Business processing method and device, equipment and medium

Abstract

The embodiment of the invention discloses a business processing method and device, equipment and a medium, which can be applied to various scenes such as intelligent traffic, auxiliary driving, cloud technology, artificial intelligence and the like. The service processing method comprises the following steps that: a calling party generates a request parameter after receiving a service request sent by a requesting party, generates an access token based on the request parameter, and then sends request calling information obtained by encrypting and packaging the request parameter and the access token to a called party, and correspondingly, the called party sends the request calling information to the calling party. And after the called party passes verification based on the request parameter in the request calling information and the access token, the service data matched with the request parameter is sent to the main calling party. According to the technical scheme, the calling party can quickly and safely call the called party, the calling efficiency and safety are improved, the service processing efficiency and safety are further improved, and the service processing scheme is greatly optimized.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a business processing method, a business processing device, an electronic device, and a computer-readable medium. Background Art

[0002] With the development of computers, more and more businesses are supported by computers. Since different businesses may be supported and run by different service providers, calls between different service providers are involved when processing businesses. In the related art, when the caller calls the called party, an access token is usually issued to the caller by a management party (such as an authentication system), and then the caller implements the call to the called party based on the access token. However, the call efficiency is usually low due to factors such as the network, which affects business processing. At the same time, in the related art, the caller usually sends the corresponding request to the called party through the access token to implement the call of the called party. The corresponding request is at risk of being tampered with or leaked during the transmission process, resulting in low call security, which further affects business processing.

[0003] Therefore, how to improve the call to improve business processing is an urgent problem to be solved. Summary of the invention

[0004] The embodiments of the present application provide a business processing method, device, equipment, and medium, which improve the calling efficiency and security, make the business processing efficient and secure, and greatly improve the business processing solution.

[0005] In the first aspect, an embodiment of the present application provides a business processing method, the method comprising: if a calling party receives a business request sent by a requesting party, it generates a request parameter for obtaining business data required to process the business request; the calling party generates an access token for calling the called party based on the request parameter; the calling party encrypts and encapsulates the request parameter and the access token to obtain request calling information, and sends the request calling information to the called party, so that the called party performs verification based on the request parameter and the access token; the calling party obtains the business data matching the request parameter returned by the called party after the verification is passed, and processes the business request based on the obtained business data.

[0006] In one embodiment of the present application, based on the aforementioned scheme, the method also includes: the calling party obtains a response token returned by the called party after verification based on the request parameters and the access token; wherein the response token is generated by the called party based on business data; the calling party processes the business request based on the acquired business data, including: the calling party performs verification based on the acquired business data and the response token; the calling party processes the business request based on the acquired business data after verification.

[0007] In one embodiment of the present application, based on the aforementioned scheme, the response token includes a generation timestamp of the response token and the signature data of the called party; the calling party performs verification based on the acquired business data and the response token, including: the calling party concatenates the acquired business data with the generation timestamp to obtain a concatenated string; the calling party performs a hash operation on the obtained concatenated string to obtain the signature data of the called party; the calling party verifies the signature data of the called party contained in the response token based on the obtained signature data of the called party.

[0008] In one embodiment of the present application, based on the aforementioned scheme, the response token also includes the identification information of the caller and the identification information of the called party; the caller performs a hash operation on the obtained concatenated string to obtain the signature data of the called party, including: the caller obtains a communication key based on the identification information of the caller and the identification information of the called party; wherein the communication key is sent after the authentication system verifies both the container deployed by the caller and the container deployed by the called party; the caller uses the communication key to perform a hash operation on the obtained concatenated string to obtain the signature data of the called party.

[0009] In one embodiment of the present application, based on the aforementioned scheme, the calling party obtains the business data matching the request parameters returned by the called party after the verification is passed, and obtains the response token returned by the called party after the verification is passed based on the request parameters and the access token, including: the calling party receives the response call information sent by the called party; wherein the response call information is obtained by encrypting and encapsulating the business data and the response token after the called party is verified based on the request parameters and the access token; the calling party decrypts the response call information to obtain the business data and the response token.

[0010] In one embodiment of the present application, based on the aforementioned scheme, the response token includes the identification information of the caller and the identification information of the called party; the caller decrypts the response call information to obtain the business data and the response token, including: the caller obtains a communication key based on the identification information of the caller and the identification information of the called party; wherein the communication key is sent after the authentication system verifies both the container deployed by the caller and the container deployed by the called party; the caller uses the communication key to decrypt the response call information to obtain the business data and the response token.

[0011] In a second aspect, an embodiment of the present application provides a business processing method, the method comprising: the called party obtains a request parameter sent by the calling party for obtaining business data required to process the business request and an access token for calling the called party; wherein the request parameter and the access token are generated by the calling party after receiving the business request sent by the requesting party, and the access token is generated based on the request parameter; the called party performs verification based on the request parameter and the access token; the called party returns the business data matching the request parameter to the calling party after the verification is passed, so that the calling party processes the business request based on the business data returned by the called party.

[0012] In one embodiment of the present application, based on the aforementioned scheme, the method also includes: after the called party is verified based on the request parameters and the access token, generating a response token for responding to the calling party based on the business data; the called party returns the response token to the calling party, so that the calling party performs verification based on the business data and the response token, and processes the business request based on the acquired business data after the verification is passed.

[0013] In one embodiment of the present application, based on the aforementioned scheme, the called party generates a response token for responding to the calling party based on the business data, including: the called party concatenates the business data with the current timestamp to obtain a concatenated string; the called party performs a hash operation on the obtained concatenated string to obtain the signature data of the called party; the called party encapsulates the current timestamp and the signature data of the called party to obtain the response token.

[0014] In one embodiment of the present application, based on the aforementioned scheme, the called party performs a hash operation on the obtained concatenated string to obtain the signature data of the called party, including: the called party obtains a communication key based on the identification information of the calling party and the identification information of the called party; wherein the communication key is sent after the authentication system verifies both the container deployed by the calling party and the container deployed by the called party; the called party uses the communication key to perform a hash operation on the obtained concatenated string to obtain the signature data of the called party.

[0015] In one embodiment of the present application, based on the aforementioned scheme, the called party encapsulates the current timestamp and the signature data of the called party to obtain the response token, including: the called party obtains the identification information of the calling party and the identification information of the called party; the called party encapsulates the identification information of the calling party, the identification information of the called party, the current timestamp, and the signature data of the called party to obtain the response token.

[0016] In one embodiment of the present application, based on the aforementioned scheme, the called party returns the business data matching the request parameters to the calling party after verification, and returns the response token to the calling party, including: the called party encrypts and encapsulates the business data and the response token after verification to obtain response call information; the called party sends the response call information to the calling party.

[0017] In one embodiment of the present application, based on the aforementioned scheme, the called party encrypts and encapsulates the business data and the response token after verification to obtain response call information, including: after verification, the called party obtains a communication key based on the identification information of the calling party and the identification information of the called party; wherein the communication key is sent by the authentication system after both the container deployed by the calling party and the container deployed by the called party are verified; the called party uses the communication key to encrypt and encapsulate the business data and the response token to obtain the response call information.

[0018] In one embodiment of the present application, based on the aforementioned scheme, the called party obtains a communication key based on the identification information of the calling party and the identification information of the called party, including: the called party performs a specified operation based on the identification information of the calling party and the identification information of the called party to obtain a second operation result; the called party obtains a communication key matching the second operation result from the memory corresponding to the called party; wherein the memory corresponding to the called party stores the communication key required for the called party to perform business processing.

[0019] In the third aspect, an embodiment of the present application provides a business processing device, which is configured on the calling party, and the device includes: a first generation module, configured to generate a request parameter for obtaining business data required to process the business request if a business request sent by the requesting party is received; a second generation module, configured to generate an access token for calling the called party based on the request parameter; a sending module, configured to encrypt and encapsulate the request parameter and the access token to obtain request call information, and send the request call information to the called party, so that the called party performs verification based on the request parameter and the access token; an acquisition and processing module, configured to obtain business data matching the request parameter returned by the called party after the verification is passed, and process the business request based on the acquired business data.

[0020] In a fourth aspect, an embodiment of the present application provides a business processing device, which is configured at the called party, and includes: an acquisition module, configured to acquire request parameters sent by the calling party for acquiring business data required to process the business request and an access token for calling the called party; wherein the request parameters and the access token are generated by the calling party after receiving the business request sent by the requesting party, and the access token is generated based on the request parameters; a verification module, configured to perform verification based on the request parameters and the access token; and a return module, configured to return the business data matching the request parameters to the calling party after the verification is passed, so that the calling party processes the business request based on the business data returned by the called party.

[0021] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising one or more processors; and a memory for storing one or more programs, so that when the one or more programs are executed by the one or more processors, the electronic device implements the business processing method as described above.

[0022] In a sixth aspect, an embodiment of the present application provides a computer-readable medium on which a computer program is stored, and when the computer program is executed by a processor, the business processing method as described above is implemented.

[0023] In a seventh aspect, an embodiment of the present application provides a computer program product, including computer instructions, which, when executed by a processor, implement the business processing method as described above.

[0024] In the technical solution provided in the embodiments of the present application:

[0025] After receiving the business request sent by the requester, the caller generates request parameters, generates an access token based on the request parameters, and sends the generated request parameters and access token to the called party. Correspondingly, after the called party passes the verification based on the request parameters and the access token, it sends the business data matching the request parameters to the caller. In this way, the caller can quickly call the called party, which improves the calling efficiency and further improves the business processing efficiency.

[0026] On the one hand, by generating the access token through the caller, the related technology avoids the problem of low access token generation efficiency caused by factors such as the network or a large number of callers needing to call the called party, thereby improving the calling efficiency and further improving the business processing efficiency.

[0027] On the one hand, the caller generates an access token based on the request parameters, that is, the access token is associated and bound with the request parameters, avoiding the phenomenon in related technologies where the access token and request parameters are sent separately to the called party, resulting in erroneous return of business data due to leakage / theft of the access token or tampering of the request parameters. This improves the call security and makes business processing more secure.

