirms that it needs to perform the plug-in download operation. After that, when further calling the plug-in download interface, the target application first obtains the current system timestamp, as well as the values ​​of various initial interface parameters that need to be passed when calling the plug-in download interface, for subsequent encryption processing of the plug-in download interface. Among them, the timestamp can be the current time of the operating system of the host device of the target application, which can be obtained by calling the system interface; the interface parameters of the plug-in download interface include but are not limited to one or more of the following: the package name, ID, current version number, update date, host operating system information (such as Android system version), etc. of the target application.

[0133] Step 120: Perform double-layer encryption processing based on the timestamp and the initial interface parameters to obtain encrypted interface parameters.

[0134] In the embodiment of the present application, in order to improve the security of the plug-in, the plug-in download interface is double-encrypted.

[0135] Optionally, the encryption interface parameters include: first encryption information and second encryption information, such as Figure 2As shown, the double-layer encryption processing is performed based on the timestamp and the initial interface parameters to obtain the encrypted interface parameters, including: sub-steps 1201 to 1203.

[0136] Sub-step 1201: Based on the timestamp, use a first encryption algorithm to perform an encryption operation to generate first encrypted information.

[0137] After acquiring the timestamp and the initial interface parameters, the target application further generates first encrypted information using a first encryption algorithm according to the timestamp.

[0138] In some embodiments of the present application, an encryption operation is performed based on the timestamp using a first encryption algorithm to generate first encrypted information, including: forward padding the number of milliseconds corresponding to the timestamp with zeros to obtain a digital string of a preset length; and performing an encryption operation corresponding to the first encryption algorithm on the digital string based on a pre-acquired public key to generate first encrypted information.

[0139] Optionally, the first encryption algorithm adopts an asymmetric encryption algorithm. For example, the first encryption algorithm may be an RSA encryption algorithm (RSA algorithm, a public cryptographic key system).

[0140] In the process of obtaining the first encrypted information, the obtained timestamp is first formatted to obtain a digital string of a preset length. Taking the current timestamp obtained as the system time of the host system of the target application expressed in milliseconds as an example, if the milliseconds of the current system time are the digital string "1665627651526" with a length of 13 bits, after forward zero-filling processing, the digital string "0001665627651526" is obtained.

[0141] Optionally, the preset length is set as required.

[0142] In some embodiments of the present application, the public key is a public key that the target application obtains in advance through the server. For example, the public key is a public key that the server sends to the target application. The server can send the public key to the target application at the same time when feeding back the plug-in update information to the target application.

[0143] In some other embodiments of the present application, the public key is a public key obtained by a key center corresponding to the first encryption algorithm. Taking the first encryption algorithm as the RSA encryption algorithm as an example, the public key is a public key that the target application has obtained in advance through a password management bureau or a key center. The private key in the key pair that matches the public key is stored on the server.

[0144] Afterwards, the target application executes a first encryption algorithm (such as an RSA encryption algorithm) on a data string of a preset length obtained after forward zero padding based on the public key to generate first encrypted information.

[0145] Sub-step 1202: Generate encrypted verification information according to the timestamp and preset information associated with the plug-in download operation.

[0146] The preset information includes one or more of the following: identification information of the target application, a token corresponding to the plug-in download operation, and a signature of the target application. Optionally, the identification information includes: a package name and / or ID (Identity document) of the target application. The identification information is information used by the server to identify different target applications.

[0147] The token corresponding to the plug-in download operation is used to identify the current plug-in download operation between the target application and the server. In some embodiments of the present application, the token may be a token obtained during the process of establishing a communication link between the target application and the server when calling the plug-in download interface.

[0148] Optionally, the signature of the target application is used to identify the owner of the target application. Optionally, the signature may carry the developer information of the target application (such as all company names of the target application).

[0149] In some embodiments of the present application, the generation of encrypted verification information based on the preset information associated with the timestamp and the plug-in download operation includes: performing preset encryption processing on the preset information associated with the timestamp and the plug-in download operation to generate encrypted verification information. The preset encryption processing may be MD5 encryption. For example, the timestamp, the package name and ID of the target application, the token corresponding to the plug-in download operation, and the signature of the target application are used as plain text, and an encryption operation is performed through the MD5 (Message-Digest Algorithm) encryption algorithm to obtain a ciphertext, and the obtained ciphertext is used as the encryption verification information for subsequent use.

[0150] Sub-step 1203: Based on the first encrypted information, the preset long vector, the encryption verification information and the initial interface parameters, a second encryption algorithm is used to perform an encryption operation to generate second encrypted information.

[0151] After obtaining the initial interface parameters, the first encryption information and the encryption verification information, an encryption key is further generated based on the first encryption information, data to be encrypted is generated according to the initial interface parameters and the first encryption information, and an encryption operation is performed using a second encryption algorithm to generate second encryption information.

[0152] In some embodiments of the present application, based on the first encryption information, the preset long vector, the encryption verification information and the initial interface parameters, an encryption operation is performed using a second encryption algorithm to generate second encryption information, including: generating data to be encrypted based on the encryption verification information and at least part of the initial interface parameters; obtaining a dynamic encryption key based on the first encryption information and the preset long vector; based on the dynamic encryption key, encrypting the data to be encrypted using a second encryption algorithm to generate second encryption information.

[0153] The preset long vector is key information predetermined by the target application and the server.

[0154] Optionally, the initial interface parameters used for performing encryption operations may be all data in the initial interface parameters.

