Service providing method and apparatus for third-party applet

Abstract

Embodiments of the present specification provide a third-party applet service providing method and device. In the method, a second-party server obtains a public key sent by a first-party client; obtains an OpenID (OpenID) and generates a SessionID (SessionID); establishes a correspondence between the public key, the OpenID and the SessionID; according to the correspondence established in advance, finds the public key corresponding to the SessionID carried in a business data request; uses the found public key to verify a signature of a business parameter signed by a private key; after verification, sends a business resource request to a third-party server, sends response data returned by the third-party server to the first-party client, and sends the response data to a third-party client by the first-party client. Embodiments of the present specification can improve the security of the third-party applet service.

Description

Technical Field

[0001] This specification relates to network communication technology in one or more embodiments, and more particularly to a method and apparatus for providing services through third-party mini-programs. Background Technology

[0002] With the continuous development of software development technology, mini-programs have gradually entered the public eye due to their speed and convenience. A mini-program is an application that can be used without downloading or installation. As third-party software, mini-programs generally need to be hosted within a host program, which provides business interfaces that enable various business functions. Examples include Alipay mini-programs, 360 mini-programs, and Toutiao mini-programs.

[0003] When providing services to third-party mini-programs, the following network nodes are typically involved: third-party client (i.e., the application loaded on the terminal device), third-party server (i.e., the server providing services to the third-party mini-program), second-party server, first-party client (i.e., the application loaded on the terminal device), and first-party server (i.e., the server providing services to the host application). The first-party server stores the user's original user ID. To avoid privacy leaks of the original user ID, the second-party server stores the OpenID mapped from the original user ID. When providing services to the third-party mini-program, the original user ID is no longer used; instead, the OpenID is used as the user identifier, and the service is provided to the third-party mini-program through processing by the second-party server.

[0004] However, in existing technologies, the service resources enjoyed by third-party mini-programs are often stolen, which greatly reduces security. Summary of the Invention

[0005] This specification describes one or more embodiments of a method and apparatus for providing services through third-party mini-programs, which can improve the security of third-party mini-program services.

[0006] According to the first aspect, a method for providing services through a third-party mini-program is provided, the method comprising:

[0007] Obtain the public key sent by the first-party client; this public key is the public key of a public-private key pair generated by the third-party client and sent to the first-party client by the third-party client.

[0008] Obtain the OpenID identifier and generate the SessionID identifier;

[0009] Establish the mapping relationship between the public key, OpenID, and SessionID;

[0010] Receive a business data request from a first-party client, the business data request carrying the SessionID and business parameters signed using the private key in the public-private key pair;

[0011] Based on the pre-established correspondence, find the public key corresponding to the SessionID carried in the business data request;

[0012] Use the found public key to verify the signature of the business parameters after signing the private key;

[0013] After successful verification, a business resource request is sent to the third-party server. This business resource request carries the OpenID corresponding to the SessionID carried in the business request.

[0014] The response data returned by the third-party server is sent to the first-party client, which then forwards the response data to the third-party client.

[0015] The step of obtaining the public key sent by the first-party client includes: receiving a third-party login request sent by the first-party client, the third-party login request being used to request the establishment of a session connection for the third-party client, and the third-party login request carrying the public key and the identity information of the third-party client; and obtaining the public key from the third-party login request.

[0016] The process further includes, after generating the SessionID and before receiving the business data request from the first-party client:

[0017] The SessionID is encrypted using the public key and sent to a first-party client. The first-party client then interacts with a third-party client to obtain the SessionID decrypted using the private key.

[0018] According to the second aspect, a method for providing services through third-party mini-programs is provided, which includes:

[0019] Generate a public / private key pair;

[0020] Send the public key from the public-private key pair to the first-party client;

[0021] Receive a login success response from a first-party client;

[0022] The business parameters are signed using the private key in the aforementioned public-private key pair;

[0023] Send a business data request to a first-party client, the business data request carrying business parameters signed using the private key;

[0024] Receive response data sent by the first-party client.

[0025] The step of sending the public key of the public-private key pair to the first-party client includes:

[0026] When business services from a third-party client are required, a third-party login request is sent to the first-party client. This third-party login request is used to request the establishment of a session connection for the third-party client, and it carries the public key and the identity information of the third-party client.