[0028] At the same time, the calling party sends the request call information obtained by encrypting and encapsulating the request parameters and the access token to the called party, that is, the calling party encrypts the request parameters and the access token, thereby avoiding the phenomenon in related technologies that the access token and / or request parameters are tampered with during transmission and the business data is erroneously returned, thereby further improving the call security, and thus making the business processing security higher, and having a wide range of applicable scenarios, especially for scenarios with higher security requirements.

[0029] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 is a schematic diagram of an exemplary implementation environment to which the technical solution of the embodiments of the present application can be applied;

[0031] Figure 2 is a flow chart of a business processing method shown in an exemplary embodiment of the present application;

[0032] Figure 3 is a flowchart of a business processing method shown in another exemplary embodiment of the present application;

[0033] Figure 4 is a flowchart of a business processing method shown in another exemplary embodiment of the present application;

[0034] Figure 5is a flowchart of a business processing method shown in another exemplary embodiment of the present application;

[0035] Figure 6 is a flowchart of a business processing method shown in another exemplary embodiment of the present application;

[0036] Figure 7 is a flowchart of a business processing method shown in another exemplary embodiment of the present application;

[0037] Figure 8 is a flowchart of a business processing method shown in another exemplary embodiment of the present application;

[0038] Fig. 9 is a flowchart of a business processing method shown in another exemplary embodiment of the present application;

[0039] Fig.10 is a flowchart of a business processing method shown in another exemplary embodiment of the present application;

[0040] Fig.11 is a flowchart of a business processing method shown in another exemplary embodiment of the present application;

[0041] Fig.12 is a flowchart of a business processing method shown in another exemplary embodiment of the present application;

[0042] Fig.13 is a flowchart of a business processing method shown in another exemplary embodiment of the present application;

[0043] Fig.14 is a schematic diagram of an exemplary implementation environment to which the technical solution of the embodiments of the present application can be applied;

[0044] Fig.15 is a flowchart of a business processing method shown in another exemplary embodiment of the present application;

[0045] Figure 16-1 to Figure 16-2 This is an interface diagram of authorization by the person in charge of the called service, shown in an exemplary embodiment of the present application;

[0046] Figure 16-3 This is an interface diagram of an exemplary embodiment of the present application showing the person in charge of the called service performing service authority control;

[0047] Fig.17 is a flowchart of a business processing method shown in another exemplary embodiment of the present application;

[0048] Fig.18 is a flowchart of a business processing method shown in another exemplary embodiment of the present application;

[0049] Fig.19 is a block diagram of a service processing device shown in an exemplary embodiment of the present application;

[0050] Fig. 20 is a block diagram of a service processing device shown in another exemplary embodiment of the present application;

[0051] Fig.21 It is a structural diagram of a computer system suitable for implementing an electronic device of an embodiment of the present application. DETAILED DESCRIPTION

[0052] Here, exemplary embodiments will be described in detail, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments that are the same as the present application. Instead, they are only examples of devices and methods that are the same as some aspects of the present application as detailed in the attached claims.

[0053] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0054] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0055] It should be noted that the "multiple" mentioned in this application refers to two or more than two. "And / or" describes the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship.

[0056] With the development of computers, more and more businesses are supported by computers. Since different businesses may be supported and run by different service providers, calls between different service providers are involved when processing businesses. In the related art, when the caller calls the called party, an access token is usually issued to the caller by a management party (such as an authentication system), and then the caller implements the call to the called party based on the access token. However, the call efficiency is usually low due to factors such as the network, which affects business processing. At the same time, in the related art, the caller usually sends the corresponding request to the called party through the access token to implement the call of the called party. The corresponding request is at risk of being tampered with or leaked during the transmission process, resulting in low call security, which further affects business processing.

[0057] Therefore, in order to improve the efficiency and security of calling, to improve the efficiency and security of business processing, and to improve the business processing solution, this application provides a business processing solution. Figure 1 , Figure 1 1 is a schematic diagram of an implementation environment involved in this application. The implementation environment mainly includes a calling party 101, a called party 102 and a management party 103; wherein:

[0058] The calling party 101 is the party that receives the service request from the requesting party and triggers the calling of the called party.

[0059] Exemplarily, the main caller can be any electronic device or server. The electronic device can be a smart phone, tablet, laptop, computer, intelligent voice interaction device, smart home appliance, smart wearable device, aircraft, etc. The server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), big data and artificial intelligence platforms, etc.

[0060] Exemplarily, the main caller may also be a service deployed on the aforementioned electronic device or server. The service refers to a service developed by software development engineers and related to the realization of business functions, such as an application app or a small program.

[0061] The called party 102 is a party called by the calling party to assist the calling party in completing corresponding business processing.

[0062] Exemplarily, the called party may be any electronic device or server. The electronic device may be a smart phone, tablet, laptop, computer, intelligent voice interaction device, smart home appliance, smart wearable device, aircraft, etc. The server may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content distribution networks, big data and artificial intelligence platforms, etc.

[0063] Exemplarily, the called party may also be a service deployed on the aforementioned electronic device or server. The service refers to a service developed by software development engineers and related to the realization of business functions, such as an application app or a small program.

[0064] It is understandable that the calling party can be the calling party in certain business processing processes and can be the called party in other business processes; correspondingly, the called party can be the called party in certain business processing processes and can be the calling party in other business processes.

[0065] For example, in the process of processing business A, service Se1 is the main caller and service Se2 is the called party; in the process of processing business B, service Se2 is the main caller and service Se1 is the called party. In actual applications, the main caller and the called party can be flexibly adjusted according to specific application scenarios.

[0066] The management party 103 is a party that centrally manages the calling party and the called party.

[0067] Exemplarily, the management party may be an authentication system, which may implement registration and authorization of the caller and the called party on the authentication system, and allocate communication keys to the caller and the called party to ensure the security of the caller and the called party.

[0068] It should be noted that Figure 1 The numbers of servers corresponding to the caller 101, the callee 102 and the manager 103 are only for reference only, and any number of servers may be provided according to actual needs.

[0069] In one embodiment of the present application, the task processing method may be interactively executed by the calling party 101 and the called party 102; wherein:

[0070] If the calling party receives a business request sent by the requesting party, it generates request parameters for obtaining the business data required to process the business request; then it generates an access token for calling the called party based on the request parameters; then it encrypts and encapsulates the request parameters and the access token to obtain the request calling information, and sends the request calling information to the called party.

[0071] Correspondingly, the called party receives the request call information sent by the calling party, and performs verification based on the request parameters and access token in the request call information; then, after the verification is passed, the business data matching the request parameters is sent to the calling party.

[0072] Correspondingly, the calling party receives the service data sent by the called party and processes the service request based on the service data.

[0073] Figure 1 The technical solutions of the illustrated embodiments can be applied to various scenarios, including but not limited to smart transportation, assisted driving, cloud technology, artificial intelligence, etc.; in actual applications, corresponding adjustments can be made according to specific application scenarios.

[0074] Exemplarily, if applied to smart transportation or assisted driving scenarios, the service may be an Internet of Vehicles service. For example, the main caller is server Se1 that supports the Internet of Vehicles service in the application, and the called party is server Se2 that supports the Internet of Vehicles service in the application. When server Se1 receives a service request for the Internet of Vehicles service initiated by an application installed on a vehicle terminal, navigation terminal, etc., it calls server Se2 to jointly complete the processing of the Internet of Vehicles service. Therefore, by implementing the technical solution of the embodiment of the present application, the processing efficiency and security of the Internet of Vehicles service are improved, and the Internet of Vehicles service processing solution is greatly improved.

[0075] Exemplarily, if applied in cloud technology or artificial intelligence scenarios, the business may be a payment business. For example, the main caller is server Se3 that supports the payment business in the application, and the called party is server Se4 that supports the payment business in the application. When server Se3 receives a business request for the payment business initiated by an application installed on a smart phone, etc., it calls server Se4 to jointly complete the processing of the payment business. Therefore, by implementing the technical solution of the embodiment of the present application, the processing efficiency and security of the payment business are improved, and the payment business processing solution is greatly improved.

[0076] It should be noted that in the specific implementation of this application, user-related data is involved. When the embodiments of this application are applied to specific products or technologies, it is necessary to obtain the permission or consent of the object, and the collection, use and processing of relevant data need to comply with the relevant laws, regulations and standards of relevant countries and regions.

[0077] The following is a detailed description of various implementation details of the technical solution of the embodiment of the present application:

[0078] See also Figure 2 , Figure 2 FIG. 1 is a flowchart of a service processing method according to an embodiment of the present application. The service processing method may be executed by the calling party 101. Figure 2 As shown, the business processing method at least includes S201 to S204, which are described in detail as follows:

[0079] S201: If the calling party receives a service request sent by the requesting party, it generates a request parameter for obtaining service data required for processing the service request.

[0080] In the embodiment of the present application, when the requesting party has a business processing requirement, it can send a business request to the calling party, wherein the business request is used to instruct the calling party to process the business corresponding to the business request.

[0081] Accordingly, after receiving the service request sent by the requester, the caller may generate a request parameter, wherein the request parameter is used to instruct the callee to send the service data required by the caller to process the service request.

[0082] Exemplarily, the caller may generate request parameters based on parameters contained in the service request.

[0083] For example, if the parameters contained in the business request are: current location information and a request for nearby food restaurants, the caller can obtain the "current location information" and "nearby food restaurants" from the business request, and generate the request parameter "food restaurants near location information" based on the "current location information" and "nearby food restaurants".

[0084] For another example, the parameters contained in the business request are: requesting to obtain Xiao Ming's home address, then the caller can obtain "Xiao Ming's home address" from the business request, and generate the request parameter "Xiao Ming's home address" based on "Xiao Ming's home address".

