Interface authentication method, device and equipment, and storage medium

Abstract

The interface authentication method, device, equipment and storage medium provided by the application first acquire application application information and interface permission information of a business module submitted by a developer platform, then perform encryption processing on the application information to obtain a License ciphertext certificate of the business module, the application information includes the application application information and the interface permission information, then perform authentication and certification on the business module according to the License ciphertext certificate, when the authentication and certification pass, generate a service bridge, and make the developer call the interface of the business module through the service bridge. The OpenAPI can have the authentication capabilities of process, module, asymmetric encryption and multiple information verification, thereby avoiding the use of authentication vulnerabilities, bypassing the authorization mechanism, impersonating the identity and other situations, and providing an EAS ecological developer platform website with high security, detailed and comprehensive business modules, integrated specifications and process control for ecological application developers.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of vehicle software, in particular to an interface authentication method and device, equipment and a storage medium. BACKGROUND

[0002] EAS (Automotive Intelligent Vehicle System, hereinafter referred to as EAS) and EAS Core (System Core, hereinafter referred to as EAS Core) included in EAS cover the core capabilities and core technologies of EAS. In order to help EAS ecological developers to realize efficient development, rapid growth and commercial innovation of vehicle applications, EAS Core opens core capabilities to application software developers (hereinafter referred to as developers) through an EAS ecological developer interface system (hereinafter referred to as OpenAPI) to ensure that the core capabilities of EAS Core are more convenient and faster for developers to use. OpenAPI includes OpenAPI modular interface package, development tools, integration specifications and development documents, developer platform and management background.

[0003] In a vehicle system, when performing cross-application communication business scenarios, if the visitor identity is not authenticated, the service interface is directly exposed in the vehicle system, which is a security risk. This will cause the service interface to be used by unauthorized applications in violation of regulations, resulting in business delays and even malicious destruction, which may pose a potential danger to driving. To avoid this risk, the interface service end will usually use some authentication methods. If the authentication is passed, the interface call is allowed, otherwise it is rejected.

[0004] Traditional authentication schemes include permission declaration, signature authentication, package name authentication, password verification, etc. However, these schemes are often loose, and are prone to authentication vulnerability exploitation, bypassing authorization mechanisms, impersonating identities, etc. At the same time, it is not convenient for application developers to integrate the scheme in a standardized manner. SUMMARY

[0005] The present application provides an interface authentication method, device, equipment and storage medium, which solves the technical problems that the authentication scheme of the prior art is prone to authentication vulnerability exploitation, bypassing authorization mechanisms, impersonating identities, etc. and is not convenient for application developers to integrate the scheme in a standardized manner.

[0006] In a first aspect, the present application provides an interface authentication method, comprising:

[0007] Obtaining application application information and interface permission information of a business module submitted by a developer platform;

[0008] Encrypting the application information to obtain a License ciphertext certificate of the business module, the application information including the application application information and the interface permission information;

[0009] According to the License ciphertext certificate, the service module is authenticated, when the authentication is passed, a service bridge is generated, and the interface of the service module is called by the developer through the service bridge.

[0010] In a possible design, the License ciphertext certificate is obtained by encrypting the application information.

[0011] According to the APK package name and the signature digest information in the application application information, application identification information is randomly generated, and the application identification information is used for uniquely identifying the application corresponding to the service module.

[0012] The permission list in the interface permission information is verified and authorized to obtain module permission list information.

[0013] According to the application identification information, the application application information and the module permission list information, a License plaintext certificate is generated.

[0014] The License plaintext certificate is encrypted by a platform private key to obtain the License ciphertext certificate, and the platform private key is stored in the developer platform.

[0015] In a possible design, the License ciphertext certificate is used for authenticating the service module, and the authentication includes:

[0016] According to the platform integration guide, the service module is integrated and authenticated.

[0017] When the integration authentication is completed, the APK package of the service module is run, and the License ciphertext certificate is decrypted, and the authentication is performed according to the decryption result.

[0018] In a possible design, the APK package of the service module is run, and the License ciphertext certificate is decrypted, and the authentication is performed according to the decryption result, and the authentication includes:

[0019] The APK package is run in the EAS system, and interface initialization calling is performed.

[0020] When the EAS system interface initialization is successful, application initialization information is obtained, the application initialization information includes the application identification information, signature information, the APK package name and the License ciphertext certificate.

[0021] The License ciphertext certificate is decrypted by a platform public key to obtain decrypted application information, the decrypted application information includes decrypted application identification information, an APK package name, signature digest information and module permission list information.

[0022] authentication according to the application initialization information and the decrypted application information.

[0023] In a possible design, the authentication according to the application initialization information and the decrypted application information includes:

[0024] comparing whether application identification information in the application initialization information is consistent with decrypted application identification information;

[0025] comparing whether an APK package name in the application initialization information is consistent with decrypted APK package information;

[0026] comparing whether initial signature digest information is consistent with decrypted signature digest information, the initial signature digest information being obtained by performing an abstract algorithm on signature information in the initialization information;

[0027] If the comparison results are all yes, it is determined whether the decrypted module permission list information contains a string of the business module.