[0027] According to the third aspect, a method for providing services through third-party mini-programs is provided, which includes:

[0028] Receive public keys sent by third-party clients;

[0029] Send the public key to the second-party server;

[0030] Receive the SessionID sent by the second-party server and cache it;

[0031] Receive a business data request from a third-party client, the business data request carrying business parameters signed with the private key, and send the business data request carrying the SessionID and the business parameters signed with the private key to the second-party server;

[0032] Receive response data from the second-party server and send the response data to the third-party client.

[0033] According to the fourth aspect, a service provision device for third-party mini-programs is provided, the device comprising:

[0034] The public key acquisition module is configured to obtain the public key sent by the first-party client; this public key is the public key of a public-private key pair generated by the third-party client and sent to the first-party client by the third-party client.

[0035] The identifier acquisition module is configured to acquire the OpenID identifier of the Open Authentication System and generate the SessionID identifier.

[0036] The mapping relationship establishment module is configured to establish the mapping relationship between the public key, OpenID, and SessionID.

[0037] The business parameter processing module is configured to receive a business data request sent by a first-party client, the business data request carrying the SessionID and business parameters signed using the private key in the public-private key pair; according to the pre-established correspondence, to find the public key corresponding to the SessionID carried in the business data request; and to verify the signature of the business parameters signed by the private key using the found public key.

[0038] The resource acquisition module is configured to send a business resource request to a third-party server after successful verification. The business resource request carries an OpenID corresponding to the SessionID carried in the business request.

[0039] The response data processing module is configured to send the response data returned by the third-party server to the first-party client, so that the first-party client can send the response data to the third-party client.

[0040] According to the fifth aspect, a service provision device for third-party mini-programs is provided, the device comprising:

[0041] The public / private key pair generation module is configured to generate public / private key pairs.

[0042] The public key reporting module is configured to send the public key of the public-private key pair to a first-party client.

[0043] The login processing module is configured to receive a login success response from a first-party client.

[0044] The resource request module is configured to sign the business parameters using the private key in the public-private key pair; and send a business data request to a first-party client, the business data request carrying the business parameters signed using the private key.

[0045] The resource data receiving module is configured to receive response data sent by first-party clients.

[0046] According to the sixth aspect, a service provision device for third-party mini-programs is provided, the device comprising:

[0047] The public key forwarding module is configured to receive public keys sent by third-party clients and then send those public keys to a second-party server.

[0048] The session identifier processing module is configured to receive and cache the SessionID sent by the second-party server.

[0049] The business data request processing module is configured to receive a business data request from a third-party client, which carries business parameters signed with the private key, and send the business data request carrying the SessionID and the business parameters signed with the private key to the second-party server.

[0050] The response data forwarding module is configured to receive response data from a second-party server and send that response data to a third-party client.

[0051] According to a seventh aspect, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method described in any embodiment of this specification.

[0052] In the third-party mini-program service provision method and apparatus provided in the embodiments of this specification, the third-party client generates a public-private key pair, and the private key is stored by the third-party client. In the first stage, i.e., the stage where the third-party client initiates login, the third-party client uploads its public key to the second-party server through the first-party client, so that the second-party server obtains the public key information of the third-party client that initiated login. Subsequently, in the second stage, i.e., when the third-party client requests resource data, the second-party server obtains the signed business parameters from the current third-party client in the business data request. If the second-party server can successfully verify the signature of the signed business parameters obtained in the second stage using the public key obtained in the first stage, it means that the third-party client that initiated login in the first stage and the third-party client that obtained resource data in the second stage are the same client, and there will be no resource data leakage. Therefore, the response data will be sent to the third-party client that requested resource data through the first-party client. If the signature verification fails, it means that the third-party client that initiated login in the first stage and the third-party client that obtained resource data in the second stage are not the same client. If response data is provided, resource data leakage will occur. Therefore, the response data will not be sent to the third-party client that requested resource data through the first-party client. As can be seen, the method in the embodiments of this specification completes a more comprehensive verification process for the identity of third-party clients, greatly improving the security of the service provision process of third-party mini-programs.