[0085] In actual applications, request parameters generated based on parameters contained in business requests can be flexibly adjusted according to specific application scenarios.

[0086] S202: The calling party generates an access token for calling the called party based on the request parameters.

[0087] In the embodiment of the present application, the calling party generates request parameters, and then can generate an access token for calling the called party based on the request parameters.

[0088] In the embodiment of the present application, the access token refers to the credential / token used by the caller to call the called party. The token is usually a string that is generated based on the request parameters. In other words, there is a binding relationship between the access token and the request parameters.

[0089] S203, the calling party encrypts and encapsulates the request parameters and the access token to obtain request calling information, and sends the request calling information to the called party, so that the called party performs verification based on the request parameters and the access token.

[0090] In the embodiment of the present application, the calling party generates request parameters and an access token, and then can encrypt and encapsulate the request parameters and the access token to obtain request call information, and send the request call information to the called party.

[0091] Correspondingly, the called party receives the request call information sent by the calling party, decrypts the request call information, obtains the request parameters and access token, and then can perform verification based on the request parameters and access token, and after the verification is passed, returns the business data matching the request parameters to the calling party.

[0092] For example, Re is used to represent the request parameter, Token_a is used to represent the access token, and R is used to represent the request call information. Assuming the encryption algorithm is K1, then K1(Re, Token_a)=R.

[0093] In one embodiment of the present application, the process in S203 where the calling party encrypts and encapsulates the request parameters and the access token to obtain the request call information may include:

[0094] Acquire a communication key based on the identification information of the calling party and the identification information of the called party; wherein the communication key is sent after the authentication system verifies both the container deployed by the calling party and the container deployed by the called party;

[0095] The communication key is used to encrypt and encapsulate the request parameters and access token to obtain the request call information.

[0096] That is, in an optional embodiment, the caller can first obtain the identification information of the caller and the identification information of the called party, then obtain the communication key based on the identification information of the caller and the identification information of the called party, and then use the communication key to encrypt and encapsulate the request parameters and access token to obtain the request call information.

[0097] For example, following the above example, using key to represent the communication key, key(Re, Token_a)=R.

[0098] In one embodiment of the present application, the calling party may encrypt the request parameters, and encapsulate the encrypted request parameters and the access token to obtain the request call information, and send the request call information to the called party. Exemplarily, the calling party may encrypt the request parameters using a communication key.

[0099] S204, the calling party obtains the business data matching the request parameters returned by the called party after the verification is passed, and processes the business request based on the obtained business data.

[0100] In the embodiment of the present application, the caller can actively or passively obtain the business data matching the request parameters returned by the called party after verification, and then process the business request based on the obtained business data to complete the business corresponding to the business request.

[0101] Exemplarily, the calling party processes the service request based on the acquired service data, obtains the service processing result, and sends the service processing result to the requesting party; correspondingly, the requesting party receives the service processing result sent by the calling party.

[0102] In the embodiment of the present application, the calling party generates an access token, which improves the calling efficiency and makes the business processing efficiency higher. At the same time, the calling party generates an access token based on the request parameters, and encrypts the request parameters and the access token, which improves the calling security and makes the business processing security higher.

[0103] In one embodiment of the present application, another service processing method is provided, which can be executed by the calling party 101. Figure 3 As shown, the business processing method may include S301 to S303, S201, and S203 to S204.

[0104] S301 to S303 are described in detail as follows:

[0105] S301, the calling party concatenates the request parameter with the current timestamp to obtain a concatenated string.

[0106] S302, the calling party performs a hash operation on the obtained concatenated character string to obtain the signature data of the calling party.

[0107] In an embodiment of the present application, the process of the caller generating the signature data of the caller based on the request parameters and the current timestamp can be to first concatenate the request parameters with the current timestamp to obtain a concatenated string, and then perform a hash operation on the obtained concatenated string to obtain the signature data of the caller.

[0108] For example, following the above example, Re is used to represent the request parameter, and Re = string 1 (for example, a movie theater near Ranjiaba, Yubei District, Chongqing), and Ti_a is used to represent the current timestamp, and Ti_a = string 2 (for example, 2023-06-16 09:00:00), then the caller concatenates string 1 and string 2 to obtain a concatenated string c_a. At the same time, Si_a is used to represent the signature data of the caller, then Si_a = Hash(c_a).

[0109] In one embodiment of the present application, the process in S302 where the calling party performs a hash operation on the obtained concatenated string to obtain the signature data of the calling party may include:

[0110] The calling party obtains a communication key based on the identification information of the calling party and the identification information of the called party; wherein the communication key is sent after the authentication system verifies both the container deployed by the calling party and the container deployed by the called party;

[0111] The calling party uses the communication key to perform a hash operation on the obtained concatenated string to obtain the signature data of the calling party.

[0112] That is, in an optional embodiment, the caller can first obtain the identification information of the caller and the identification information of the called party, and then obtain the communication key based on the identification information of the caller and the identification information of the called party, and then use the communication key to perform a hash operation on the obtained concatenated string to obtain the signature data of the caller.

[0113] In the optional embodiment, the communication key refers to the credential sent by the authentication system after verifying both the container deployed by the calling party and the container deployed by the called party. For example, when the calling party is a service, the container is the hardware device on which the service is deployed, such as a computer, a server, etc.; similarly, when the called party is a service, the container is the hardware device on which the service is deployed, such as a computer, a server, etc.

[0114] In the optional embodiment, the identification information of the caller is used to uniquely identify the caller, including but not limited to identification number, name, etc. Similarly, the identification information of the caller is used to uniquely identify the called party, including but not limited to identification number, name, etc.

[0115] For example, following the above example, using key to represent the communication key, Si_a = Hash key (c_a).

[0116] In this way, by implementing the optional embodiment, the calling party uses the communication key to perform a hash operation on the obtained concatenated string, and can easily and quickly obtain the signature data of the calling party, providing strong support for the generation of the access token.

[0117] In one embodiment of the present application, the process of the calling party acquiring the communication key based on the identification information of the calling party and the identification information of the called party may include:

[0118] The calling party performs a specified operation based on the identification information of the calling party and the identification information of the called party to obtain a first operation result;

[0119] The calling party obtains a communication key matching the first operation result from the memory corresponding to the calling party; wherein the memory corresponding to the calling party stores the communication key required by the calling party for business processing.

[0120] That is, in the optional embodiment, the memory corresponding to the calling party stores all the communication keys required by the calling party for business processing, wherein the number of all the communication keys can be one or more. For example, see Table 1, which is an example table of communication keys stored in the memory corresponding to the calling party.

[0121] The communication key stored in the memory corresponding to the calling party Communication key 1 required by business A Communication key 2 required by business B Communication key 3 required by business C

[0122] Table 1

[0123] Furthermore, in the current business processing situation, the caller can perform a specified operation based on the identification information of the caller and the identification information of the called party to obtain a first operation result, and select a communication key that matches the first operation result from all stored communication keys.

[0124] Among them, in the optional embodiment, the communication key can be a symmetric key or an asymmetric key. It can be understood that a symmetric key indicates that the calling party and the called party store the same key, while an asymmetric key indicates that the calling party and the called party store different keys, for example, the calling party stores a public key and the called party stores a private key. In practical applications, the choice of communication key can be flexibly adjusted according to the specific application scenario.

[0125] Among them, the specified operation in the optional embodiment can be an arbitrary operation, which can be flexibly adjusted according to the specific application scenario in actual application.

[0126] It should be noted that the communication key content related to the caller in the optional embodiments is similar to the communication key content related to the called party (please refer to the following embodiments for introduction); at the same time, the communication key content related to the caller in the optional embodiments is also applicable to the following embodiments, and will not be repeated in the following embodiments.

[0127] S303, the calling party encapsulates the current timestamp and the signature data of the calling party to obtain an access token for calling the called party.

[0128] In the embodiment of the present application, the caller obtains the current timestamp and the signature data of the caller, and then can encapsulate the current timestamp and the signature data of the caller to obtain an access token.

[0129] For example, continuing with the above example, using Token_a to represent the access token, [Ti_a, Si_a] = Token_a.

[0130] In one embodiment of the present application, in S303, the process in which the calling party encapsulates the current timestamp and the signature data of the calling party to obtain an access token for calling the called party may include:

[0131] The calling party obtains identification information of the calling party and identification information of the called party;

[0132] The calling party encapsulates the identification information of the calling party, the identification information of the called party, the current timestamp, and the signature data of the calling party to obtain an access token for calling the called party.

[0133] That is, in an optional embodiment, the caller may first obtain the identification information of the caller and the identification information of the called party, and then encapsulate the identification information of the caller, the identification information of the called party, the current timestamp, and the signature data of the caller to obtain an access token.

[0134] For example, following the above example, Id_a is used to represent the identification information of the caller, and Id_r is used to represent the identification information of the called party, then [Id_a, Id_r, Ti_a, Si_a] = Token_a.

[0135] In this way, by implementing the optional embodiment, the identification information of the caller and the called party contained in the access token makes it easy for the called party to quickly obtain the communication key based on the identification information of the caller and the called party during verification.

[0136] It should be noted that Figure 3 For detailed description of S201, S203 to S204, please refer to Figure 2 S201, S203 to S204 shown are not described in detail here.

[0137] In the embodiment of the present application, the caller generates the signature data of the caller based on the request parameters and the current timestamp, and generates an access token based on the current timestamp and the signature data. This can easily and quickly implement the association and binding between the request parameters and the access token, and is suitable for a wide range of scenarios.

[0138] In one embodiment of the present application, another service processing method is provided, which can be executed by the calling party 101. Figure 4As shown, the business processing method may further include S401 to S402 before S201.

[0139] As described in the above-mentioned embodiment, the memory corresponding to the calling party stores all the communication keys required for business processing. The embodiment of the present application will describe in detail the origin of the communication keys on the calling party side.