[0028] If yes, the authentication is passed.

[0029] In a possible design, after the authentication is passed, the method further includes:

[0030] generating an interface callback instruction, the interface callback instruction being used to instruct to call an interface of the business module.

[0031] In a possible design, the application information and the interface permission information of the business module submitted by the developer platform include:

[0032] When the developer identity authentication is passed, the application name, the APK package name, and the signature digest information corresponding to the business module submitted by the developer platform are obtained.

[0033] The APK package name and the signature digest information are subjected to a normative check.

[0034] When the check is passed, the interface permission information submitted by the developer platform is obtained.

[0035] In a possible design, the normative check on the APK package name and the signature digest information includes:

[0036] checking whether the APK package name conforms to a naming norm; and

[0037] checking whether the signature digest information conforms to a normative length.

[0038] In a possible design, the platform private key is obtained through an asymmetric encryption algorithm, and the asymmetric encryption algorithm includes an RSA algorithm.

[0039] In a second aspect, the present application provides an interface authentication device, comprising:

[0040] An obtaining module is configured to obtain application information and interface permission information of a business module submitted by a developer platform;

[0041] An encryption module is configured to perform encryption processing on the application information to obtain a License ciphertext certificate of the business module, wherein the application information includes the application information and the interface permission information;

[0042] An authentication module is configured to perform authentication on the business module according to the License ciphertext certificate, and generate a service bridge when the authentication is passed, so that the developer calls an interface of the business module through the service bridge.

[0043] In a third aspect, the present application provides an electronic device, comprising a processor and a memory connected with the processor in communication;

[0044] The memory stores computer execution instructions;

[0045] The processor executes the computer execution instructions stored in the memory to implement any one of the possible interface authentication methods provided in the first aspect.

[0046] In a fourth aspect, the present application provides a computer readable storage medium, wherein the computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by a processor to implement any one of the possible interface authentication methods provided in the first aspect.

[0047] In a fifth aspect, the present application provides a computer program product, comprising computer execution instructions, and the computer execution instructions are executed by a processor to implement any one of the possible interface authentication methods provided in the first aspect.

[0048] The interface authentication method, device, equipment and storage medium provided by the application first acquire application application information and interface permission information of a business module submitted by a developer platform, then perform encryption processing on the application information to obtain a License ciphertext certificate of the business module, the application information includes the application application information and the interface permission information, and then the business module is authenticated according to the License ciphertext certificate, when the authentication passes, a service bridge is generated, and the interface of the business module is called by the developer through the service bridge. The OpenAPI can have the authentication capabilities of process, module, asymmetric encryption and multiple information verification, so as to avoid the use of authentication vulnerabilities, bypass the authorization mechanism, impersonate the identity and other situations, and can provide an EAS ecological developer platform website with high security, detailed and comprehensive business modules, integrated specifications and process control for ecological application developers. BRIEF DESCRIPTION OF DRAWINGS

[0049] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, the drawings in the following description are some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0050] Figure 1 A system architecture schematic diagram provided by the embodiments of the present application;

[0051] Figure 2 An application scenario schematic diagram provided by the embodiments of the present application;

[0052] Figure 3 A flowchart of an interface authentication method provided by the embodiments of the present application;

[0053] Figure 4 A flowchart of another interface authentication method provided by the embodiments of the present application;

[0054] Figure 5 A flowchart of another interface authentication method provided by the embodiments of the present application;

[0055] Figure 6 A flowchart of another interface authentication method provided by the embodiments of the present application;

[0056] Figure 7 A flowchart of another interface authentication method provided by the embodiments of the present application;

[0057] Figure 8 A structure schematic diagram of an interface authentication device provided by the embodiments of the present application;

[0058] Figure 9 Another interface authentication device structure diagram provided by an embodiment of the present application is shown in the figure.

[0059] Figure 10 A structure diagram of an electronic device provided by an embodiment of the present application is shown in the figure. DETAILED DESCRIPTION

[0060] The exemplary embodiments will be described in detail herein with reference to the attached drawings. In the following description, the same numbers are used to indicate the same or similar components. The embodiments described in the following exemplary embodiments do not represent all the embodiments consistent with the present application. Rather, they are merely examples of methods and apparatuses consistent with some aspects of the present application as detailed in the appended claims.

[0061] The terms "first", "second", "third", "fourth" and the like used in the description and the claims of the present application and the above-described drawings, if any, are used to distinguish similar objects and are not necessarily used to describe a particular sequential or chronological order. It should be understood that the use of such terms herein is subject to appropriate circumstances and that the embodiments of the present application described herein can be practiced in other than the illustrative order unless specifically stated otherwise. Furthermore, the terms "comprise", "comprising", "include", "including", and "has", "having" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product, or apparatus that comprises a list of steps or units is not necessarily limited to those steps or units that are clearly listed, but can include other steps or units not clearly listed or inherent to such processes, methods, products, or apparatuses.