[0053] Furthermore, the methods and apparatus in the embodiments of this specification use private keys to sign business parameters, preventing business parameters from being arbitrarily stolen, preventing the boundaries between third-party servers from being confused, and further facilitating the isolation and protection of third-party resources, thereby ensuring the long-term secure operation of third-party mini-programs in the future. Attached Figure Description

[0054] To more clearly illustrate the technical solutions in the embodiments or prior art of this specification, the drawings used in the description of the embodiments or prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0055] Figure 1 This is a schematic diagram of the system architecture used in one embodiment of this specification.

[0056] Figure 2 This is a flowchart of a service provision method for a third-party mini-program executed on a second-party server, as described in one embodiment of this specification.

[0057] Figure 3 This is a flowchart of a service provision method for a third-party mini-program executed in a third-party client, as described in one embodiment of this specification.

[0058] Figure 4 This is a flowchart of a service provision method for a third-party mini-program executed in a first-party client, as described in one embodiment of this specification.

[0059] Figure 5 This is a flowchart of a service provision method for a third-party mini-program, executed by the parties in one embodiment of this specification.

[0060] Figure 6 This is a schematic diagram of the structure of a service providing device for a third-party mini-program set in a second-party server in one embodiment of this specification.

[0061] Figure 7 This is a schematic diagram of the structure of a service providing device for a third-party mini-program set in a third-party client in one embodiment of this specification.

[0062] Figure 8 This is a schematic diagram of the structure of a service providing device for a third-party mini-program set in a first-party client in one embodiment of this specification. Detailed Implementation

[0063] The solution provided in this specification will now be described with reference to the accompanying drawings.

[0064] First, it should be noted that the terminology used in the embodiments of this invention is for the purpose of describing specific embodiments only and is not intended to limit the invention. The singular forms “a,” “the,” and “the” used in the embodiments of this invention and the appended claims are also intended to include the plural forms, unless the context clearly indicates otherwise.

[0065] It should be understood that the term "and / or" used in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0066] To facilitate understanding of the methods provided in this manual, the system architecture involved and applicable to this manual is first described. For example... Figure 1 As shown, the system architecture mainly includes five types of network nodes: third-party client (i.e., the application end of the third-party mini-program loaded on the terminal device), third-party server (i.e., the server that provides service resources for the third-party mini-program), second-party server (for security, used to isolate the first-party server from the third-party server), first-party client (i.e., the application end of the host program loaded on the terminal device), and first-party server (i.e., the server that provides services for the host program).

[0067] Both third-party and first-party clients are installed and run on terminal devices, which can include, but are not limited to, smart mobile terminals, smart home devices, network devices, wearable devices, smart medical devices, and PCs (personal computers). Smart mobile devices can include mobile phones, tablets, laptops, PDAs (personal digital assistants), and connected cars. Smart home devices can include smart appliances such as smart TVs, smart air conditioners, smart water heaters, smart refrigerators, and smart air purifiers, as well as smart door locks, smart sockets, smart lights, and smart cameras. Network devices can include switches, wireless access points (APs), and servers. Wearable devices can include smartwatches, smart glasses, smart bracelets, virtual reality devices, augmented reality devices, and mixed reality devices (devices that support both virtual and augmented reality). Smart medical devices can include smart thermometers, smart blood pressure monitors, and smart blood glucose meters.

[0068] It should be understood that Figure 1 The number of network nodes shown is merely illustrative. Any number can be selected and deployed as needed for implementation.

[0069] The methods described in this specification mainly involve processing by a second-party server, processing by a third-party client, and processing by a first-party client. These will be explained below through different embodiments.

[0070] First, let's explain the processing on the second-party server. Figure 2This is a flowchart illustrating a method for providing services to a third-party mini-program executed on a second-party server, according to one embodiment of this specification. The execution entity of this method is a service-providing device for the third-party mini-program. This device can be located on the second-party server. It is understood that this method can also be executed by any device, equipment, platform, or device cluster with computing and processing capabilities. See also... Figure 2 The method includes:

[0071] Step 201: The second-party server obtains the public key sent by the first-party client; this public key is the public key of a public-private key pair generated by the third-party client and sent by the third-party client to the first-party client.