[0155] In some other embodiments of the present application, the initial interface parameters used for performing encryption operations may also be: the initial interface parameters do not include data in the preset information associated with the plug-in download operation. That is, at least part of the initial interface parameters are: the data in the initial interface parameters other than the signature of the target application. For example, when the initial interface parameters include: the package name, ID, current version number, update date, and host operating system information of the target application, at least part of the initial interface parameters may include: the version number of the target application and the host system version number.

[0156] When generating the second encrypted information, the data to be encrypted includes two parts of data: at least part of the initial interface parameters, and the encrypted verification information obtained through the encryption process in the above steps.

[0157] Furthermore, a dynamic encryption key is obtained according to the preset long vector and the first encrypted information obtained through encryption operation in the above steps. For example, the preset long vector and the first encrypted information are concatenated to obtain a dynamic encryption key. Since the timestamp of generating the first encrypted information changes dynamically with the timing of the plug-in download operation of the plug-in download interface, the first encrypted information changes dynamically each time a plug-in is downloaded. In this way, the key obtained by concatenating the preset long vector and the first encrypted information also changes dynamically, which can improve the security of plug-in downloading.

[0158] Next, the data to be encrypted is encrypted using a second encryption algorithm with the dynamic encryption key to generate second encrypted information. The second encryption algorithm is a symmetric encryption algorithm. For example, the second encryption algorithm may be an AES (Advanced Encryption Standard) encryption algorithm.

[0159] Afterwards, the first encryption information and the second encryption information are used as encryption interface parameters.

[0160] By performing double-layer encryption on the plug-in download interface, the security of plug-in download can be improved.

[0161] Step 130: access the plug-in download interface using the encrypted interface parameter as an interface parameter to send a plug-in download request to the server.

[0162] Afterwards, the target application uses the first encryption information and the second encryption information as encryption interface parameters of the plug-in download interface, accesses the plug-in download interface, and sends a plug-in download request to the server to download the plug-in corresponding to the target application through the server.

[0163] Step 140: In response to the temporary download address sent by the server in response to the plug-in download request, download the plug-in of the target application through the temporary download address.

[0164] After receiving the plug-in download request sent by the target application, the server further decrypts and verifies the interface parameters of the plug-in download interface to determine whether to authorize the plug-in download request. If the server determines to authorize the plug-in download request, a temporary download address for downloading the plug-in of the target application is sent to the target application; if the server determines not to authorize the plug-in download request, feedback information indicating download failure or verification failure is sent to the target application.

[0165] In some embodiments of the present application, the temporary download address is generated by the server through the following method: in response to a plug-in download request sent by a target application, obtaining the encrypted interface parameters of the plug-in download interface corresponding to the plug-in download request; performing double-layer decryption verification on the encrypted interface parameters to obtain a decryption verification result; when the decryption verification result indicates that the verification is passed, the server sends a temporary download address for the plug-in download request to the target application.

[0166] The first decryption algorithm is a decryption algorithm corresponding to the first encryption algorithm. Taking the first encryption algorithm as an RSA encryption algorithm as an example, the first decryption algorithm is an RSA decryption algorithm. The public key used by the first decryption algorithm when decrypting is the public key used by the first encryption algorithm when performing encryption operations.

[0167] After receiving the plug-in download request sent by the target application, the server further parses the interface parameters of the plug-in download interface to obtain the first encryption information and the second encryption information included in the interface parameters. After that, the server decrypts the first encryption information to obtain the first timestamp corresponding to the first encryption information, and obtains the current timestamp of the server as the second timestamp, and then calculates the time difference between the first timestamp and the second timestamp, and if the time difference is less than the preset time difference threshold, the current access is considered valid; otherwise, the current access is considered invalid and the target application is rejected to download the plug-in.

[0168] On the premise that the current access is valid, the server further decrypts the second encrypted information using a decryption operation corresponding to the encryption operation for obtaining the second encrypted information, and obtains the encrypted verification information and the initial interface parameters. After that, data verification is performed based on the encrypted verification information, and if the verification is successful, the temporary download address of the plug-in of the target application is obtained according to the initial interface parameters carried in the interface parameters, and the temporary download address is sent to the target application.

[0169] In this way, after receiving the temporary download address sent by the server, the target application can download the plug-in program package that needs to be updated of the target application from the temporary download address.

[0170] The specific generation process of the temporary download address is described below and will not be repeated here.

[0171] The plug-in download method also disclosed in the embodiment of the present application obtains the timestamp of the plug-in download operation and the initial interface parameters of the plug-in download interface corresponding to the plug-in download operation in response to the plug-in download operation for the target application; performs double-layer encryption processing based on the timestamp and the initial interface parameters to obtain encrypted interface parameters; uses the encrypted interface parameters as interface parameters to access the plug-in download interface to send a plug-in download request to the server; and responds to a temporary download address sent by the server in response to the plug-in download request, downloads the plug-in of the target application through the temporary download address, which helps to improve the security of plug-in downloading.

[0172] The plug-in download method also disclosed in the embodiment of the present application encrypts the plug-in download interface so that the server can use the decryption algorithm negotiated with the target application to decrypt the encrypted plug-in download interface, and perform authorization verification on the access to the plug-in download interface based on the result of the decryption process. Only when the verification is successful, the temporary download address of the plug-in is sent to the target application. If the verification is unsuccessful, the temporary download address of the plug-in is not sent to the target application, thereby effectively improving the plug-in security of the target application.

[0173] On the other hand, for applications that maliciously download plug-ins, when the server performs authorization verification on access to the plug-in download interface, if the verification fails, the temporary download address of the plug-in will not be sent to the application that maliciously downloads plug-ins. In this way, the application that maliciously downloads plug-ins cannot download plug-ins from the server, which can prevent malicious application plug-ins from occupying server resources.