[0062] OpenAPI can open core capabilities to developers to ensure that the core capabilities of EAS Core are more convenient and faster for developers to use. OpenAPI includes OpenAPI modular interface package, development tools, integration specifications and development documents, developer platform and management background. In the vehicle-side system, when performing cross-application communication business scenarios, if the visitor identity is not authenticated, the service interface is directly exposed in the vehicle contact system, which has security risks. This will cause the service interface to be used by unauthorized applications in violation of regulations, resulting in business delays and even malicious destruction, which may pose a potential danger to driving. To avoid this risk, some authentication methods are usually used by interface service providers. If the authentication is passed, interface calling is allowed, otherwise it is rejected. However, traditional authentication schemes include permission declaration, signature authentication, package name authentication, password verification, etc. However, these schemes are often loose, and are prone to authentication vulnerability exploitation, bypassing the authorization mechanism, impersonating identity, etc. At the same time, it is not convenient for application developers to integrate the scheme in a standardized manner.

[0063] To solve the above problems in the prior art, the application provides an interface authentication method, device and equipment and a storage medium. The application provides the application concept of the interface authentication method, wherein an EAS application developer can register information about a business module on a developer platform, and select a business module to be used to initiate an application to a management background. The management background grants a license file (hereinafter referred to as a License plaintext file) after the application is verified. The License plaintext file is asymmetrically encrypted, for example, by using an RSA algorithm to ensure that the information cannot be illegally decrypted and impersonated. The License plaintext file contains multiple information, such as a developer application package name, an application signature SHA1 digest, an application identification information (AppId) generated for the registered application, and a module permission list information, and the multiple information verification can ensure high security. Meanwhile, standardized integration documents and modularized interface development packages are provided to guide the developer to integrate into the application. When the application of the developer is installed and run on the EAS, the EAS Core service performs interface module authentication on the business module to determine whether the application is allowed to use the related module business capability of the OpenAPI. Thus, the interface authentication method with the advantages of high security, detailed and comprehensive business module, standardized integration, and process control is provided, and the use of authentication vulnerabilities, bypassing of the authorization mechanism, impersonation of the identity, and the like are avoided.

[0064] Figure 1 A system architecture diagram is provided for the embodiments of the application. As shown in the figure, Figure 1 The system architecture includes a cloud-based developer platform, an OpenAPI module, an EAS Core service, and a service provider application. The cloud-based management background is responsible for module uploading, application registration verification, and permission application. The developer can register information about the business module on the developer platform, select a business module to be used to initiate a permission application to the management background, and obtain a License plaintext certificate and an integration specification guide for application integration after the application is approved. The developer platform is open to developers.

[0065] The OpenAPI module level can be divided into multiple relatively independent business modules, such as navigation, voice, multimedia, and air conditioning modules, according to business scenarios, and is responsible for providing interface development packages corresponding to the business modules to the developer to facilitate the developer to freely select (multiple modules can be selected to apply for permissions) according to the business needs, and the business module is detailed and comprehensive.

[0066] The EAS Core service plays a role of a hub of an end-side service in this architecture, and is responsible for application authentication, module management, service bridging, and other core businesses. The interface capabilities of the bottommost OpenAPI business modules are implemented by applications, and these applications collectively form an EAS Core core business capability set, which can open these service interfaces in compliance with uniform technical specifications within the framework of the OpenAPI.

[0067] It should be noted that the business modules and corresponding interface capabilities provided in this application include, but are not limited to, the following: Figure 1 As shown in the architecture.

[0068] Figure 2 This is a schematic diagram illustrating an application scenario provided by an embodiment of this application. For example... Figure 2 As shown, developers register relevant information about business modules on the developer platform 100 in the cloud, select the business modules they need to use, and submit an application to the management backend 200. The management backend 200 is configured to execute the interface authentication method provided in this application embodiment. After the application is approved, it grants an authorized authentication file and further encrypts the file to obtain a License encrypted certificate. The License encrypted certificate is used to authenticate the business module. When the authentication is successful, a service bridge is established. Through the service handover, the developer can call the interface of the business module. This provides the EAS ecosystem developer platform website with high security, detailed and comprehensive business modules, standardized integration, and process control for ecosystem application developers.

[0069] It is worth noting that the developer platform 100 and the management backend 200 can be configured with electronic devices such as computers, servers, and server clusters. This application embodiment does not limit the specific type of electronic device. Figure 2 The developer platform 100 and the management backend 200 in the example are both shown as servers.

[0070] It should be noted that the above application scenarios are merely illustrative, and the interface authentication methods, devices, equipment, and storage media provided in the embodiments of this application include, but are not limited to, the above application scenarios.