[0072] Step 203: The second-party server obtains the Open Authentication System identifier (OpenID) and generates a session identifier (SessionID).

[0073] Step 205: The second-party server establishes the correspondence between the public key, OpenID, and SessionID.

[0074] Step 207: The second-party server receives a business data request from the first-party client. The business data request carries the SessionID and business parameters signed using the private key in the public-private key pair.

[0075] Step 209: The second-party server searches for the public key corresponding to the SessionID carried in the business data request based on the pre-established correspondence.

[0076] Step 211: The second-party server uses the found public key to verify the signature of the business parameters after the private key is signed.

[0077] Step 213: After the second-party server verifies the transaction, it sends a business resource request to the third-party server. The business resource request carries business parameters and an OpenID corresponding to the SessionID carried in the business request.

[0078] Step 215: The second-party server sends the response data returned by the third-party server to the first-party client, so that the first-party client can send the response data to the third-party client.

[0079] The above Figure 2 The flowchart shown describes the processing within a second-party server. Corresponding to the above... Figure 2 The processing shown by the second-party server requires cooperation from both the third-party client and the first-party client to complete the corresponding processing.

[0080] The following explanation corresponds to Figure 2The processing shown is performed by the second-party server, and the corresponding processing is performed in the third-party client. Figure 3 This is a flowchart illustrating a method for providing services to a third-party mini-program executed in a third-party client, according to one embodiment of this specification. The execution entity of this method is a service-providing device for the third-party mini-program. This device can be located within the third-party client. It is understood that this method can also be executed by any device, equipment, platform, or cluster of devices with computing and processing capabilities. See also... Figure 3 The method includes:

[0081] Step 301: The third-party client generates a public / private key pair;

[0082] Step 303: The third-party client sends the public key from the public-private key pair to the first-party client;

[0083] Step 305: The third-party client receives the login success response from the first-party client;

[0084] Step 307: The third-party client signs the business parameters using the private key from the public-private key pair;

[0085] Step 309: The third-party client sends a business data request to the first-party client, which carries business parameters signed using the private key;

[0086] Step 311: The third-party client receives the response data sent by the first-party client.

[0087] The following explanation corresponds to Figure 2 The processing shown is performed by the second-party server, and the corresponding processing is performed in the first-party client. Figure 4 This is a flowchart illustrating a method for providing services to a third-party mini-program executed in a first-party client, according to one embodiment of this specification. The execution entity of this method is a service-providing device for the third-party mini-program. This device can be located in the first-party client. It is understood that this method can also be executed by any device, equipment, platform, or cluster of devices with computing and processing capabilities. See also... Figure 4 The method includes:

[0088] Step 401: The first-party client receives the public key sent by the third-party client;

[0089] Step 403: The first-party client sends the public key to the second-party server;

[0090] Step 405: The first-party client receives the SessionID sent by the second-party server and caches it;

[0091] Step 407: The first-party client receives a business data request from the third-party client. The business data request carries business parameters signed with the private key. The first-party client then sends the business data request carrying the SessionID and the business parameters signed with the private key to the second-party server.

[0092] Step 409: The first-party client receives the response data sent by the second-party server and sends the response data to the third-party client.

[0093] As mentioned earlier, in existing technologies, the service resources enjoyed by third-party mini-programs are frequently misused, significantly reducing security. For example, on a host application platform, multiple third-party mini-program clients (i.e., multiple third-party clients) may exist. These clients all obtain the service resources they need through the same host application (i.e., the same first-party client). Therefore, it is highly possible that third-party client A obtains the SessionID of a session originally belonging to third-party client B, thus allowing third-party client A to access service resources that should have been provided to third-party client B. Similarly, an attacker could launch an attack to obtain service resources that should have been provided to third-party client B. Therefore, the security of existing technologies needs to be improved.