[0174] The present application also discloses a plug-in download method, which is applied to the server. Figure 3 As shown, the method includes: step 310 to step 340.

[0175] Step 310: In response to a plug-in download request sent by a target application, an encrypted interface parameter of a plug-in download interface corresponding to the plug-in download request is obtained.

[0176] The encryption interface parameters include: first encryption information and second encryption information.

[0177] After the server receives the plug-in download request sent by the target application, the server can obtain the encrypted interface parameters of the plug-in download interface corresponding to the plug-in download interface by parsing the encrypted parameters carried in the plug-in download request. As mentioned above, the encrypted interface parameters of the plug-in download interface include: first encrypted information and second encrypted information.

[0178] Step 320, performing double-layer decryption verification on the encryption interface parameters to obtain a decryption verification result.

[0179] Next, the server uses a double-layer decryption method corresponding to the client to decrypt the encrypted interface parameters, and verifies the plug-in download request sent by the target application of the client based on the decryption result to obtain a decryption verification result.

[0180] As mentioned above, the encryption interface parameters include: first encryption information and second encryption information, optionally, such as Figure 4 As shown, the double-layer decryption verification is performed on the encryption interface parameters to obtain the decryption verification result, including: sub-steps 410 to 450.

[0181] Sub-step 410: Decrypt the first encrypted information using a first decryption algorithm to obtain a digital string of a preset length.

[0182] According to the method for generating the first encrypted information for the target application running on the client in the previous text, the first encrypted information is a digital string of a preset length obtained by forward zero padding based on the timestamp of the plug-in download operation, and is obtained by encryption operation using a first encryption algorithm, wherein the timestamp. Correspondingly, on the server side, it is necessary to use a first decryption algorithm corresponding to the first encryption algorithm to decrypt the first encrypted information and obtain a digital string of the preset length. Taking the first encryption algorithm as the RSA encryption algorithm as an example, the first decryption algorithm is the RSA decryption algorithm.

[0183] In some embodiments of the present application, the use of a first decryption algorithm to decrypt the first encrypted information to obtain a digital string of a preset length includes: performing a decryption operation corresponding to the first decryption algorithm on the first encrypted information based on a preset public key to obtain a digital string of a preset length. The preset public key is the same as the public key used to encrypt the first encrypted information. For example, the preset public key can be a public key that the server obtains in advance from a password administration bureau or a key center, and then the public key is stored locally and sent to the target application for encryption.

[0184] Optionally, the target application and the server use a predetermined and mutually matching first encryption algorithm and a first decryption algorithm to perform encryption and decryption processing.

[0185] Sub-step 420, obtaining a first timestamp corresponding to the digital string.

[0186] The step of obtaining a first timestamp corresponding to the digital string includes: performing forward zero removal processing on the digital string to obtain a first timestamp.

[0187] As described in the encryption process above, the digital string of preset length is obtained by previously padding the milliseconds of the timestamp with zeros. Therefore, in the decryption stage, the server needs to restore the digital string of preset length to the milliseconds of the timestamp, which is referred to as the "first timestamp" in the embodiment of the present application.

[0188] Sub-step 430: performing a timeout verification on the plug-in download operation according to the first timestamp to obtain a timeout verification result.

[0189] As can be seen from the foregoing description, the first timestamp is a timestamp corresponding to the plug-in download operation. Next, the server further performs a timeout verification on the plug-in download operation according to the first timestamp.

[0190] In an embodiment of the present application, the timeout verification is performed on the plug-in download operation according to the first timestamp to obtain a timeout verification result, including: obtaining the current timestamp of the server; when the first timestamp is greater than or equal to a timeout threshold from the current timestamp, obtaining a timeout verification result indicating that the verification failed; when the first timestamp is less than the timeout threshold from the current timestamp, obtaining a timeout verification result indicating that the verification passed.

[0191] The timeout threshold is set according to specific needs, for example, it can be set to 1 minute.

[0192] For example, the server can obtain the timestamp of the local system as the current timestamp, and then subtract the first timestamp from the current timestamp to obtain the time difference. If the time difference is greater than or equal to the timeout threshold, it means that the time when the target application initiated the plug-in download request is relatively long from the current time, and exceeds the effective duration corresponding to the timeout threshold. At this time, it can be considered that the verification has failed; if the time difference is less than the timeout threshold, it means that the time when the target application initiated the plug-in download request is within the effective duration corresponding to the timeout threshold. At this time, it can be considered that the verification has succeeded.

[0193] Sub-step 440, when the timeout verification result indicates that the verification is passed, decryption and authorization verification are performed according to the first encrypted information and the second encrypted information to obtain a decryption and encryption verification result.

[0194] If the current plug-in download request passes the timeout verification, the server further decrypts the second encrypted information and verifies the encrypted information based on the decryption result to verify whether the plug-in download request is legal, that is, whether it is a plug-in download request initiated by an authorized application.

[0195] In an embodiment of the present application, decryption and authorization verification are performed based on the first encryption information and the second encryption information, and based on the results of the decryption and authorization verification, a temporary download address for the plug-in download request is sent to the target application, or the target application is denied access to the plug-in download interface to download the plug-in, including: sub-steps 4401 to 4405.

[0196] Sub-step 4401: obtaining a decryption key according to the first encrypted information and a preset long vector.

[0197] In the embodiment of the present application, the specific implementation method of obtaining the decryption key according to the first encryption information and the preset long vector is the same as the specific implementation method of obtaining the dynamic encryption key according to the first encryption information and the preset long vector during the encryption operation performed by the target application, and will not be repeated here.