[0071] Figure 3 This is a flowchart illustrating an interface authentication method provided in an embodiment of this application. Figure 3 As shown, the interface authentication method provided in this application embodiment includes:

[0072] S101: Obtain application application information and interface permission information of the business modules submitted by the developer platform.

[0073] When a developer has a need to call a business module, they will register on the developer platform to submit an application to call the business module.

[0074] For example, the developer platform can first authenticate the developer's identity. After the identity authentication is successful, the developer creates relevant information about the business module that needs to be called on the developer platform. The developer platform submits this relevant information to the management backend for review, and the management backend obtains the application submitted by the developer platform for the developer to call the business module.

[0075] In a possible design, a possible implementation manner of step S101 is as shown in Figure 4 . Figure 4 Another interface authentication method provided by the embodiment of the present application is shown in a flowchart. As shown in Figure 4 , the embodiment of the present application includes:

[0076] S1011: After the developer identity authentication is passed, the application name, APK package name and signature digest information corresponding to the business module submitted by the developer platform are obtained.

[0077] After the developer identity authentication is passed, the developer can create an application in the application center of the developer platform, and the application is used to refer to the interface capability implementation application of the business module capability in the OpenAPI, that is, the application corresponding to the business module. For example, the developer fills in the application name, APK package name, signature digest information (that is, SHA1 value), shelving platform (such as a vehicle model) and other related information of the application corresponding to the business module in the application center, and the related information is defined as application application information, wherein the APK package name and the signature digest information are necessary credentials for verifying the uniqueness of the application identity. After the developer fills in the application application information in the application center of the developer platform, the developer platform submits the application application information to the management background, that is, the management background obtains the application application information submitted by the developer platform.

[0078] It should be noted that a piece of information is obtained by a digest algorithm to obtain a string of hash values, and the hash values are digests, that is, the signature digest information in the embodiment of the present application. The information is of any length, and the digest is of fixed length. Common digest algorithms include MD5, SHA-1, SHA-256 and the like.

[0079] S1012: The APK package name and the signature digest information are subjected to a specification check.

[0080] After the management background receives the application application information submitted by the developer platform, the specification of the package name (that is, the APK package name) and the signature digest information of the application is checked.

[0081] For example, the management platform checks whether the APK package name conforms to the naming specification, and checks whether the length of the signature digest information (that is, the SHA1 value) conforms to the specification length, so as to ensure security.

[0082] S1013: When the check is passed, the interface permission information submitted by the developer platform is obtained.

[0083] After the APK package name and signature digest information are checked by the management platform, the developer can enter the permission application interface to select a business module that the developer wants to call, such as a car machine service module. The developer platform determines an interface for calling the business module according to the business module applied by the developer, generates interface permission information, and submits the interface permission information to the management background. Correspondingly, the management background obtains the interface permission information.

[0084] The interface authentication method provided by the embodiment of the application, when the developer has a calling requirement for the business module, the developer registers on the developer platform to apply for calling the business module to the developer platform. The developer platform submits the application information and the interface permission information to the management platform, so that the management platform obtains the application information and the interface permission information to provide a prerequisite for the subsequent process of the interface authentication method.

[0085] S102: The application information is encrypted to obtain a License ciphertext certificate of the business module.

[0086] The application information includes the application information and the interface permission information.

[0087] The management background needs to perform related verification in the process of obtaining the application information and the interface permission information submitted by the developer platform, and can also audit the interface permission information. After the audit is passed, the management background automatically organizes all information related to the application, such as at least the APK package name, the signature digest information, the application identification information, the module permission list information, and the like, to encrypt the all information to obtain a corresponding ciphertext file to provide the developer for downloading and using.

[0088] In a possible design, a possible implementation of step S102 is as shown in Figure 5 . Figure 5 Another interface authentication method provided by the embodiment of the application is shown in a flowchart as shown in Figure 5 . The embodiment of the application includes the following steps.

[0089] S1021: Randomly generating application identification information according to the APK package name and the signature digest information in the application information.

[0090] The application identification information is used to uniquely identify the application corresponding to the business module.

[0091] The management background generates the application identifier information AppId of the APK in a random manner after receiving the APK package name and signature digest information in the application application information submitted by the developer platform. The AppId is the unique coding identifier of the application corresponding to the business module (i.e., the interface capability implementation application corresponding to the business module) on the developer platform, needs to be guaranteed to be unique and have a fixed length string, and can be used for unique verification when recorded in the database. If it is not unique, the unique verification is repeated.

[0092] S1022: Verify and authorize the permission list in the interface permission information to obtain module permission list information.

[0093] The management background audits and authorizes the permission list in the interface permission information submitted by the developer platform, obtains the module permission list information according to the corresponding business module that passes the audit and authorization, and the permission list information can represent the audited and authorized business module.