[0140] S401 to S402 are described in detail as follows:

[0141] S401, if the caller receives the start instruction, the credential information of the caller is sent to the authentication system; wherein, the credential information is used by the authentication system to verify the container deployed by the caller based on the credential information and the stored credential information, and after the verification is passed, the communication key required for the caller to perform business processing stored locally is returned.

[0142] In the embodiment of the present application, the start instruction refers to an instruction to start the main caller, which can be issued by the requesting party with business needs.

[0143] Exemplarily, when the calling party is a service (such as an application app or a mini-program, etc.), the startup instruction can be a service start instruction (such as an application app start instruction or a mini-program start instruction).

[0144] Exemplarily, when the calling party is a server, the startup instruction may be a server startup instruction.

[0145] In the embodiment of the present application, when the caller receives the start instruction, the caller's credential information can be sent to the authentication system; accordingly, the authentication system verifies the container deployed by the caller based on the credential information and the stored credential information, and returns the communication key required for the caller to perform business processing stored locally after the verification is passed.

[0146] That is, in the optional embodiment, the authentication system locally stores all communication keys required by the caller for business processing, wherein all communication keys required by the caller for business processing are sent after the authentication system verifies the container deployed by the caller.

[0147] In the optional embodiment, the process of the authentication system verifying the container deployed by the calling party may include:

[0148] The authentication system detects the match between the credential information of the caller and the stored credential information;

[0149] If the authentication system detects that the credential information of the caller matches the stored credential information, a verification result is obtained indicating that the container deployed by the caller has been verified.

[0150] If the authentication system detects that the credential information of the caller does not match the stored credential information, a verification result indicating that the verification of the container deployed by the caller has failed is obtained.

[0151] That is, the process of the authentication system in the optional embodiment verifying the container deployed by the caller includes two cases:

[0152] In case 1, the credential information of the caller matches the stored credential information, which indicates that the container deployed by the caller has been authenticated.

[0153] In case 2, the credential information of the caller does not match the stored credential information, which indicates that the verification of the container deployed by the caller has failed.

[0154] In the optional embodiment, the credential information stored in the authentication system may be obtained from a third-party authority / trusted institution. For example, when the calling party is a service, the credential information stored in the authentication system may be the factory identification information of the hardware device where the service is deployed.

[0155] S402, the calling party receives the communication key sent by the authentication system, and stores the received communication key into the memory.

[0156] In the embodiment of the present application, after the authentication system verifies the container deployed by the caller based on the credential information and the stored credential information, it returns the communication key required for the caller to perform business processing stored locally; accordingly, the caller receives the communication key returned by the authentication system and stores the received communication key in the memory.

[0157] It can be understood that the calling party stores the communication key in the memory corresponding to the calling party. When the calling party is turned off, the communication key stored in the memory corresponding to the calling party will disappear, thereby ensuring the security of the communication key.

[0158] In one embodiment of the present application, before the calling party sends the credential information of the calling party to the authentication system, the following steps may be further included:

[0159] The caller sends a registration authorization request to the authentication system; wherein the registration authorization request is used by the authentication system to complete the registration of the caller on the authentication system based on the registration authorization request, and the authorization of the caller by the called party corresponding to the caller, and after completing the registration and authorization, the communication key required for the caller to perform business processing allocated to the caller is stored locally;

[0160] The calling party receives the registration and authorization completion information sent by the authentication system.

[0161] That is, in an optional embodiment, the caller can send a registration authorization request to the authentication system, wherein the registration authorization request is used to instruct the authentication system to register the caller on the authentication system, and to instruct the authentication system to authorize the caller by the called party corresponding to the caller.

[0162] Correspondingly, the authentication system receives the registration authorization request sent by the caller, and completes the registration of the caller on the authentication system based on the registration authorization request, as well as the authorization of the caller by the called party corresponding to the caller, and after completing the registration and authorization, stores the communication key required for the caller to perform business processing assigned to the caller locally; then returns the registration and authorization completion information.

[0163] Correspondingly, the calling party receives the registration and authorization completion information returned by the authentication system.

[0164] In the optional embodiment, the registration authorization request can be divided into two requests, for example, one request is used to instruct the authentication system to register the caller on the authentication system, and the other request is used to instruct the authentication system to authorize the caller by the called party corresponding to the caller. In actual applications, the registration authorization request can be flexibly adjusted according to the specific application scenario.

[0165] In the optional embodiment, the registration and authorization completion information is used to indicate that the authentication system has completed the registration of the caller on the authentication system, and the authorization of the caller by the callee corresponding to the caller.

[0166] In the optional embodiment, the process in which the authentication system performs authorization of the calling party by the called party corresponding to the calling party may include:

[0167] The authentication system sends an authorization request to the called party corresponding to the caller; wherein the authorization request is used for the called party corresponding to the caller to authorize the caller based on the authorization request, and returns the authorized result after authorization;

[0168] The authentication system receives the authorization result sent by the called party corresponding to the calling party.

[0169] That is, in an optional embodiment, the authentication system generates an authorization request for the caller, and sends the authorization request to the called party corresponding to the caller; accordingly, the called party corresponding to the caller receives the authorization request sent by the authentication system, performs authorization based on the authorization request, and then returns an authorized result; accordingly, the authentication system receives the authorized result returned by the called party corresponding to the caller.

[0170] It can be understood that the number of called parties corresponding to the caller can be one or more, which includes the called parties to which the caller sends the request parameters and access token in the aforementioned embodiment.

[0171] In this way, by implementing the optional embodiment, the caller sends a registration authentication request to the authentication system, and the authentication system completes the registration of the caller on the authentication system based on the registration authentication request, and the authorization of the caller by the called party corresponding to the caller, and then stores the communication key required for the caller to perform business processing allocated to the caller locally, so that when the caller needs to call the called party, the communication key required for the caller to perform business processing can be quickly sent to the caller, which improves the transmission efficiency of the communication key to a certain extent, and further improves the calling efficiency, making the business processing efficiency higher.

[0172] It can be understood that the process of deriving the communication key on the called party side is similar to the process of deriving the communication key on the calling party side, and so on, which will not be repeated in the following embodiments.

[0173] It should be noted that Figure 4 For detailed description of S201 to S204, please refer to Figure 2 S201 to S204 shown are not described in detail here.

[0174] In the embodiment of the present application, after receiving the start command, the main caller sends the credential information to the authentication system, and then the authentication system verifies the container deployed by the main caller based on the credential information and the stored credential information, and returns the communication key required by the main caller for business processing to the main caller after the verification is passed. In this way, the main caller is authenticated every time it obtains the communication key, avoiding the phenomenon that the main caller is attacked and the communication key is sent incorrectly, ensuring the security of the communication key. At the same time, the main caller stores the communication key in the memory corresponding to the main caller. When the main caller is closed, the communication key stored in the memory corresponding to the main caller will disappear, ensuring the security of the communication key. As a result, the call security is further improved, making the business processing security higher.

[0175] In one embodiment of the present application, another service processing method is provided, which can be executed by the calling party 101. Figure 5 As shown, the business processing method may further include S501 after S203.

[0176] S501 is described in detail as follows:

[0177] S501, the calling party obtains a response token returned by the called party after the called party passes the verification based on the request parameters and the access token; wherein the response token is generated by the called party based on the business data.

[0178] As described in the above embodiment, the calling party can obtain the business data returned by the called party after verification based on the request parameters and the access token.

[0179] In an embodiment of the present application, the caller can simultaneously obtain the business data and response token returned by the called party after verification based on the request parameters and the access token, wherein the response token refers to the credential / token used by the called party to respond to the caller, and the token is usually a string generated based on the business data. In other words, there is a binding relationship between the access token and the business data.

[0180] Accordingly, the service processing method may include S502 to S503 and S201 to S203.

[0181] S502 to S503 are described in detail as follows:

[0182] S502: The calling party performs verification based on the acquired business data and response token.

[0183] S503, the calling party processes the service request based on the acquired service data after the verification is passed.

[0184] In the embodiment of the present application, the calling party obtains the business data and the response token, and can then perform verification based on the business data and the response token, and process the business request based on the business data after the verification is passed.

[0185] It can be understood that the calling party performs verification based on the business data and the response token, that is, the calling party verifies the identity of the called party.

[0186] For example, if Bd is used to represent business data and Token_r is used to represent the response token, the main calling method performs verification based on Bd and Token_r, and processes the business request based on Bd after the verification is passed.

[0187] It should be noted that Figure 5 For detailed description of S201 to S203, please refer to Figure 2 S201 to S203 shown are not described in detail here.

[0188] In the embodiment of the present application, the calling party processes the service request based on the service data only after passing the verification based on the service data and the response token, thereby avoiding the phenomenon that the called party is attacked and returns erroneous service data, and ensuring the accuracy of service processing.

[0189] In one embodiment of the present application, another service processing method is provided, which can be executed by the calling party 101. Figure 6 As shown, the business processing method may include S601 to S603, S501, S503, and S201 to S203.

[0190] In the embodiment of the present application, the response token includes the generation timestamp of the response token and the signature data of the called party.

[0191] For example, continuing with the above example, Ti_r is used to represent the timestamp of the generation of the response token, and Si_r is used to represent the signature data of the called party, then Token_r = [Ti_r, Si_r].

[0192] S601 to S603 are described in detail as follows:

[0193] S601, the calling party concatenates the acquired business data with the generated timestamp to obtain a concatenated string.

[0194] S602, the calling party performs a hash operation on the obtained concatenated string to obtain the signature data of the called party.

[0195] In an embodiment of the present application, the process in which the caller generates the signature data of the called party based on the business data and the generation timestamp of the response token can be to first concatenate the business data and the generation timestamp of the response token to obtain a concatenated string, and then perform a hash operation on the obtained concatenated string to obtain the signature data of the called party.

[0196] For example, following the above example, let Bd = string 3 (e.g., Cinema 1-3), Ti_r = string 4 (e.g., 2023-06-16 09:00:05), then string 3 and string 4 are concatenated to obtain a concatenated string c_r'. At the same time, Si_r' is used to represent the signature data of the called party, then Si_r' = Hash(c_r').