[0198] Sub-step 4402: Based on the decryption key, a second decryption algorithm is used to decrypt the second encrypted information to obtain first decrypted data, wherein the first decrypted data includes: encryption verification information and initial interface parameters.

[0199] The second decryption algorithm is a decryption algorithm corresponding to the second encryption algorithm mentioned above. Taking the second encryption algorithm as the AES encryption algorithm as an example, the second decryption algorithm is the AES decryption algorithm.

[0200] As can be seen from the encryption process above, the second encrypted information is obtained by performing an encryption operation corresponding to the second decryption algorithm on the encrypted data using the dynamic encryption key obtained from the first encrypted information and the preset long vector. Accordingly, the second encrypted information is subjected to an inverse operation of the encryption operation (i.e., a decryption operation corresponding to the second decryption algorithm) using the same decryption key as the dynamic encryption key, and the encrypted data can be obtained. Furthermore, the encryption verification information and initial interface parameters included in the encrypted data can be obtained.

[0201] Sub-step 4403: verifying the encrypted verification information based on the first timestamp and preset information associated with the plug-in download operation to obtain an encrypted information verification result.

[0202] Among them, for a plug-in download operation, the preset information associated with the plug-in download operation is pre-defined by the server and the target application, and each is the same information stored locally.

[0203] After decrypting and obtaining the encrypted verification information carried in the plug-in download request, the server further verifies the encrypted verification information to determine whether to authorize the plug-in download operation.

[0204] In an embodiment of the present application, the encryption verification information is verified based on the preset information associated with the first timestamp and the plug-in download operation to obtain an encryption information verification result, including: performing preset encryption processing on the first timestamp and the preset information associated with the plug-in download operation to generate reference encryption verification information; when the encryption verification information and the reference encryption verification information are consistent, obtaining an encryption information verification result indicating a successful verification; when the encryption verification information and the reference encryption verification information are inconsistent, obtaining an encryption information verification result indicating a failed verification.

[0205] Among them, the server performs preset encryption processing on the first timestamp and the preset information associated with the plug-in download operation to generate a specific implementation method of reference encryption verification information, which is the same as the specific implementation method of the target application performing preset encryption processing on the timestamp and the preset information associated with the plug-in download operation to generate encryption verification information, and will not be repeated here.

[0206] Afterwards, the server further compares the generated reference encryption verification information with the encryption verification information obtained by decryption to see if they are consistent. If they are consistent, it is determined that the encryption information verification is successful, otherwise, it is determined that the encryption information verification has failed.

[0207] Sub-step 4404, when the encrypted information verification result indicates that the verification is successful, obtain a decryption verification result indicating that the verification is successful.

[0208] Sub-step 4405, when the encrypted information verification result indicates verification failure, obtain a decryption verification result indicating verification failure.

[0209] Sub-step 450, when the timeout verification result indicates verification failure, obtain a decryption verification result indicating verification failure.

[0210] Step 330: When the decryption verification result indicates that the verification is passed, the server sends a temporary download address for the plug-in download request to the target application.

[0211] As can be seen from the foregoing description, when the server passes both the timeout verification and the authorization verification for the plug-in download request, it is considered that the verification is passed, and a decryption verification result indicating that the verification is passed is obtained. In this case, the server further determines the temporary download address of the plug-in to be updated of the target application targeted by the plug-in download request based on the package name, version number and other information of the target application carried in the initial interface parameters, and sends the temporary download address to the target application.

[0212] Step 340: When the decryption verification result indicates a verification failure, the server denies the target application from downloading the plug-in by accessing the plug-in download interface.

[0213] As can be seen from the foregoing description, when the timeout verification result indicates verification failure, or authorization verification fails, the server considers this access invalid and refuses the target application to download the plug-in by accessing the plug-in download interface. For example, a timeout prompt message may be fed back, or a prompt message of download failure or verification failure may be fed back.

[0214] Those skilled in the art should understand that the above specific embodiments are merely one or more feasible embodiments, not the only feasible embodiments, and should not be construed as limitations on the present application.

[0215] The plug-in download method disclosed in the embodiment of the present application obtains the encrypted interface parameters of the plug-in download interface corresponding to the plug-in download request in response to the plug-in download request sent by the target application; performs double-layer decryption verification on the encrypted interface parameters to obtain a decryption verification result; when the decryption verification result indicates that the verification is passed, the server sends a temporary download address for the plug-in download request to the target application; when the decryption verification result indicates that the verification fails, the server refuses the target application to download the plug-in by accessing the plug-in download interface, which helps to improve the security of plug-in downloading.

[0216] The plug-in download method also disclosed in the embodiment of the present application encrypts the plug-in download interface on the client side through the target application, and then the server side uses a decryption algorithm negotiated with the target application to decrypt the encrypted plug-in download interface, and based on the result of the decryption, performs authorization verification on the access to the plug-in download interface. Only when the verification is successful, the temporary download address of the plug-in is sent to the target application. If the verification is unsuccessful, the temporary download address of the plug-in is not sent to the target application, thereby effectively improving the plug-in security of the target application.

[0217] On the other hand, for applications that maliciously download plug-ins, when the server performs authorization verification on access to the plug-in download interface, if the verification fails, the temporary download address of the plug-in will not be sent to the application that maliciously downloads plug-ins. In this way, the application that maliciously downloads plug-ins cannot download plug-ins from the server, which can prevent malicious application plug-ins from occupying server resources.

[0218] In order to facilitate readers to better understand this application, Figure 5 The application scenario shown further explains the plug-in download method disclosed in the embodiment of the present application.