[0094] Specifically, the management background audits and authorizes the permission list after receiving the interface permission information submitted by the developer platform, to obtain the module permission list information.

[0095] S1023: Generate a License plaintext certificate according to the application identifier information, the application application information, and the module permission list information.

[0096] The management platform further collects the application application information after generating the application identifier information and the module permission list information, to generate an original License plaintext certificate according to the APK package name, the signature digest information, the AppId, and the module permission list information, that is, the management background authorization authentication file.

[0097] S1024: Encrypt the License plaintext certificate by using the platform private key to obtain a License ciphertext certificate.

[0098] The management background encrypts the original License plaintext certificate by using the platform private key to generate a final ciphertext License certificate, that is, the License ciphertext certificate. The developer platform holds the public key and the private key that are unique to the whole platform and are generated by the encryption process, that is, the platform public key and the platform private key. The public key and the private key are matched in pairs, and the private key encrypted file needs to be matched with the public key to be decrypted.

[0099] Optionally, the encryption process can be implemented by using an asymmetric encryption algorithm, so that the platform private key and the platform public key can be obtained by using the asymmetric encryption algorithm. The asymmetric encryption algorithm can include an RSA algorithm.

[0100] Optionally, after obtaining the License ciphertext certificate, the management background can also generate a download link for the developer to download the application corresponding to the business module through the download link.

[0101] Optionally, the developer can download the License plaintext certificate of the business module according to the technical specification and integrate it into the project source code.

[0102] The interface authentication method provided by the embodiments of the application, the management background encrypts the application information to obtain the License ciphertext certificate of the business module, thereby completing the cloud authentication of the APK, obtaining the legal authentication certificate of the APK, and encrypting the certificate to make it have high security, ensuring that the business module calling process cannot be illegally decrypted and impersonated. In the embodiments of the application, the management background obtains the License plaintext certificate, so that the calling process of the business module overcomes the defect that the authorization mechanism is bypassed in the prior art.

[0103] S103: authenticating the business module according to the License ciphertext certificate, and generating a service bridge when the authentication is passed, so that the developer can call the interface of the business module through the service bridge.

[0104] Since the License plaintext certificate is associated with the corresponding APK package name, signature digest information, module permission list information, APPId and other information, the License plaintext certificate of each APK (i.e., application) generated is unique and cannot be used interchangeably, that is, each authenticated APK has a dedicated License plaintext certificate. Therefore, the business module can be authenticated according to the License ciphertext certificate to authenticate the related information of the developer and the application itself, to ensure that the identity of the developer and the business module to be called are correct, and whether the business module corresponding to the application has the use permission of the interface of the business module. If the use permission is available, the developer can call the interface of the business module.

[0105] The interface authentication method provided in this application first allows developers to register the software information corresponding to the business modules they wish to call on the developer platform. Then, they select the desired business module and submit a permission request to the management backend. After the management backend approves the request, it grants an authorization certificate (i.e., a plaintext License) and encrypts it using asymmetric encryption, such as RSA, to obtain a ciphertext License, ensuring the information cannot be illegally decrypted or impersonated. The plaintext License includes multiple pieces of information such as the application (APK) package name, signature digest, AppId, and module permission list, ensuring high security. Furthermore, the developer platform provides standardized integration documentation and modular interface development kits to guide developers in integrating these into their applications. Additionally, the management backend, through its EAS Core service capabilities, authenticates the business module based on the ciphertext License, i.e., it authenticates the interface module of the application corresponding to that business module (the interface caller), determining whether to allow the application to use the business capabilities of the OpenAPI business module. As can be seen, the interface authentication method provided in this application embodiment has built an OpenAPI with advantages such as high security, detailed and comprehensive business modules, standardized integration, and process control, which can provide an EAS ecosystem developer platform website for ecosystem application developers.

[0106] Based on the above embodiments, Figure 6 This is a flowchart illustrating another interface authentication method provided in an embodiment of this application. Figure 6 As shown, the embodiments of this application include:

[0107] S301: Obtain application application information and interface permission information of the business modules submitted by the developer platform.

[0108] Possible implementation methods, principles, and technical effects of step S301 Figure 4 Similar to the above description, details can be found elsewhere and will not be repeated here.

[0109] S302: Encrypt the application information to obtain the encrypted license certificate for the business module.

[0110] Possible implementation methods, principles, and technical effects of step S302 Figure 5 Similar to the above description, details can be found elsewhere and will not be repeated here.

[0111] S303: Perform integration certification of business modules in accordance with the platform integration guidelines.

[0112] Integrated authentication is used to authenticate the identity of developers of business modules.

[0113] According to the platform integration guide provided by OpenAPI, the developer configures (meta-data) the application identification information (AppId) in the application manifest file (androidmanifest.xml), and then integrates the License plaintext file under the application engineering directory (assets), integrates the interface development package provided by the business module in the dependent lib library, and completes the development integration authentication.