[0094] In this embodiment of the specification, to prevent the misuse of service resources enjoyed by third-party mini-programs, it is necessary to ensure that the third-party client that logs in initially and the third-party client that requests resources subsequently are the same client. Therefore, referring to the above... Figure 2 , Figure 3 and Figure 4The process illustrated in this embodiment involves a third-party client generating a public-private key pair and storing the private key. In the first stage, when the third-party client initiates login, it uploads its public key to the second-party server via the first-party client, allowing the second-party server to obtain the public key information of the third-party client initiating login. Subsequently, in the second stage, when the third-party client requests resource data, the second-party server retrieves the signed business parameters from the current third-party client in the business data request. If the second-party server can successfully verify the signed business parameters using the public key obtained in the first stage, it indicates that the third-party client initiating login in the first stage and the third-party client obtaining resource data in the second stage are the same client, and resource data leakage will not occur. Therefore, the response data is sent to the requesting third-party client via the first-party client. If signature verification fails, it indicates that the third-party client initiating login in the first stage and the third-party client obtaining resource data in the second stage are not the same client. Providing response data in this case would result in resource data leakage, so the response data is not sent to the requesting third-party client via the first-party client. As can be seen, the method in the embodiments of this specification completes a more comprehensive verification process for the identity of third-party clients, greatly improving the security of the service provision process of third-party mini-programs.

[0095] Furthermore, see the above. Figure 2 , Figure 3 and Figure 4 The process shown in this specification demonstrates that the method in this embodiment uses a private key to sign the business parameters, preventing the business parameters from being arbitrarily stolen, preventing the boundaries between third-party servers from being confused, and further facilitating the isolation and protection of third-party resources, thereby ensuring the long-term secure operation of the third-party mini-program in the future.

[0096] In the above Figure 2 , Figure 3 and Figure 4 In the process shown, the second-party server obtains the public key sent by the first-party client during the first stage described above. Specifically,

[0097] In the third-party client, the process of sending the public key in the public-private key pair to the first-party client in step 301 above includes: sending a third-party login request to the first-party client. The third-party login request is used to request the establishment of a session connection for the third-party client, and the third-party login request carries the public key and the identity information of the third-party client.

[0098] Accordingly, in the first-party client, the implementation process of the above steps 401 and 403 includes: the first-party client receiving a third-party login request carrying a public key and the identity information of the third-party client from the third-party client, and sending the third-party login request carrying a public key and the identity information of the third-party client to the second-party server;

[0099] Accordingly, in the second-party server, the process of obtaining the public key sent by the first-party client in step 201 above includes: the second-party server receiving a third-party login request sent by the first-party client, the third-party login request being used to request the establishment of a session connection for the third-party client, and the third-party login request carrying the public key and the identity information of the third-party client; the second-party server obtaining the public key from the third-party login request.

[0100] In the embodiments described in this specification, the business parameters can be further encrypted during transmission to enhance security. Specific implementations include:

[0101] In the second-party server, after generating the SessionID in step 203 and before receiving the business data request from the first-party client in step 207, the process further includes: the second-party server generating a session key, which has the same lifecycle as the SessionID; and sending the session key and the SessionID to the first-party client.

[0102] Subsequently, in the first-party client, in step 405, the first-party client receives the session key sent by the second-party server and caches the session key; in step 407, before sending the business data request to the second-party server, it further includes: the first-party client uses the stored session key to encrypt the business parameters in the business data request sent to the second-party server; that is, the business data request sent by the first-party client to the second-party server carries encrypted business parameters.

[0103] Subsequently, on the second-party server, after successful verification, before sending a business resource request to the third-party server, the second-party server uses the session key to decrypt the encrypted business parameters in the business data request to obtain the business parameters.

[0104] The following is through Figure 1 The flowchart illustrates the cooperation of various parties in the system to demonstrate the service provision method of a third-party mini-program in the embodiments of this specification. See also... Figure 5 The method includes:

[0105] Step 500: The third-party client generates a public-private key pair and saves the private key.

[0106] Step 501: When the business service of the corresponding third-party client is required, the third-party client sends a third-party login request to the first-party client. The third-party login request is used to request the establishment of a session connection for the third-party client, and the third-party login request carries the public key and the identity information of the third-party client.

[0107] For example, a third-party client corresponds to a third-party mini-program on the Alipay platform that handles users' electricity bills. A first-party client corresponds to the host program on the Alipay platform. When a user needs to check their electricity balance, they can click on the third-party mini-program, which will then send a third-party login request to the first-party client through the corresponding third-party client.