[0219] like Figure 5 As shown, the plug-in download method described in the embodiment of the present application is applied to the client or server. Among them, the client is the host device of the aforementioned target application, and the client can be a smart terminal, a computer, etc.; the target application is an application program, which can be: a small program, a browser application, etc. The server is a background server. The plug-in download method also disclosed in the embodiment of the present application needs to encrypt the plug-in download interface on the target application side, and then the encrypted plug-in download interface is decrypted by the server and verified. After the verification is passed, the target application can download the plug-in. The following is combined with Figure 5 Describe the plug-in download process.

[0220] Step 501: In response to a plug-in download operation for a target application, the client obtains a timestamp of the plug-in download operation and initial interface parameters of a plug-in download interface corresponding to the plug-in download operation.

[0221] Step 502: The client performs double-layer encryption processing based on the timestamp and the initial interface parameters to obtain encrypted interface parameters.

[0222] Step 503: The client accesses the plug-in download interface using the encrypted interface parameter as an interface parameter to send a plug-in download request to the server.

[0223] Step 504: The server obtains encrypted interface parameters of the plug-in download interface corresponding to the plug-in download request in response to the plug-in download request sent by the target application.

[0224] Step 505: The server performs double-layer decryption verification on the encryption interface parameters to obtain a decryption verification result.

[0225] Step 506: When the decryption verification result indicates that the verification is passed, the server sends a temporary download address for the plug-in download request to the target application.

[0226] Step 507: The client downloads the plug-in of the target application through the temporary download address in response to the temporary download address sent by the server in response to the plug-in download request.

[0227] The specific implementation methods of the above steps are described above and will not be repeated here.

[0228] At this point, the target application running on the client has been successfully downloaded to the plug-in.

[0229] If the timeout verification result indicates a verification failure, the target application cannot download the plug-in.

[0230] If authorization verification fails, the target application cannot download the plug-in.

[0231] Correspondingly, the embodiment of the present application also discloses a plug-in downloading device, which is applied to a client, such as Figure 6 As shown, the device comprises:

[0232] A timestamp and interface parameter acquisition module 610 is used to obtain, in response to a plug-in download operation for a target application, a timestamp of the plug-in download operation and initial interface parameters of a plug-in download interface corresponding to the plug-in download operation;

[0233] The encryption interface parameter acquisition module 620 is used to perform double-layer encryption processing based on the timestamp and the initial interface parameters to obtain encryption interface parameters;

[0234] The interface access module 630 is used to access the plug-in download interface using the encrypted interface parameter as the interface parameter to send a plug-in download request to the server;

[0235] The plug-in download module 640 is used to respond to the temporary download address sent by the server in response to the plug-in download request, and download the plug-in of the target application through the temporary download address.

[0236] Optionally, the encryption interface parameters include: first encryption information and second encryption information, such as Figure 7 As shown, the encryption interface parameter acquisition module 620 further includes:

[0237] The first encrypted information generating submodule 6201 is used to perform encryption operation based on the timestamp using a first encryption algorithm to generate first encrypted information;

[0238] The encrypted verification information generation submodule 6202 is used to generate encrypted verification information according to the timestamp and the preset information associated with the plug-in download operation;

[0239] The second encryption information generation submodule 6203 is used to perform encryption operation using a second encryption algorithm based on the first encryption information, the preset long vector, the encryption verification information and the initial interface parameters to generate second encryption information.

[0240] Optionally, the second encryption information generating submodule 6203 is further used to:

[0241] Generate data to be encrypted according to the encryption verification information and at least part of the initial interface parameters;

[0242] Obtaining a dynamic encryption key according to the first encryption information and the preset long vector;

[0243] Based on the dynamic encryption key, the data to be encrypted is encrypted using a second encryption algorithm to generate second encrypted information.

[0244] Optionally, the encryption verification information generation submodule 6202 is further used to:

[0245] The preset information associated with the timestamp and the plug-in download operation is encrypted to generate encrypted verification information.

[0246] Optionally, the first encryption information generating submodule 6201 is further used to:

[0247] Performing forward zero padding on the milliseconds corresponding to the timestamp to obtain a digital string of a preset length;

[0248] An encryption operation corresponding to a first encryption algorithm is performed on the digital string based on a pre-acquired public key to generate first encrypted information.

[0249] Optionally, the temporary download address is generated by the server through the following method:

[0250] In response to a plug-in download request sent by a target application, obtaining encrypted interface parameters of a plug-in download interface corresponding to the plug-in download request;

[0251] Performing double-layer decryption verification on the encryption interface parameters to obtain a decryption verification result;

[0252] When the decryption verification result indicates that the verification is passed, the server sends a temporary download address for the plug-in download request to the target application.

[0253] Correspondingly, the embodiment of the present application also discloses a plug-in downloading device, which is applied to the server, such as Figure 8 As shown, the device comprises:

[0254] The encryption parameter acquisition module 810 is used to respond to the plug-in download request sent by the target application and obtain the encryption interface parameters of the plug-in download interface corresponding to the plug-in download request;

[0255] The decryption verification module 820 is used to perform double-layer decryption verification on the encryption interface parameters to obtain a decryption verification result;

[0256] The authorized download module 830 is used for, when the decryption verification result indicates that the verification is passed, the server sends a temporary download address for the plug-in download request to the target application;

[0257] The download rejection module 840 is used for, when the decryption verification result indicates a verification failure, for the server to reject the target application from downloading the plug-in by accessing the plug-in download interface.