[0197] In this way, by implementing the optional embodiment, the calling party uses the communication key to perform a hash operation on the obtained concatenated string, and can easily and quickly obtain the signature data of the called party, providing strong support for verification.

[0198] In one embodiment of the present application, the response token also includes identification information of the caller and identification information of the called party.

[0199] For example, following the above example, Id_a is used to represent the identification information of the caller, and Id_r is used to represent the identification information of the called party, then Token_r = [Id_a, Id_r, Ti_r, Si_r].

[0200] Accordingly, in S602, the process in which the calling party performs a hash operation on the obtained concatenated string to obtain the signature data of the called party may include:

[0201] The calling party obtains a communication key based on the identification information of the calling party and the identification information of the called party; wherein the communication key is sent after the authentication system verifies both the container deployed by the calling party and the container deployed by the called party;

[0202] The calling party uses the communication key to perform a hash operation on the obtained concatenated string to obtain the signature data of the called party.

[0203] That is, in an optional embodiment, the caller can first obtain the identification information of the caller and the called party from the response token, and then obtain the communication key based on the identification information of the caller and the called party, and then use the communication key to perform a hash operation on the obtained concatenated string to obtain the signature data of the called party.

[0204] For example, following the above example, using key to represent the communication key, Si_r'=Hash key (c_r').

[0205] S603, the caller verifies the signature data of the called party contained in the response token based on the obtained signature data of the called party.

[0206] In the embodiment of the present application, the caller calculates the signature data of the called party, and then can verify the signature data of the called party contained in the response token based on the calculated signature data of the called party.

[0207] For example, following the above example, the calculated signature data of the called party is Si_r', and the signature data of the called party contained in the response token is Si_r, then Si_r is verified based on Si_r'.

[0208] In one embodiment of the present application, the process in S603 where the caller verifies the signature data of the called party contained in the response token based on the obtained signature data of the called party may include:

[0209] The calling party detects whether the obtained signature data of the called party matches the signature data of the called party contained in the response token;

[0210] If the caller detects that the obtained signature data of the called party matches the signature data of the called party contained in the response token, a verification result is obtained, indicating that the signature data of the called party contained in the response token has been verified;

[0211] If the caller detects that the obtained signature data of the called party does not match the signature data of the called party contained in the response token, a verification result indicating that the verification of the signature data of the called party contained in the response token has failed is obtained.

[0212] That is, in the optional embodiment, the caller verifies the signature data of the called party contained in the response token based on the obtained signature data of the called party, including two cases:

[0213] Case 1: the obtained signature data of the called party matches the signature data of the called party contained in the response token, such as Si_r'=Si_r in the above example, which indicates that the caller has passed the verification based on the business data and the response token.

[0214] Case 2: the obtained signature data of the called party matches the signature data of the called party contained in the response token. For example, Si_r'≠Si_r in the above example, this indicates that the verification based on the business data and the response token by the caller has failed.

[0215] It should be noted that Figure 6 For detailed description of S501 and S503, please refer to Figure 5 S501 and S503 shown in FIG. Figure 6 For detailed description of S201 to S203, please refer to Figure 2 S201 to S203 shown are not described in detail here.

[0216] In the embodiment of the present application, the caller regenerates the signature data of the called party based on the business data, and matches the generated signature data of the called party with the signature data of the called party contained in the response token. This can easily and quickly implement verification based on business data and response tokens, and is suitable for a wide range of scenarios.

[0217] In one embodiment of the present application, another service processing method is provided, which can be executed by the calling party 101. Figure 7 As shown, the service processing method may include S701 to S702, S503, and S201 to S203.

[0218] S701 to S702 are described in detail as follows:

[0219] S701, the calling party receives the call response information sent by the called party; wherein the call response information is obtained by encrypting and encapsulating the business data and the response token after the called party passes the verification based on the request parameters and the access token.

[0220] S702, the calling party decrypts the response call information to obtain business data and a response token.

[0221] As described in the above embodiment, the calling party can simultaneously obtain the business data and response token returned by the called party after verification based on the request parameters and the access token.

[0222] In the embodiment of the present application, after the called party passes the verification based on the request parameters and the access token, the service data and the response token can be encrypted and encapsulated to obtain the response call information, and the response call information is sent to the calling party. The process of the called party obtaining the response call information is described in the following embodiment.

[0223] Correspondingly, the caller receives the response call information sent by the called party, and then decrypts the response call information to obtain the business data and response token, thereby enabling the caller to simultaneously obtain the business data and response token returned by the called party after verification based on the request parameters and access token.

[0224] For example, D is used to represent the response call information, and the decryption algorithm is assumed to be K2' (the decryption algorithm K2' matches the encryption algorithm K2 in the following embodiment), then (Bd, Token_r) = K2'(D).

[0225] In one embodiment of the present application, the response token includes identification information of the caller and identification information of the called party.

[0226] For example, continuing with the above example, Token_r = [Id_a, Id_r, Ti_r, Si_r].

[0227] Accordingly, in S702, the process in which the calling party decrypts the response call information to obtain the service data and the response token may include:

[0228] The calling party obtains a communication key based on the identification information of the calling party and the identification information of the called party; wherein the communication key is sent after the authentication system verifies both the container deployed by the calling party and the container deployed by the called party;

[0229] The caller uses the communication key to decrypt the response call information and obtain the business data and response token.

[0230] That is, in an optional embodiment, the caller can first obtain the identification information of the caller and the called party from the response token, and then obtain the communication key based on the identification information of the caller and the called party, and then use the communication key to decrypt the response call information to obtain business data and a response token.

[0231] For example, following the above example, using key to represent the communication key, (Bd, Token_r) = key(D).

[0232] In this way, by implementing the optional embodiment, the response token contains the identification information of the caller and the identification information of the called party, and the caller can quickly obtain the communication key based on the identification information of the caller and the identification information of the called party during verification.

[0233] In one embodiment of the present application, the calling party may receive a response call message sent by the called party, wherein the response call message is obtained by encapsulating the called party based on the response token and the encrypted business data; then the calling party decapsulates the response call message to obtain the response token and the encrypted business data, and decrypts the encrypted business data to obtain the decrypted business data. Exemplarily, the calling party may decrypt the business data using the communication key.

[0234] It should be noted that Figure 7 For a detailed description of S503, please refer to Figure 5 The S503 shown, Figure 7 For detailed description of S201 to S203, please refer to Figure 2 S201 to S203 shown are not described in detail here.

[0235] In the embodiment of the present application, the calling party obtains the business data and the response token by decrypting the response call information, which provides strong support for verification based on the business data and the response token.

[0236] It should be noted that Figures 2 to 7 The embodiment shown is explained from the perspective of the main caller. Figures 8 to 13 The implementation details of the technical solution of the embodiment of the present application are elaborated in detail from the perspective of the called party:

[0237] See also Figure 8 , Figure 8 FIG. 1 is a flowchart of a task processing method according to an embodiment of the present application, and the task processing method may be executed by the called party 102. Figure 8 As shown, the task processing method at least includes S801 to S803, which are described in detail as follows:

[0238] S801, the called party obtains the request parameters sent by the calling party for obtaining the business data required to process the business request and the access token for calling the called party; wherein, the request parameters and the access token are generated by the calling party after receiving the business request sent by the requesting party, and the access token is generated based on the request parameters.

[0239] In the embodiment of the present application, the called party can actively or passively obtain the request parameters sent by the calling party for obtaining the business data required for processing the business request and the access token for calling the called party. The generation process of the request parameters and the access token can be found in the introduction of the above embodiment, which will not be repeated here.

[0240] S802: The called party performs verification based on the request parameters and the access token.

[0241] In the embodiment of the present application, the called party obtains the request parameters and access token sent by the calling party, and can then perform verification based on the request parameters and access token.

[0242] For example, continuing with the above example, Re is used to represent the request parameter, and Token_a is used to represent the access token. The called party is verified based on Re and Token_a.

[0243] S803, after verification, the called party returns the service data matching the request parameters to the calling party, so that the calling party processes the service request based on the service data returned by the called party.

[0244] In the embodiment of the present application, after the called party passes the verification based on the request parameters and the access token, the called party returns the business data matching the request parameters to the calling party; accordingly, the calling party receives the business data matching the request parameters returned by the called party, and processes the business request based on the business data matching the request parameters.

[0245] In the embodiment of the present application, since the calling party can generate an access token easily and quickly, the called party can obtain the access token more efficiently, that is, the calling efficiency is improved, and the business processing efficiency is higher. At the same time, since the request parameters of the calling party are associated and bound with the access token, the security of the request parameters and the access token is higher, that is, the calling security is improved, and the business processing security is higher.

[0246] In one embodiment of the present application, another service processing method is provided, which can be executed by the called party 102. Fig. 9 As shown, the service processing method may include S901 to S903, S801, and S803.

[0247] In the embodiment of the present application, the access token includes the generation timestamp of the access token and the signature data of the calling party.

[0248] For example, following the above example, Ti_a is used to represent the generation timestamp of the access token, and Si_a is used to represent the signature data of the caller, then Token_a = [Ti_a, Si_a].

[0249] S901 to S903 are described in detail as follows:

[0250] S901, the called party concatenates the request parameter with the generated timestamp to obtain a concatenated string.

[0251] S902, the called party performs a hash operation on the obtained concatenated string to obtain the signature data of the calling party.

[0252] In an embodiment of the present application, the process of the called party generating the signature data of the caller based on the request parameters and the generation timestamp of the access token can be to first concatenate the request parameters and the generation timestamp of the access token to obtain a concatenated string, and then perform a hash operation on the obtained concatenated string to obtain the signature data of the caller.