[0108] Step 503: The first-party client sends the received third-party login request to the second-party server.

[0109] Step 505: The second-party server obtains the public key and identity information of the third-party client currently requesting login from the third-party login request, and saves the public key.

[0110] Step 507: The second-party server sends a session update request carrying the identity information of the third-party client to the first-party server.

[0111] Step 509: The first-party server returns a token corresponding to this session to the second-party server.

[0112] Step 511: The second-party server uses the token to request an OpenID from the first-party server.

[0113] Step 513: The first-party server returns the OpenID corresponding to this session to the second-party server.

[0114] Step 515: The second-party server generates a SessionID and a session key based on the received OpenID, and establishes the correspondence between the obtained public key, OpenID, and SessionID.

[0115] Step 517: The second-party server sends the SessionID and session key to the first-party client.

[0116] Step 519: The first-party client caches the SessionID and session key.

[0117] Step 521: The third-party client uses the private key in the public-private key pair to sign the business parameters and sends a business data request to the first-party client. The business data request carries the business parameters signed with the private key.

[0118] Step 523: The first-party client encrypts the business parameters using the session key and sends the SessionID, the encrypted business parameters signed with the private key, in the business data request to the second-party server.

[0119] Step 525: The second-party server, based on the pre-established correspondence mentioned above, finds the public key corresponding to the SessionID carried in the business data request, and uses the found public key to verify the signature of the business parameters after the private key is signed.

[0120] Step 527: After successful verification, the second-party server uses the session key to decrypt the encrypted business parameters, and then sends a business resource request to the third-party server. This business resource request carries the business parameters and the OpenID corresponding to the SessionID in the business data request.

[0121] Step 529: The second-party server sends the response data returned by the third-party server to the first-party client.

[0122] Step 531: The first-party client sends the response data to the third-party client.

[0123] In one embodiment of this specification, a service provider for a third-party mini-program is provided, which is located in a second-party server. See also Figure 6 The device includes:

[0124] The public key acquisition module 601 is configured to obtain the public key sent by the first-party client; the public key is the public key of a public-private key pair generated by the third-party client and sent by the third-party client to the first-party client.

[0125] The identifier acquisition module 602 is configured to acquire the Open Authentication System identifier OpenID and generate the session identifier SessionID;

[0126] The mapping relationship establishment module 603 is configured to establish the mapping relationship between the public key, OpenID and SessionID;

[0127] The business parameter processing module 604 is configured to receive a business data request sent by a first-party client, the business data request carrying the SessionID and business parameters signed using the private key in the public-private key pair; according to the pre-established correspondence, to find the public key corresponding to the SessionID carried in the business data request; and to verify the signature of the business parameters signed by the private key using the found public key.

[0128] The resource acquisition module 605 is configured to send a business resource request to a third-party server after successful verification. The business resource request carries an OpenID corresponding to the SessionID carried in the business request.

[0129] The response data processing module 606 is configured to send the response data returned by the third-party server to the first-party client, so that the first-party client can send the response data to the third-party client.

[0130] In one embodiment of this specification, the public key acquisition module 601 is configured to perform the following: receiving a third-party login request sent by a first-party client, the third-party login request being used to request the establishment of a session connection for the third-party client, and the third-party login request carrying the public key and the identity information of the third-party client; and obtaining the public key from the third-party login request.

[0131] In one embodiment of this specification, Figure 6 The apparatus shown further includes a session key distribution module (not shown in the figure), which is configured to perform: encrypting the SessionID using the public key, and sending the encrypted SessionID to a first-party client, so that the first-party client can interact with a third-party client to obtain the SessionID decrypted by the private key.

[0132] This specification provides an embodiment of a third-party mini-program service provision device, which is configured within a third-party client. See also Figure 7 The device includes:

[0133] Public-private key pair generation module 701 is configured to generate public-private key pairs;

[0134] The public key reporting module 702 is configured to send the public key of the public-private key pair to a first-party client.

[0135] Login processing module 703 is configured to receive a login success response from a first-party client.