[0114] S304: When the integration authentication is completed, the APK package of the business module is run and the License ciphertext certificate is decrypted, and authentication is performed according to the decryption result.

[0115] When the development integration authentication is completed, the application APK is installed into the EAS system for running, the interface development package of OpenAPI is called to call the capability of the business module, and the EAS Core service of the management background performs identity authentication and module authentication on the interface caller, that is, the application. Specifically, the APK package of the business module is run and the License ciphertext certificate is decrypted, and it is determined whether the authentication passes according to the decryption result, and when it passes, the business module corresponding to the application is allowed to call the business module interface.

[0116] In a possible design, the possible implementation of step S304 is as shown in Figure 7 , and Figure 7 a flowchart of another interface authentication method provided by an embodiment of the present application is shown. As shown in Figure 7 , the embodiment of the present application includes:

[0117] S3041: Run the APK package in the EAS system and perform interface initialization calling.

[0118] The management background installs the application into the EAS system for running and debugging, that is, runs the APK package in the EAS system and performs interface initialization calling, and then enters an asynchronous waiting stage, waiting for the feedback of the audit result of the EAS Core service.

[0119] S3042: When the EAS system interface initialization is successful, application initialization information is obtained.

[0120] The application initialization information includes application identification information, signature information, APK package name, and License ciphertext certificate.

[0121] After receiving the interface initialization, the EAS Core service scans the application information of the interface caller, that is, the application, to obtain the application identification information, signature information, APK package name, and License ciphertext certificate, collectively referred to as application initialization information.

[0122] S3043: Decrypt the License ciphertext certificate through the platform public key to obtain decrypted application information.

[0123] The decrypted application information includes decrypted application identifier information, APK package name, signature digest information, and module permission list information.

[0124] The License ciphertext certificate is decrypted using the platform public key to obtain decrypted application identifier information, decrypted APK package name, decrypted signature digest information, and decrypted module permission list information, collectively referred to as decrypted application information.

[0125] S3044: Perform authentication and authorization according to the application initialization information and the decrypted application information.

[0126] The decrypted information, i.e., the decrypted application information, is compared with the application identifier information, signature information, and APK package name scanned during interface initialization to confirm the identity legitimacy of the application corresponding to the business module and whether the application has the use permission of the business module interface.

[0127] For example, the application identifier information in the application initialization information is compared with the decrypted application identifier information, the APK package name in the application initialization information is compared with the decrypted APK package, and the initial signature digest information obtained by performing a digest algorithm on the signature information in the initialization information is compared with the decrypted signature digest information. If the comparison results are all yes, it indicates that the identity of the application corresponding to the business module is legitimate, otherwise, it indicates that the identity of the application corresponding to the business module is not legitimate.

[0128] Further, it can be checked whether the decrypted module permission list information contains the string of the business module. If it contains, it is determined that the application corresponding to the business module has the use permission of the business module interface, and the developer can call the interface of the business module, and the authentication and authorization pass. Otherwise, the authentication and authorization fail, the application corresponding to the business module is not allowed to use the business module, and the developer cannot call the interface of the business module.

[0129] S305: When the authentication and authorization pass, generate a service bridge to enable the developer to call the interface of the business module through the service bridge.

[0130] When the authentication and authorization pass, the EAS Core service of the management background starts the business service corresponding to the business module, such as starting the navigation and multimedia services of the navigation module or the multimedia module, and establishes a service bridge, and then notifies the caller, i.e., the application corresponding to the business module, that the interface is ready for the next business communication through an interface callback instruction, so that the developer can call the interface of the business module. The interface callback instruction is used to instruct to call the interface of the business module.

[0131] Optionally, if the authentication fails, the EAS Core service also notifies the caller through the interface callback failure instruction that the caller has no permission to use the interface of the business module.

[0132] The interface authentication method provided by the embodiment of the application can make the OpenAPI have the authentication capabilities of process, module, asymmetric encryption, and multiple information verification, thereby avoiding the use of authentication vulnerabilities, bypassing the authorization mechanism, impersonating an identity, and the like, and can provide an EAS ecological developer platform website with high security, detailed and comprehensive business modules, integrated specifications, and process control for ecological application developers.

[0133] Figure 8 A structural diagram of an interface authentication device provided by the embodiment of the application is shown in FIG. 4. Figure 8 As shown in FIG. 4, the interface authentication device 400 provided by the embodiment of the application includes:

[0134] The obtaining module 401 is configured to obtain application information and interface permission information of a business module submitted by a developer platform.

[0135] The encryption module 402 is configured to perform encryption processing on the application information to obtain a License ciphertext certificate of the business module, the application information including the application information and the interface permission information.

[0136] The authentication module 403 is configured to perform authentication on the business module according to the License ciphertext certificate, and when the authentication is passed, a service bridge is generated to enable the developer to call the interface of the business module through the service bridge.