[0253] For example, following the above example, let Re = string 1 (e.g., a movie theater near Ranjiaba, Yubei District, Chongqing), Ti_a = string 2 (e.g., 2023-06-16 09:00:05), then string 1 and string 2 are concatenated to obtain a concatenated string c_a'. At the same time, Si_a' is used to represent the signature data of the calling party, then Si_a' = Hash(c_a').

[0254] In one embodiment of the present application, the access token also includes identification information of the calling party and identification information of the called party.

[0255] For example, following the above example, Id_a is used to represent the identification information of the caller, and Id_r is used to represent the identification information of the called party, then Token_a = [Id_a, Id_r, Ti_a, Si_a].

[0256] Accordingly, the process in S902 where the called party performs a hash operation on the obtained concatenated string to obtain the signature data of the calling party may include:

[0257] The called party obtains a communication key based on the identification information of the calling party and the identification information of the called party; wherein the communication key is sent after the authentication system verifies both the container deployed by the calling party and the container deployed by the called party;

[0258] The called party uses the communication key to perform a hash operation on the concatenated string to obtain the signature data of the calling party.

[0259] That is, in an optional embodiment, the called party can first obtain the identification information of the caller and the called party from the access token, and then obtain the communication key based on the identification information of the caller and the called party, and then use the communication key to perform a hash operation on the obtained concatenated string to obtain the signature data of the caller.

[0260] For example, following the above example, using key to represent the communication key, Si_a'=Hash key (c_a').

[0261] In this way, by implementing the optional embodiment, the called party uses the communication key to perform a hash operation on the obtained concatenated string, and can easily and quickly obtain the signature data of the calling party, providing strong support for verification.

[0262] In one embodiment of the present application, the process of the called party acquiring the communication key based on the identification information of the calling party and the identification information of the called party may include:

[0263] The called party performs a specified operation based on the identification information of the calling party and the identification information of the called party to obtain a second operation result;

[0264] The called party obtains a communication key matching the second operation result from a memory corresponding to the called party; wherein the memory corresponding to the called party stores the communication key required by the calling party for business processing.

[0265] That is, in the optional embodiment, the memory corresponding to the called party stores all the communication keys required by the called party for business processing, wherein the number of all the communication keys can be one or more. For example, see Table 2, which is an example table of communication keys stored in the memory corresponding to the called party.

[0266] The communication key stored in the memory corresponding to the called party Communication key 1 required by business A Communication key 2 required by business B Communication key 3 required by business C

[0267] Table 2

[0268] Furthermore, under the current business processing situation, the called party can perform a specified operation based on the identification information of the calling party and the identification information of the called party to obtain a second operation result, and select a communication key that matches the second operation result from all stored communication keys.

[0269] Among them, in the optional embodiment, the communication key can be a symmetric key or an asymmetric key. It can be understood that the symmetric key indicates that the caller and the called party store the same key (for example, communication key 1 is the same, communication key 2 is the same, and communication key 3 is the same in Table 2 and Table 1), while the asymmetric key indicates that the caller and the called party store different keys, for example, the called party stores a private key and the caller stores a public key (for example, communication key 1 in Table 2 is a private key, and correspondingly, communication key 1 in Table 1 is a public key; communication key 2 in Table 2 is a private key, and correspondingly, communication key 2 in Table 1 is a public key; communication key 3 in Table 2 is a private key, and correspondingly, communication key 3 in Table 1 is a public key). In practical applications, the selection of communication keys can be flexibly adjusted according to specific application scenarios.

[0270] Among them, the specified operation in the optional embodiment can be an arbitrary operation, which can be flexibly adjusted according to the specific application scenario in actual application.

[0271] It should be noted that the communication key content related to the called party involved in the optional embodiment is similar to the communication key content related to the calling party in the aforementioned embodiment; at the same time, the communication key content related to the called party involved in the optional embodiment is also applicable to the following embodiments, and will not be repeated in the following embodiments.

[0272] S903: The called party verifies the signature data of the caller contained in the access token based on the obtained signature data of the caller.

[0273] In the embodiment of the present application, the called party calculates the signature data of the caller, and then can verify the signature data of the caller contained in the access token based on the calculated signature data of the caller.

[0274] For example, following the above example, the calculated signature data of the caller is Si_a', and the signature data of the caller contained in the access token is Si_a, then the called party verifies Si_a based on Si_a'.

[0275] In one embodiment of the present application, the process in S903 where the called party verifies the signature data of the caller contained in the access token based on the obtained signature data of the caller may include:

[0276] The called party detects whether the obtained signature data of the calling party matches the signature data of the calling party contained in the access token;

[0277] If the called party detects that the obtained signature data of the caller matches the signature data of the caller contained in the access token, a verification result is obtained, indicating that the signature data of the caller contained in the access token has been verified;

[0278] If the called party detects that the obtained signature data of the caller does not match the signature data of the caller contained in the access token, a verification result indicating that the signature data of the caller contained in the access token has failed to be verified is obtained.

[0279] That is, in the optional embodiment, the called party verifies the signature data of the caller contained in the access token based on the obtained signature data of the caller, including two cases:

[0280] Case 1: the signature data of the caller obtained matches the signature data of the caller contained in the access token, such as Si_a'=Si_a in the above example, which indicates that the called party has passed the verification based on the request parameters and the access token.

[0281] Case 2: the signature data of the caller matches the signature data of the caller contained in the access token. For example, in the above example, Si_a'≠Si_a, which indicates that the called party has failed the verification based on the request parameters and the access token.

[0282] It can be understood that the called party performs verification based on the request parameters and the access token, that is, the called party verifies the identity of the calling party.

[0283] Exemplarily, if the called party passes the identity authentication of the caller, the called party can check the access control list (i.e., the whitelist, where the whitelist contains the corresponding information of the caller that can access the called party, such as the identification number and name of the caller) to detect whether the caller has the authority to access. If it is detected that the caller has the authority to access, the business data is returned to the caller. If it is detected that the caller does not have the authority to access, the process is terminated or the result of no authority to access is returned to the caller.

[0284] It should be noted that the process in which the called party detects whether the caller has access authority through the access control list and the process in which the called party authenticates the caller's identity can be executed first, later, or in parallel. In actual applications, they can be flexibly adjusted according to the specific application scenario.

[0285] It should be noted that Fig. 9 For detailed description of S801 and S803, please refer to Figure 8 S801 and S803 shown are not described in detail here.

[0286] In the embodiment of the present application, the called party regenerates the signature data of the caller based on the request parameters, and matches the generated signature data of the caller with the signature data of the caller contained in the access token. This can easily and quickly implement verification based on business data and access tokens, and is suitable for a wide range of scenarios.

[0287] In one embodiment of the present application, another service processing method is provided, which can be executed by the called party 102. Fig.10 As shown, the business processing method may include S1001 to S1002 and S802 to S803.

[0288] S1001 to S1002 are described in detail as follows:

[0289] S1001, the called party receives the request calling information sent by the calling party; wherein the request calling information is obtained by the calling party through encryption and encapsulation based on the request parameters and the access token.

[0290] S1002: The called party decrypts the request call information to obtain request parameters and access token.

[0291] As described in the above-mentioned embodiment, the called party can simultaneously obtain the request parameters and the access token returned by the calling party after receiving the service request sent by the requesting party.

[0292] In the embodiment of the present application, after receiving the service request sent by the requester, the caller encrypts and encapsulates the request parameters and the access token, obtains the request call information, and sends the request call information to the called party. The process of the caller obtaining the request call information can be found in the introduction of the above embodiment.

[0293] Correspondingly, the called party receives the request call information sent by the calling party, and then decrypts the request call information to obtain the request parameters and access token, thereby enabling the called party to simultaneously obtain the request parameters and access token returned by the calling party after receiving the service request sent by the requesting party.

[0294] For example, R is used to represent the call request information, and the decryption algorithm is assumed to be K1' (the decryption algorithm K1' matches the encryption algorithm K1 in the above embodiment), then (Re, Token_a) = K1'(R).

[0295] In one embodiment of the present application, the access token includes identification information of the caller and identification information of the called party.

[0296] For example, continuing with the above example, Token_a = [Id_a, Id_r, Ti_a, Si_a].

[0297] Accordingly, the process in S1002 whereby the called party decrypts the request call information to obtain the request parameters and the access token may include:

[0298] The called party obtains a communication key based on the identification information of the calling party and the identification information of the called party; wherein the communication key is sent after the authentication system verifies both the container deployed by the calling party and the container deployed by the called party;

[0299] The called party uses the communication key to decrypt the request call information and obtain the request parameters and access token.

[0300] That is, in an optional embodiment, the called party can first obtain the identification information of the caller and the called party from the access token, and then obtain the communication key based on the identification information of the caller and the called party, and then use the communication key to decrypt the request call information to obtain the request parameters and the access token.

[0301] For example, following the above example, using key to represent the communication key, (Re, Token_a) = key(R).

[0302] In this way, by implementing the optional embodiment, the access token contains the identification information of the caller and the identification information of the called party, and the called party can quickly obtain the communication key based on the identification information of the caller and the identification information of the called party during verification.

[0303] In one embodiment of the present application, the called party may receive the request call information sent by the calling party, wherein the request call information is obtained by encapsulating the calling party based on the access token and the encrypted request parameters; then the called party decapsulates the request call information to obtain the access token and the encrypted request parameters, and decrypts the encrypted request parameters to obtain the decrypted request parameters. Exemplarily, the called party may decrypt the request parameters using the communication key.

[0304] It should be noted that Fig.10 For detailed description of S802 to S803, please refer to Figure 8 S802 to S803 shown are not described in detail here.

[0305] In the embodiment of the present application, the called party obtains the request parameters and access token by decrypting the request call information, which provides strong support for verification based on the request parameters and access token.

[0306] In one embodiment of the present application, another service processing method is provided, which can be executed by the called party 102. Fig.11 As shown, the business processing method may further include S1101 after S802.

[0307] S1101 is described in detail as follows:

[0308] S1101, after the called party passes the verification based on the request parameters and the access token, the called party generates a response token for responding to the calling party based on the business data.