[0136] Resource request module 704 is configured to sign business parameters using the private key in the public-private key pair; and send a business data request to a first-party client, the business data request carrying the business parameters signed using the private key.

[0137] Resource data receiving module 705 is configured to receive response data sent by a first-party client.

[0138] exist Figure 7 In the embodiment of the device shown in this specification, the public key reporting module 702 is configured to perform:

[0139] When business services from a third-party client are required, a third-party login request is sent to the first-party client. This third-party login request is used to request the establishment of a session connection for the third-party client, and it carries the public key and the identity information of the third-party client.

[0140] This specification provides an embodiment of a third-party mini-program service provision device, which is configured in a first-party client. See also Figure 8 The device includes:

[0141] The public key forwarding module 801 is configured to receive a public key sent by a third-party client and send the public key to a second-party server.

[0142] The session identifier processing module 802 is configured to receive and cache the session identifier SessionID sent by the second-party server.

[0143] The business data request processing module 803 is configured to receive a business data request sent by a third-party client, the business data request carrying business parameters signed with the private key, and send the business data request carrying the SessionID and the business parameters signed with the private key to the second-party server.

[0144] The response data forwarding module 804 is configured to receive response data sent from a second-party server and send the response data to a third-party client.

[0145] This specification provides, in one embodiment, a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the methods of any embodiment in the specification.

[0146] This specification provides a computing device according to one embodiment, including a memory and a processor, wherein the memory stores executable code, and the processor executes the executable code to perform the method of any embodiment of the specification.

[0147] It is understood that the structures illustrated in the embodiments of this specification do not constitute a specific limitation on the apparatus of the embodiments of this specification. In other embodiments of the specification, the above-described apparatus may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0148] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the apparatus embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0149] Those skilled in the art will recognize that, in one or more of the examples above, the functions described in this invention can be implemented using hardware, software, widgets, or any combination thereof. When implemented in software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium.

[0150] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made on the basis of the technical solution of the present invention should be included within the scope of protection of the present invention.

Claims

1. The service provision method of a third-party mini-program is executed by a second-party server; this method includes: Obtain the public key sent by the first-party client; The public key is the public key in a public-private key pair generated by the third-party client and sent to the first-party client by the third-party client; Obtain the OpenID identifier and generate the SessionID identifier; Establish the mapping relationship between the public key, OpenID, and SessionID; Receive a business data request from a first-party client, the business data request carrying the SessionID and business parameters signed using the private key in the public-private key pair; Based on the pre-established correspondence, find the public key corresponding to the SessionID carried in the business data request; Use the found public key to verify the signature of the business parameters after signing the private key; After successful verification, a business resource request is sent to the third-party server. The business resource request carries the business parameters and the OpenID corresponding to the SessionID carried in the business request. The response data returned by the third-party server is sent to the first-party client, which then forwards the response data to the third-party client.

2. The method according to claim 1, wherein, Obtaining the public key sent by the first-party client includes: receiving a third-party login request sent by the first-party client, the third-party login request being used to request the establishment of a session connection for the third-party client, and the third-party login request carrying the public key and the identity information of the third-party client; and obtaining the public key from the third-party login request.

3. The method according to claim 1, wherein, After generating the SessionID and before receiving the business data request from the first-party client, the process further includes: The SessionID is encrypted using the public key and sent to a first-party client. The first-party client then interacts with a third-party client to obtain the SessionID decrypted using the private key.

4. The method according to claim 1, wherein, After generating the SessionID and before receiving the business data request from the first-party client, the method further includes: generating a session key, the session key having the same lifecycle as the SessionID; and sending the session key and the SessionID to the first-party client. In the business data request sent by the first-party client, the business parameters are encrypted by the first-party client using a session key; After the verification is passed, and before sending the business resource request to the third-party server, the process further includes: using a session key to decrypt the encrypted business parameters in the business data request to obtain the business parameters.

5. The service provision method of the third-party mini-program is executed by the third-party client; this method includes: Generate a public / private key pair; Send the public key from the public-private key pair to the first-party client; Receive a login success response from a first-party client; The business parameters are signed using the private key in the aforementioned public-private key pair; A business data request is sent to a first-party client, which carries business parameters signed using the private key. The second-party server pre-establishes a correspondence between a public key, OpenID, and SessionID, and finds the public key corresponding to the SessionID carried in the business data request sent by the first-party client according to the pre-established correspondence. The public key is then used to verify the signature of the obtained business parameters. Receive response data sent by the first-party client.