[0137] In a possible design, the encryption module 402 is specifically configured to:

[0138] randomly generate application identification information according to the APK package name and the signature digest information in the application information, the application identification information being used to uniquely identify an application corresponding to the business module;

[0139] verify and authorize the permission list in the interface permission information to obtain module permission list information;

[0140] generate a License plaintext certificate according to the application identification information, the application information, and the module permission list information;

[0141] perform encryption processing on the License plaintext certificate through a platform private key to obtain the License ciphertext certificate, and the platform private key is stored in the developer platform.

[0142] On the basis of the foregoing, Figure 8 Figure 9 A structural diagram of another interface authentication device provided by the embodiment of the application is shown in FIG. 5. Figure 9 ​As shown, the authentication module 403 in the interface authentication device 400 provided by the embodiments of the present application includes:

[0143] The integrated authentication module 4031 is configured to perform integrated authentication on the service module according to a platform integration guideline;

[0144] The authentication and certification module 4032 is configured to, when the integrated authentication is completed, run the APK package of the service module and decrypt the License ciphertext certificate, and perform authentication and certification according to the decryption result.

[0145] In a possible design, the authentication and certification module 4032 is specifically configured to:

[0146] run the APK package in the EAS system, and perform interface initialization calling;

[0147] When the interface initialization of the EAS system is successful, application initialization information is obtained, and the application initialization information includes application identification information, signature information, an APK package name, and a License ciphertext certificate;

[0148] The License ciphertext certificate is decrypted by using a platform public key to obtain decrypted application information, and the decrypted application information includes decrypted application identification information, the APK package name, signature digest information, and module permission list information;

[0149] The authentication and certification are performed according to the application initialization information and the decrypted application information.

[0150] In a possible design, the authentication and certification module 4032 is further configured to:

[0151] Compare whether the application identification information in the application initialization information is consistent with the decrypted application identification information;

[0152] Compare whether the APK package name in the application initialization information is consistent with the decrypted APK package;

[0153] Compare whether the initial signature digest information is consistent with the decrypted signature digest information, the initial signature digest information being obtained by performing a digest algorithm on the signature information in the initialization information;

[0154] If the comparison results are all yes, it is checked whether the decrypted module permission list information contains a string of the service module;

[0155] If yes, the authentication and certification are passed.

[0156] In a possible design, the authentication and certification module 4032 is further configured to:

[0157] Generate an interface callback instruction, and the interface callback instruction is used to instruct to call the interface of the service module.

[0158] In a possible design, the obtaining module 401 is specifically configured to:

[0159] obtain, after the developer identity authentication passes, application names, APK package names and signature digest information corresponding to the business module submitted by the developer platform;

[0160] perform a normative check on the APK package names and the signature digest information;

[0161] obtain interface permission information submitted by the developer platform when the check passes.

[0162] In a possible design, the interface authentication apparatus 400 further includes a checking module, configured to:

[0163] check whether the APK package name conforms to a naming norm; and

[0164] check whether the signature digest information conforms to a normative length.

[0165] In a possible design, the platform private key is obtained through an asymmetric encryption algorithm, and the asymmetric encryption algorithm includes an RSA algorithm.

[0166] The interface authentication apparatus provided in the embodiments of this application can perform each step of the interface authentication method in the method embodiments, and has similar implementation principles and technical effects, which will not be repeated here.

[0167] Figure 10 A structural schematic diagram of an electronic device provided in the embodiments of this application is shown in FIG. 5. Figure 10 As shown in FIG. 5, the electronic device 500 can include a processor 501 and a memory 502 connected with the processor 501 in communication.

[0168] The memory 502 is configured to store a program. Specifically, the program can include program code, and the program code includes computer execution instructions.

[0169] The memory 502 can include a high-speed RAM memory, and can also include a non-volatile memory (NoN-volatile memory), for example, at least one disk memory.

[0170] The processor 501 is configured to execute the computer execution instructions stored in the memory 502, so as to implement the interface authentication method.

[0171] The processor 501 can be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to perform the operations of the embodiments of the present application.

[0172] The memory 502 can be independent or integrated with the processor 501. When the memory 502 is independent of the processor 501, the electronic device 500 can further include:

[0173] The bus 503 is used to connect the processor 501 and the memory 502. The bus can be an industry standard architecture (ISA) bus, a peripheral component (PCI) bus, an extended industry standard architecture (EISA) bus, or the like. The bus can be divided into an address bus, a data bus, a control bus, and the like, but does not mean that there is only one bus or one type of bus.

[0174] Optionally, in a specific implementation, if the memory 502 and the processor 501 are integrated on a chip, the memory 502 and the processor 501 can communicate through an internal interface.

[0175] The present application also provides a computer readable storage medium, which can include a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes. Specifically, the computer readable storage medium stores computer execution instructions, and the computer execution instructions are used for the steps of the method in the above embodiments.