[0309] In the embodiment of the present application, after the called party passes the verification based on the request parameters and the access token, it can generate a response token for responding to the calling party based on the business data.

[0310] In the embodiment of the present application, the response token refers to the credential / token used by the called party to respond to the calling party. The token is usually a string that is generated based on business data. In other words, there is a binding relationship between the access token and the business data.

[0311] Accordingly, the service processing method may include S1102, S801 to S802.

[0312] S1102 is described in detail as follows:

[0313] S1102, the called party returns the response token to the calling party, so that the calling party performs verification based on the business data and the response token, and processes the business request based on the acquired business data after the verification is passed.

[0314] In the embodiment of the present application, the called party generates a response token, and then can return the response token to the calling party; accordingly, the calling party simultaneously obtains the business data and the response token returned by the called party, and then can perform verification based on the business data and the response token, and process the business request based on the business data after the verification is passed.

[0315] For example, continuing with the above example, using Bd to represent the business data and Token_r to represent the response token, the called party sends Bd and Token_r to the calling party.

[0316] It should be noted that Fig.11 For detailed description of S801 to S802, please refer to Figure 8 S801 to S802 shown are not described in detail here.

[0317] In the embodiment of the present application, the called party returns both the business data and the response token to the calling party, so that the calling party can process the business request based on the business data only after verification based on the business data and the response token. This avoids the phenomenon that the called party is attacked and returns erroneous business data, thereby ensuring the accuracy of business processing.

[0318] In one embodiment of the present application, another service processing method is provided, which can be executed by the called party 102. Fig.12 As shown, the business processing method may include S1201 to S1203, S1102, and S801 to S802.

[0319] S1201 to S1203 are described in detail as follows:

[0320] S1201, the called party concatenates the business data with the current timestamp to obtain a concatenated string.

[0321] S1202, the called party performs a hash operation on the obtained concatenated character string to obtain the signature data of the called party.

[0322] In an embodiment of the present application, the process of the called party generating the signature data of the called party based on the business data and the current timestamp can be to first concatenate the business data with the current timestamp to obtain a concatenated string, and then perform a hash operation on the obtained concatenated string to obtain the signature data of the called party.

[0323] For example, following the above example, let Bd = string 3 (e.g., Cinema 1-3), Ti_r = string 4 (e.g., 2023-06-16 09:00:05), then the called party concatenates string 3 and string 4 to obtain a concatenated string c_r. At the same time, Si_r is used to represent the signature data of the called party, then Si_r = Hash(c_r).

[0324] In this way, by implementing the optional embodiment, the called party uses the communication key to perform a hash operation on the obtained concatenated string, and can easily and quickly obtain the signature data of the called party, providing strong support for the generation of the response token.

[0325] In one embodiment of the present application, the process in S1202 where the called party performs a hash operation on the obtained concatenated string to obtain the signature data of the called party may include:

[0326] The called party obtains a communication key based on the identification information of the calling party and the identification information of the called party; wherein the communication key is sent after the authentication system verifies both the container deployed by the calling party and the container deployed by the called party;

[0327] The called party uses the communication key to perform a hash operation on the obtained concatenated string to obtain the signature data of the called party.

[0328] That is, in an optional embodiment, the called party can first obtain the identification information of the caller and the identification information of the called party, and then obtain the communication key based on the identification information of the caller and the identification information of the called party, and then use the communication key to perform a hash operation on the obtained concatenated string to obtain the signature data of the called party.

[0329] For example, following the above example, using key to represent the communication key, Si_r = Hash key (c_r).

[0330] S1203, the called party encapsulates the current timestamp and the signature data of the called party to obtain a response token.

[0331] In the embodiment of the present application, the called party obtains the current timestamp and the signature data of the called party, and then the current timestamp and the signature data of the called party can be encapsulated to obtain a response token.

[0332] For example, continuing with the above example, Token_r is used to represent the response token, then [Ti_r, Si_r] = Token_r.

[0333] In one embodiment of the present application, the process in S1203 where the called party encapsulates the current timestamp and the signature data of the called party to obtain a response token may include:

[0334] Obtain identification information of the calling party and identification information of the called party;

[0335] The identification information of the caller, the identification information of the called party, the current timestamp, and the signature data of the called party are encapsulated to obtain a response token.

[0336] That is, in an optional embodiment, the called party may first obtain the identification information of the caller and the called party, and then encapsulate the identification information of the caller, the identification information of the called party, the current timestamp, and the signature data of the called party to obtain a response token.

[0337] For example, following the above example, Id_a is used to represent the identification information of the caller, and Id_r is used to represent the identification information of the called party, then [Id_a, Id_r, Ti_r, Si_r] = Token_r.

[0338] In this way, by implementing the optional embodiment, the identification information of the caller and the identification information of the called party contained in the response token makes it easy for the caller to quickly obtain the communication key based on the identification information of the caller and the called party during verification.

[0339] It should be noted that Fig.12 For detailed information about S1102, please refer to Fig.11 The S1102 shown, Fig.12 For detailed description of S801 to S802, please refer to Figure 8 S801 to S802 shown are not described in detail here.

[0340] In the embodiment of the present application, the called party generates the signature data of the called party based on the business data and the current timestamp, and generates a response token based on the current timestamp and the signature data. This can easily and quickly realize the association and binding between the business data and the response token, and is suitable for a wide range of scenarios.

[0341] In one embodiment of the present application, another service processing method is provided, which can be executed by the called party 102. Fig.13 As shown, the service processing method may include S1301 to S1302, S1101, and S801 to S802.

[0342] S1301 to S1302 are described in detail as follows:

[0343] S1301, after verification, the called party encrypts and encapsulates the business data and response token to obtain response call information.

[0344] In the embodiment of the present application, after the verification is passed, the called party can encrypt and encapsulate the business data and the response token to obtain the response call information.

[0345] For example, continuing with the previous example, use Bd to represent the business data, use Token_r to represent the response token, and use D to represent the response call information. Suppose the encryption algorithm is K2, then K2(Bd, Token_r)=D.

[0346] In one embodiment of the present application, the process in S1301 where the called party encrypts and encapsulates the service data and the response token after verification to obtain the response call information may include:

[0347] After the verification is passed, the called party obtains the communication key based on the identification information of the calling party and the identification information of the called party; wherein the communication key is sent by the authentication system after the container deployed by the calling party and the container deployed by the called party are verified;

[0348] The called party uses the communication key to encrypt and encapsulate the business data and response token to obtain the response call information.

[0349] That is, in an optional embodiment, after the verification is passed, the called party can first obtain the identification information of the caller and the identification information of the called party, and then obtain the communication key based on the identification information of the caller and the identification information of the called party, and then use the communication key to encrypt and encapsulate the business data and the response token to obtain the response call information.

[0350] For example, following the above example, using key to represent the communication key, key(Bd, Token_r)=D.

[0351] S1302: The called party sends a call response message to the calling party.

[0352] In the embodiment of the present application, the called party obtains the response call information, and then can send the response call information to the calling party; correspondingly, the calling party receives the response call information sent by the called party.

[0353] In one embodiment of the present application, the called party may encrypt the service data, and encapsulate the encrypted service data and the response token to obtain the response call information, and send the response call information to the calling party. Exemplarily, the called party may encrypt the service data using the communication key.

[0354] It should be noted that Fig.13 For detailed information about S1101, please refer to Fig.11 The S1101 shown, Fig.13 For detailed description of S801 to S802, please refer to Figure 8 S801 to S802 shown are not described in detail here.

[0355] In the embodiment of the present application, the called party encrypts and encapsulates the business data and the response token, obtains the response call information, and sends the response call information to the calling party, which avoids the business data and the response token from being tampered with or leaked during the sending process, ensures the security of the business data and the response token, further improves the call security, and makes the business processing more secure. At the same time, the encapsulation method can easily and quickly send the business data and the response token to the calling party, which is suitable for a wide range of scenarios.

[0356] The following is a detailed description of a specific scenario of an embodiment of the present application:

[0357] See also Fig.14 , mainly including the calling service, the called service and the authentication system. For example, the calling service can be deployed on server 1, the called service can be deployed on server 2, and the authentication system can be deployed on cloud server 3.

[0358] based on Fig.14 The implementation environment shown is shown in Fig.15 , Fig.15 FIG. 1 is a flow chart of a business processing method according to an embodiment of the present application. Fig.15 As shown, the service processing method at least includes S1501 to S1503, which are described in detail as follows:

[0359] S1501, both the calling service and the called service need to register in the authentication system first, and the person in charge of the calling service needs to request authorization from the person in charge of the called service. After the person in charge of the called service authorizes the calling service, the authentication system uses authentication certificates to verify the containers deployed by the calling service and the containers deployed by the called service respectively. After both verifications are passed, all the communication keys required by each service are allocated to the calling service and the called service.

[0360] For example, see Figure 16-1 and Figure 16-2 , which is an interface diagram for the authorized person in charge of a called service. If the "Add Authorization" component receives a trigger operation (such as a click operation), the "Add Authorization Module" interface pops up. Accordingly, the name of the calling service can be entered in the input box corresponding to the "Module Name" of the interface, so as to realize the authorization of the called service to the calling service. In actual applications, the authorization example diagram can be flexibly adjusted according to specific application scenarios.

[0361] For example, see Figure 16-3, is an interface diagram for the person in charge of a called service to control service permissions. In this interface, the called service configures its own access control list (ACL), such as adding, deleting, modifying, and checking. It can be understood that the access control list is a mechanism for controlling the access permissions of the called service. The access control list usually contains a set of rules for defining which calling services can access the called service, as well as the access methods and permissions, so as to achieve fine-grained control of its own service permissions.

[0362] S1502, if the authentication system detects that the calling service is started, it uses the authentication certificate to verify the container deployed by the calling party, and sends all the communication keys required by the calling service after the verification is successful; similarly, if the authentication system detects that the called service is started, it uses the authentication certificate to verify the container deployed by the called service, and sends all the communication keys required by the called service after the verification is successful.