[0258] Optionally, the encryption interface parameters include: first encryption information and second encryption information, such as Fig. 9 As shown, the decryption verification module 820 further includes:

[0259] The data string acquisition submodule 8201 is used to decrypt the first encrypted information using a first decryption algorithm to obtain a digital string of a preset length;

[0260] A timestamp acquisition submodule 8202 is used to acquire a first timestamp corresponding to the digital string;

[0261] A timeout verification submodule 8203 is used to perform a timeout verification on the plug-in download operation according to the first timestamp to obtain a timeout verification result;

[0262] The first verification result acquisition submodule 8204 is used to perform decryption and authorization verification according to the first encrypted information and the second encrypted information to obtain a decryption verification result when the timeout verification result indicates that the verification is passed;

[0263] The second verification result acquisition submodule 8205 is used to obtain a decryption verification result indicating verification failure when the timeout verification result indicates verification failure.

[0264] Optionally, the first verification result obtaining submodule 8204 is further used to:

[0265] Obtaining a decryption key according to the first encrypted information and a preset long vector;

[0266] Based on the decryption key, using a second decryption algorithm to decrypt the second encrypted information to obtain first decrypted data, wherein the first decrypted data includes: encryption verification information and initial interface parameters;

[0267] Verifying the encrypted verification information based on the first timestamp and preset information associated with the plug-in download operation to obtain an encrypted information verification result;

[0268] When the encrypted information verification result indicates that the verification is successful, obtaining a decryption verification result indicating that the verification is successful;

[0269] In the case where the encrypted information verification result indicates a verification failure, a decryption verification result indicating a verification failure is obtained.

[0270] Optionally, verifying the encrypted verification information based on the first timestamp and preset information associated with the plug-in download operation to obtain an encrypted information verification result includes:

[0271] Performing preset encryption processing on the first timestamp and preset information associated with the plug-in download operation to generate reference encryption verification information;

[0272] When the encryption verification information and the reference encryption verification information are consistent, obtaining an encryption information verification result indicating successful verification;

[0273] In the case where the encryption verification information and the reference encryption verification information are inconsistent, an encryption information verification result indicating a verification failure is obtained.

[0274] Optionally, the data string acquisition submodule 8201 is further used to:

[0275] A decryption operation corresponding to a first decryption algorithm is performed on the first encrypted information based on a preset public key to obtain a digital string of a preset length.

[0276] Optionally, the timeout verification submodule 8203 is further used to:

[0277] Obtaining the current timestamp of the server;

[0278] When the first timestamp is greater than or equal to the timeout threshold from the current timestamp, obtaining a timeout verification result indicating a verification failure;

[0279] In the case where the first timestamp is less than the timeout threshold from the current timestamp, a timeout verification result indicating that the verification is passed is obtained.

[0280] Optionally, the timestamp acquisition submodule 8202 is further used to:

[0281] Perform forward zero removal processing on the digital string to obtain a first timestamp.

[0282] The plug-in downloading device disclosed in the embodiment of the present application is used to implement the plug-in downloading method described in the embodiment of the present application. The specific implementation methods of each module of the device will not be repeated here. Please refer to the specific implementation methods of the corresponding steps in the method embodiment.

[0283] A plug-in download device disclosed in an embodiment of the present application obtains a timestamp of the plug-in download operation and initial interface parameters of the plug-in download interface corresponding to the plug-in download operation in response to a plug-in download operation for a target application; performs double-layer encryption processing based on the timestamp and the initial interface parameters to obtain encrypted interface parameters; uses the encrypted interface parameters as interface parameters to access the plug-in download interface to send a plug-in download request to a server; and responds to a temporary download address sent by the server in response to the plug-in download request, downloads the plug-in of the target application through the temporary download address, which helps to improve the security of plug-in downloading.

[0284] The plug-in download device also disclosed in the embodiment of the present application encrypts the plug-in download interface so that the server can use the decryption algorithm negotiated with the target application to decrypt the encrypted plug-in download interface, and perform authorization verification on the access to the plug-in download interface based on the result of the decryption process. Only when the verification is successful, the temporary download address of the plug-in is sent to the target application. If the verification is unsuccessful, the temporary download address of the plug-in is not sent to the target application, thereby effectively improving the plug-in security of the target application.

[0285] On the other hand, for applications that maliciously download plug-ins, when the server performs authorization verification on access to the plug-in download interface, if the verification fails, the temporary download address of the plug-in will not be sent to the application that maliciously downloads plug-ins. In this way, the application that maliciously downloads plug-ins cannot download plug-ins from the server, which can prevent malicious application plug-ins from occupying server resources.

[0286] Each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0287] The above is a detailed introduction to a plug-in downloading method and device provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and a core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

[0288] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0289] The various component embodiments of the present application can be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or digital signal processor (DSP) can be used in practice to implement some or all functions of some or all components in the electronic device according to the embodiment of the present application. The present application can also be implemented as a device or apparatus program (e.g., computer program and computer program product) for executing part or all of the methods described herein. Such a program implementing the present application can be stored on a computer-readable medium, or can have the form of one or more signals. Such a signal can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0290] For example, Fig.10An electronic device that can implement the method according to the present application is shown. The electronic device can be a PC, a mobile terminal, a personal digital assistant, a tablet computer, etc. The electronic device traditionally includes a processor 1010 and a memory 1020 and a program code 1030 stored on the memory 1020 and can be run on the processor 1010, and the processor 1010 implements the method described in the above embodiment when executing the program code 1030. The memory 1020 can be a computer program product or a computer-readable medium. The memory 1020 can be an electronic memory such as a flash memory, an EEPROM (electrically erasable programmable read-only memory), an EPROM, a hard disk or a ROM. The memory 1020 has a storage space 10201 for the program code 1030 of the computer program for executing any method step in the above method. For example, the storage space 10201 for the program code 1030 can include various computer programs for implementing the various steps in the above method respectively. The program code 1030 is a computer-readable code. These computer programs can be read from one or more computer program products or written into the one or more computer program products. These computer program products include a program code carrier such as a hard disk, a compact disk (CD), a memory card or a floppy disk. The computer program includes a computer readable code, which, when executed on an electronic device, causes the electronic device to execute the method according to the above embodiments.