[0176] The present application also provides a computer program product, which includes computer execution instructions, and the computer instructions are executed by the processor to realize the steps of the method in the above embodiments.

[0177] Other embodiments of the application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. It is intended that the specification and examples be considered as exemplary only, with the true scope and spirit of the application being indicated by the following claims.

[0178] It is to be understood that the application is not limited to the precise construction herein described and as shown in the attached drawings, and that various modifications and changes can be made by those skilled in the art without departing from the scope of the application. The scope of the application is to be indicated by the appended claims, rather than the description.

Claims

1. An interface authentication method, characterized by, The application relates to a method for realizing a business module of an application. The application comprises the following steps: An application information encryption process is performed on the application information to obtain a License ciphertext certificate of the business module, wherein the application information comprises the application application information and the interface permission information. The APK package is run, and the business module is authenticated according to the License ciphertext certificate; when the authentication is passed, a service bridge is generated, and the service bridge is used to enable the developer to call the interface of the business module. The application information encryption process is performed on the application information to obtain a License ciphertext certificate of the business module, wherein the application information comprises the application application information and the interface permission information.

2. The interface authentication method of claim 1, wherein, The application identification information is randomly generated according to the APK package name and the signature digest information in the application application information, and the application identification information is used to uniquely identify the application corresponding to the business module. The module permission list information is obtained by verifying and authorizing the permission list in the interface permission information. The License plaintext certificate is generated according to the application identification information, the application application information and the module permission list information. The License plaintext certificate is encrypted by a platform private key to obtain the License ciphertext certificate, and the platform private key is stored in the developer platform. The authentication of the business module is performed according to the License ciphertext certificate, and the authentication comprises the following steps:

3. The interface authentication method of claim 2, wherein, The business module is integrated and authenticated according to a platform integration guide. When the integration authentication is completed, the APK package of the business module is run, and the License ciphertext certificate is decrypted, and the authentication is performed according to the decryption result. The APK package is run in the EAS system, and interface initialization calling is performed.

4. The interface authentication method of claim 3, wherein, When the EAS system interface initialization is successful, application initialization information is obtained, the application initialization information comprises the application identification information, signature information, the APK package name and the License ciphertext certificate. The License ciphertext certificate is decrypted by a platform public key to obtain decrypted application information, the decrypted application information comprises the decrypted application identification information, the APK package name, signature digest information and module permission list information. The authentication is performed according to the application initialization information and the decrypted application information. The authentication is performed according to the application initialization information and the decrypted application information, and the authentication comprises the following steps: The application identification information in the application initialization information is compared with the decrypted application identification information.

5. The interface authentication method of claim 4, wherein, The APK package name in the application initialization information is compared with the decrypted APK package. The initial signature digest information is compared with the decrypted signature digest information, the initial signature digest information is obtained by performing an algorithm on the signature information in the initialization information. ​ ​ If the comparison results are all yes, it is determined whether the decrypted module permission list information contains the string of the business module; If yes, the authentication is performed.

6. The interface authentication method of claim 5, wherein, After the authentication, the following steps are further included: An interface callback instruction is generated, and the interface callback instruction is used to instruct to call the interface of the business module.

7. The method of authenticating an interface of any of claims 2-6, wherein, The application information and the interface permission information of the business module submitted by the developer platform are obtained, including: After the developer identity authentication is passed, the application name, the APK package name and the signature digest information of the business module submitted by the developer platform are obtained; The APK package name and the signature digest information are subjected to a standardization check; When the check is passed, the interface permission information submitted by the developer platform is obtained.

8. The interface authentication method of claim 7, wherein, The standardization check on the APK package name and the signature digest information includes: It is checked whether the APK package name conforms to the naming standard; and It is checked whether the signature digest information conforms to the standard length.

9. The interface authentication method of claim 8, wherein, The platform private key is obtained through an asymmetric encryption algorithm, and the asymmetric encryption algorithm includes an RSA algorithm.

10. An interface authentication apparatus, characterized by comprising: It includes: An obtaining module is configured to obtain application information and interface permission information of a business module submitted by a developer platform; the application information includes an APK package name of the application; The business module is used to implement the application; An encryption module is configured to encrypt application information to obtain a License ciphertext certificate of the business module; the application information includes the application information and the interface permission information; An authentication module is configured to, after running the APK package, authenticate the business module according to the License ciphertext certificate; when the authentication is passed, a service bridge is generated, and the service bridge is used to enable a developer to call an interface of the business module.

11. An electronic device, comprising: It includes: A processor and a memory connected with the processor in communication; The memory stores computer execution instructions; The processor executes the computer execution instructions stored in the memory to implement the interface authentication method according to any one of claims 1-9.

12. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by the processor to implement the interface authentication method according to any one of claims 1-9.

13. A computer program product, including computer execution instructions, which are executed by a processor to implement the interface authentication method according to any one of claims 1-9.

Images