6. The method according to claim 5, wherein, Sending the public key from the public-private key pair to the first-party client includes: A third-party login request is sent to the first-party client. This third-party login request is used to request the establishment of a session connection for the third-party client, and the third-party login request carries the public key and the identity information of the third-party client.

7. The service provision method of the third-party mini-program is executed by the first-party client; the method includes: Receive the public key from the public-private key pair sent by a third-party client; Send the public key to the second-party server; Receive the SessionID sent by the second-party server and cache it; Receive business data requests from third-party clients, which carry business parameters signed with the private key in the public-private key pair; The service data request carrying the SessionID and the service parameters signed with the private key is sent to the second-party server; wherein, the second-party server pre-establishes a correspondence between the public key, OpenID and SessionID and finds the public key corresponding to the SessionID carried in the service data request according to the pre-established correspondence, and uses the public key to verify the signature of the obtained signed service parameters. Receive response data from the second-party server and send the response data to the third-party client.

8. The method according to claim 7, wherein, The step of receiving the SessionID sent by the second-party server further includes: receiving the session key sent by the second-party server and saving the session key; After receiving a business data request from a third-party client, and before sending the business data request to the second-party server, the method further includes: encrypting the business parameters in the business data request sent to the second-party server using a stored session key.

9. A service provisioning device for third-party mini-programs, applied to a second-party server, the device comprising: The public key acquisition module is configured to obtain the public key sent by the first-party client. The public key is the public key in a public-private key pair generated by the third-party client and sent to the first-party client by the third-party client; The identifier acquisition module is configured to acquire the OpenID identifier of the Open Authentication System and generate the SessionID identifier. The mapping relationship establishment module is configured to establish the mapping relationship between the public key, OpenID, and SessionID. The business parameter processing module is configured to receive a business data request sent by a first-party client, the business data request carrying the SessionID and business parameters signed using the private key in the public-private key pair; according to the pre-established correspondence, to find the public key corresponding to the SessionID carried in the business data request; and to verify the signature of the business parameters signed by the private key using the found public key. The resource acquisition module is configured to send a business resource request to a third-party server after successful verification. The business resource request carries an OpenID corresponding to the SessionID carried in the business request. The response data processing module is configured to send the response data returned by the third-party server to the first-party client, so that the first-party client can send the response data to the third-party client.

10. A service provider for a third-party mini-program, applied to a third-party client, the device comprising: The public / private key pair generation module is configured to generate public / private key pairs. The public key reporting module is configured to send the public key of the public-private key pair to a first-party client. The login processing module is configured to receive a login success response from a first-party client. The resource request module is configured to sign business parameters using the private key in the public-private key pair; A business data request is sent to a first-party client, which carries business parameters signed using the private key. The second-party server pre-establishes a correspondence between a public key, OpenID, and SessionID, and finds the public key corresponding to the SessionID carried in the business data request sent by the first-party client according to the pre-established correspondence. The public key is then used to verify the signature of the obtained business parameters. The resource data receiving module is configured to receive response data sent by first-party clients.

11. A service providing device for a third-party mini-program, applied to a first-party client, the device comprising: The public key forwarding module is configured to receive the public key from a public-private key pair sent by a third-party client; Send the public key to the second-party server; The session identifier processing module is configured to receive and cache the SessionID sent by the second-party server. The business data request processing module is configured to receive a business data request from a third-party client. This business data request carries business parameters signed using the private key in a public-private key pair. The module then sends the business data request, carrying the SessionID and the business parameters signed using the private key, to a second-party server. The second-party server pre-establishes a mapping between the public key, OpenID, and SessionID. Based on this pre-established mapping, it finds the public key corresponding to the SessionID carried in the business data request and uses the public key to verify the signature of the obtained business parameters. The response data forwarding module is configured to receive response data from a second-party server and send that response data to a third-party client.

12. A computing device comprising a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method of any one of claims 1-8.

Images