[0291] The embodiment of the present application further discloses a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the steps of the plug-in downloading method described in the embodiment of the present application are implemented.

[0292] Such a computer program product may be a computer-readable storage medium, which may have a computer-readable storage medium having a Fig.10 The memory 1020 in the electronic device shown in the figure is similarly arranged as a storage segment, storage space, etc. The program code can be compressed and stored in the computer-readable storage medium in an appropriate form, for example. The computer-readable storage medium is generally a storage medium such as the reference Fig.11 The portable or fixed storage unit. Generally, the storage unit includes computer readable code 1030', which is a code read by a processor. When the code is executed by the processor, each step in the method described above is implemented.

[0293] References to "one embodiment," "embodiment," or "one or more embodiments" herein mean that a particular feature, structure, or characteristic described in conjunction with the embodiment is included in at least one embodiment of the present application. In addition, please note that examples of the term "in one embodiment" herein do not necessarily all refer to the same embodiment.

[0294] In the description provided herein, a large number of specific details are described. However, it is understood that the embodiments of the present application can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0295] In the claims, any reference signs placed between brackets shall not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present application may be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third etc. does not indicate any order. These words may be interpreted as names.

[0296] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A plug-in download method, applied to a client, characterized in that: The method comprises: In response to a plug-in download operation for a target application, acquiring a timestamp of the plug-in download operation and initial interface parameters of a plug-in download interface corresponding to the plug-in download operation; Based on the timestamp and the initial interface parameters, performing double-layer encryption processing to obtain encrypted interface parameters; Using the encrypted interface parameter as an interface parameter, accessing the plug-in download interface to send a plug-in download request to the server; In response to the temporary download address sent by the server in response to the plug-in download request, download the plug-in of the target application through the temporary download address; The encrypted interface parameters include: first encrypted information and second encrypted information, and the double-layer encryption process is performed based on the timestamp and the initial interface parameters to obtain the encrypted interface parameters, including: Based on the timestamp, an encryption operation is performed using a first encryption algorithm to generate first encrypted information; Generate encrypted verification information according to the timestamp and preset information associated with the plug-in download operation; Based on the first encrypted information, the preset long vector, the encrypted verification information and the initial interface parameter, an encryption operation is performed using a second encryption algorithm to generate second encrypted information; Generate data to be encrypted according to the encryption verification information and at least part of the initial interface parameters; Obtaining a dynamic encryption key according to the first encryption information and the preset long vector; Based on the dynamic encryption key, the data to be encrypted is encrypted using a second encryption algorithm to generate second encrypted information.

2. The method according to claim 1, characterized in that The generating of encrypted verification information according to the timestamp and the preset information associated with the plug-in download operation includes: The preset information associated with the timestamp and the plug-in download operation is encrypted to generate encrypted verification information.

3. The method according to claim 1, characterized in that The step of performing encryption operation based on the timestamp using a first encryption algorithm to generate first encrypted information includes: Performing forward zero padding on the milliseconds corresponding to the timestamp to obtain a digital string of a preset length; An encryption operation corresponding to a first encryption algorithm is performed on the digital string based on a pre-acquired public key to generate first encrypted information.

4. The method according to claim 1, characterized in that The temporary download address is generated by the server through the following method: In response to a plug-in download request sent by a target application, obtaining encrypted interface parameters of a plug-in download interface corresponding to the plug-in download request; Performing double-layer decryption verification on the encryption interface parameters to obtain a decryption verification result; When the decryption verification result indicates that the verification is passed, the server sends a temporary download address for the plug-in download request to the target application.

5. A plug-in download method, applied to a server, characterized in that: The method comprises: In response to a plug-in download request sent by a target application, obtaining encrypted interface parameters of a plug-in download interface corresponding to the plug-in download request; Performing double-layer decryption verification on the encryption interface parameters to obtain a decryption verification result; When the decryption verification result indicates that the verification is passed, the server sends a temporary download address for the plug-in download request to the target application; In the case where the decryption verification result indicates that the verification fails, the server denies the target application from downloading the plug-in by accessing the plug-in download interface; The encryption interface parameters include: first encryption information and second encryption information, and the double-layer decryption verification is performed on the encryption interface parameters to obtain a decryption verification result, including: Decrypting the first encrypted information using a first decryption algorithm to obtain a digital string of a preset length; Obtaining a first timestamp corresponding to the digital string; Performing a timeout verification on the plug-in download operation according to the first timestamp to obtain a timeout verification result; When the timeout verification result indicates that the verification is passed, decryption and authorization verification are performed according to the first encrypted information and the second encrypted information to obtain a decryption and encryption verification result; In the case where the timeout verification result indicates that the verification has failed, obtaining a decryption verification result indicating that the verification has failed; performing decryption and authorization verification according to the first encrypted information and the second encrypted information to obtain the decryption verification result, including: Obtaining a decryption key according to the first encrypted information and a preset long vector; Based on the decryption key, using a second decryption algorithm to decrypt the second encrypted information to obtain first decrypted data, wherein the first decrypted data includes: encryption verification information and initial interface parameters; Based on the first timestamp and preset information associated with the plug-in download operation, verify the encrypted verification information to obtain an encrypted information verification result; When the encrypted information verification result indicates that the verification is successful, obtaining a decryption verification result indicating that the verification is successful; In the case where the encrypted information verification result indicates a verification failure, a decryption verification result indicating a verification failure is obtained.

6. The method according to claim 5, characterized in that The step of verifying the encrypted verification information based on the first timestamp and the preset information associated with the plug-in download operation to obtain an encrypted information verification result includes: Performing preset encryption processing on the first timestamp and preset information associated with the plug-in download operation to generate reference encryption verification information; When the encryption verification information and the reference encryption verification information are consistent, obtaining an encryption information verification result indicating successful verification; In the case where the encryption verification information and the reference encryption verification information are inconsistent, an encryption information verification result indicating a verification failure is obtained.

7. The method according to claim 5, characterized in that The step of using a first decryption algorithm to decrypt the first encrypted information to obtain a digital string of a preset length includes: A decryption operation corresponding to a first decryption algorithm is performed on the first encrypted information based on a preset public key to obtain a digital string of a preset length.

8. The method according to claim 5, characterized in that The performing a timeout verification on the plug-in download operation according to the first timestamp to obtain a timeout verification result includes: Obtaining the current timestamp of the server; When the first timestamp is greater than or equal to the timeout threshold from the current timestamp, obtaining a timeout verification result indicating a verification failure; In the case where the first timestamp is less than the timeout threshold from the current timestamp, a timeout verification result indicating that the verification is passed is obtained.

9. The method according to claim 5, characterized in that The obtaining of a first timestamp corresponding to the digital string includes: Perform forward zero removal processing on the digital string to obtain a first timestamp.

10. A plug-in downloading device, applied to a client, characterized in that: The device comprises: A timestamp and interface parameter acquisition module, configured to, in response to a plug-in download operation for a target application, acquire a timestamp of the plug-in download operation and initial interface parameters of a plug-in download interface corresponding to the plug-in download operation; An encryption interface parameter acquisition module, used to perform double-layer encryption processing based on the timestamp and the initial interface parameters to obtain encryption interface parameters; An interface access module, used to access the plug-in download interface using the encrypted interface parameter as an interface parameter, so as to send a plug-in download request to the server; A plug-in download module, configured to respond to a temporary download address sent by the server in response to the plug-in download request, and download the plug-in of the target application through the temporary download address; The encrypted interface parameters include: first encrypted information and second encrypted information, and the double-layer encryption process is performed based on the timestamp and the initial interface parameters to obtain the encrypted interface parameters, including: Based on the timestamp, an encryption operation is performed using a first encryption algorithm to generate first encrypted information; Generate encrypted verification information according to the timestamp and preset information associated with the plug-in download operation; Based on the first encrypted information, the preset long vector, the encrypted verification information and the initial interface parameter, an encryption operation is performed using a second encryption algorithm to generate second encrypted information; Generate data to be encrypted according to the encryption verification information and at least part of the initial interface parameters; Obtaining a dynamic encryption key according to the first encryption information and the preset long vector; Based on the dynamic encryption key, the data to be encrypted is encrypted using a second encryption algorithm to generate second encrypted information.

11. A plug-in downloading device, applied to a server, characterized in that: The device comprises: An encryption parameter acquisition module, used to respond to a plug-in download request sent by a target application and acquire an encryption interface parameter of a plug-in download interface corresponding to the plug-in download request; A decryption verification module, used to perform double-layer decryption verification on the encryption interface parameters to obtain a decryption verification result; An authorization download module, configured to cause the server to send a temporary download address for the plug-in download request to the target application if the decryption verification result indicates that the verification is passed; A download rejection module, configured to, when the decryption verification result indicates a verification failure, cause the server to reject the target application from downloading the plug-in by accessing the plug-in download interface; The encryption interface parameters include: first encryption information and second encryption information, and the double-layer decryption verification is performed on the encryption interface parameters to obtain a decryption verification result, including: Decrypting the first encrypted information using a first decryption algorithm to obtain a digital string of a preset length; Obtaining a first timestamp corresponding to the digital string; Performing a timeout verification on the plug-in download operation according to the first timestamp to obtain a timeout verification result; When the timeout verification result indicates that the verification is passed, decryption and authorization verification are performed according to the first encrypted information and the second encrypted information to obtain a decryption and encryption verification result; In the case where the timeout verification result indicates verification failure, obtaining a decryption verification result indicating verification failure; The decryption and authorization verification are performed according to the first encrypted information and the second encrypted information to obtain a decryption and authorization verification result, including: Obtaining a decryption key according to the first encrypted information and a preset long vector; Based on the decryption key, using a second decryption algorithm to decrypt the second encrypted information to obtain first decrypted data, wherein the first decrypted data includes: encryption verification information and initial interface parameters; Based on the first timestamp and preset information associated with the plug-in download operation, verify the encrypted verification information to obtain an encrypted information verification result; When the encrypted information verification result indicates that the verification is successful, obtaining a decryption verification result indicating that the verification is successful; In the case where the encrypted information verification result indicates a verification failure, a decryption verification result indicating a verification failure is obtained.

12. An electronic device comprising a memory, a processor, and a program code stored in the memory and executable on the processor, characterized in that: When the processor executes the program code, the plug-in downloading method according to any one of claims 1 to 9 is implemented.

13. A computer-readable storage medium having a program code stored thereon, characterized in that: When the program code is executed by a processor, the steps of the plug-in downloading method described in any one of claims 1 to 9 are implemented.

Images