[0363] Exemplarily, the communication key can be replaced regularly, for example, once every six months or one year. This further ensures the security of the communication key. In practical applications, the replacement time of the communication key can be flexibly adjusted according to the specific application scenario.

[0364] S1503, when the calling service calls the called service, it uses the communication key to generate request parameters (also called request message) and access token, and then uses the communication protocol agreed upon by both parties to send the request parameters and access token to the called service; accordingly, the called service can perform verification based on the request parameters and access token, and return the result (such as business data) to the calling service after the verification is passed.

[0365] Exemplarily, the called service verifies the identity of the calling service based on the request parameters and the access token, and also verifies the authorization of the called service to the calling service, wherein the authorization verification can be based on an access control list, i.e., detecting whether the calling service is in the access control list (i.e., detecting whether the calling service is in the whitelist).

[0366] It should be noted that Fig.15 For detailed description of S1501 to S1503 shown, please refer to the aforementioned embodiment, which will not be repeated here.

[0367] Optionally, in order to more easily understand S1501 in the above embodiment, please refer to Fig.17 , Fig.17 FIG. 1 is a flow chart of a business processing method according to an embodiment of the present application. Fig.17 As shown, the service processing method at least includes S1701 to S1705, which are described in detail as follows:

[0368] S1701, the calling service and the called service need to be registered in the authentication system.

[0369] S1702: The calling service requests the called service to access the called service.

[0370] S1703: The called service authorizes the calling service to access the calling service.

[0371] S1704, the management end generates a communication key and stores it in the database DB.

[0372] S1705, the management end writes the access control list and stores it in the database DB.

[0373] The management end is the background of the authentication system. It is understandable that there may be multiple services to implement the same business function, so the management end can manage the access control list in a unified manner, thereby facilitating the management of the services to be called.

[0374] It should be noted that Fig.17 For the detailed description of S1701 to S1705 shown, please refer to the aforementioned embodiment, which will not be repeated here.

[0375] Optionally, in order to facilitate understanding of S1502 to S1503 in the above embodiment, please refer to Fig.18 , Fig.18 FIG. 1 is a flow chart of a business processing method according to an embodiment of the present application. Fig.18 As shown, the service processing method at least includes S1801 to S1807, which are described in detail as follows:

[0376] S1801, after the main calling service is started (also called initialized), it carries the identity credentials (such as a certificate) to request the authentication system. After the authentication system verifies the identity of the main calling service (that is, the identity of the container deployed by the main calling service), it sends all the communication keys owned by the main calling service to the container of the main calling service.

[0377] It is understandable that the certificate is inserted into the container of the calling service when the container is created. Exemplarily, the communication key and access control list owned by the calling service can be asynchronously sent to the container of the called service.

[0378] S1802, after the called service is started (also called initialized), it carries the identity credentials (such as a certificate) to request the authentication system. After the authentication system verifies the identity of the called service (that is, the identity of the container deployed by the calling service), it sends all the communication keys and access control lists owned by the called service to the container of the called service.

[0379] It is understandable that the certificate is inserted into the container of the called service when the container is created. Exemplarily, all the communication keys and access control lists owned by the called service can be asynchronously sent to the container of the called service.

[0380] It should be noted that S1801 and S1802 can be executed either first or later, or in parallel.

[0381] S1803, the calling service generates an access token, and sends the request parameters (also called request service) and the access token to the called service.

[0382] Exemplarily, the calling service generates an access token, including:

[0383] 1) Define a structure that includes the following fields: identification information of the calling service, identification information of the called service, current timestamp, and signature data of the calling service.

[0384] 2) Concatenate the request parameters and the current timestamp into a string.

[0385] 3) Obtain the corresponding communication key according to the identification information of the calling service and the identification information of the called service.

[0386] 4) Follow the national encryption SM3-HMAC standard and use the communication key to perform a hash operation on the concatenated string to obtain the signature data of the main calling service.

[0387] 5) Fill the calling service's identification information, the called service's identification information, the current timestamp, and the calling service's signature data into the corresponding fields of the structure.

[0388] Exemplarily, the calling service encrypts the request parameters using the communication key, and encapsulates the access token and the encrypted request parameters to obtain the request calling information, and then sends the request calling information to the called service.

[0389] S1804: The called service performs verification based on the request parameters and the access token.

[0390] Exemplarily, the called service receives the request call information sent by the calling service, decapsulates the request call information to obtain the access token and the encrypted request parameters, and decrypts the encrypted request parameters using the communication key to obtain the decrypted request parameters.

[0391] Exemplarily, the called service performs verification based on the access token and the decrypted request parameters, including:

[0392] 1) Obtain the corresponding communication key according to the identification information of the calling service and the identification information of the own service.

[0393] 2) Concatenate the request parameters and the current timestamp contained in the access token into a string.

[0394] 3) Follow the national encryption SM3-HMAC standard and use the communication key to perform a hash operation on the concatenated string to obtain the signature data of the main calling service.

[0395] 4) Compare the calculated signature data of the calling service with the signature data of the calling service contained in the access token. If they are consistent, the identity authentication of the calling service is passed. If they are inconsistent, the identity authentication of the calling service is failed.

[0396] Exemplarily, if the called service passes the authentication of the calling service, the called service can check the access control list to detect whether the calling service has the authority to access (i.e., detect whether the calling service is in the whitelist). If it is detected that the calling service has the authority to access, S1805 is executed; if it is detected that the calling service does not have the authority to access, the process ends.

[0397] It should be noted that the process in which the called service detects whether the calling service has access authority through the access control list and the identity authentication process of the called service to the calling service can be executed first, later, or in parallel. In actual applications, they can be flexibly adjusted according to the specific application scenario.

[0398] S1805, after the called service passes the verification based on the request parameters and the access token, it generates a response token and sends the business data and the response token to the calling service.

[0399] Exemplarily, the calling service generates an access token, including:

[0400] 1) Define a structure that includes the following fields: identification information of the calling service, identification information of the called service, current timestamp, and signature data of the called service.

[0401] 2) Concatenate the business data and the current timestamp into a string.

[0402] 3) Obtain the corresponding communication key according to the identification information of the calling service and the identification information of the called service.

[0403] 4) Follow the national encryption SM3-HMAC standard and use the communication key to perform a hash operation on the concatenated string to obtain the signature data of the called service.

[0404] 5) Fill the identification information of the calling service, the identification information of the called service, the current timestamp, and the signature data of the called service into the corresponding fields of the structure.

[0405] Exemplarily, the called service uses the communication key to encrypt the business data, and encapsulates the response token and the encrypted business data to obtain response call information, and then sends the response call information to the called service.

[0406] S1806, the calling service performs verification based on the business data and the response token.

[0407] Exemplarily, the calling service receives the response call information sent by the called service, decapsulates the response call information to obtain a response token and encrypted business data, and decrypts the encrypted business data using a communication key to obtain decrypted business data.

[0408] Exemplarily, the calling service performs verification based on the response token and the decrypted business data, including:

[0409] 1) Obtain the corresponding communication key according to the identification information of the calling service and the identification information of the own service.

[0410] 2) Concatenate the business data and the current timestamp contained in the response token into a string.

[0411] 3) Follow the national encryption SM3-HMAC standard and use the communication key to perform a hash operation on the concatenated string to obtain the signature data of the called service.

[0412] 4) Compare the calculated signature data of the called service with the signature data of the called service contained in the response token. If they are consistent, the identity authentication of the called service is passed. If they are inconsistent, the identity authentication of the called service is failed.

[0413] S1807, after the main calling service is verified based on the business data and the response token, it processes the business logic based on the business data.

[0414] It should be noted that Fig.18 For detailed description of S1801 to S1807 shown, please refer to the aforementioned embodiment, which will not be repeated here.

[0415] The beneficial effects of the embodiments of the present application are as follows:

[0416] 1. Token generation:

[0417] On the one hand, by generating access tokens through the calling service, the related technology avoids the problem of generating access tokens through management (such as authentication systems), and the low efficiency of access token generation caused by factors such as the network or a large number of calling services needing to call the called services, thereby improving the calling efficiency and making the business processing efficiency higher. At the same time, the access token is generated based on the request parameters, that is, the access token is associated and bound with the request parameters, which avoids the related technology where the access token and the request parameters are sent to the called service separately, and the business data is incorrectly returned due to the leakage / theft of the access token or the tampering of the request parameters, thereby improving the calling security and making the business processing security higher, and having a wide range of applicable scenarios, especially for scenarios with high security requirements.

[0418] On the one hand, by generating a response token through the called service, the phenomenon of generating a response token through a management party (such as an authentication system) in related technologies is avoided, and the response token generation efficiency is low due to factors such as the network or a large number of calling services needing to call the called service, thereby improving the calling efficiency and making the business processing efficiency higher. At the same time, the response token is generated based on the business data, that is, the response token is associated and bound with the business data, which avoids the phenomenon of sending the response token and the business data to the called service separately in related technologies, and returning the business data incorrectly due to the leakage / theft of the response token or the tampering of the business data, thereby improving the calling security and making the business processing security higher, and having a wide range of applicable scenarios, especially for scenarios with high security requirements.

[0419] 2. Encryption using communication keys:

[0420] On the one hand, the calling service uses the communication key to encrypt the request parameters and sends the encrypted request parameters to the called service. This prevents the request parameters from being tampered with or leaked during the sending process, ensures the security of the request parameters, further improves the call security, and makes business processing more secure.

[0421] On the one hand, the called service uses the communication key to encrypt the business data and sends the encrypted business data to the calling service. This avoids the business data from being tampered with or leaked during the transmission process, ensures the security of the business data, further improves the call security, and makes business processing more secure.

[0422] 3. Issuance of communication keys:

[0423] On the one hand, every time the main calling service is started, the authentication system verifies the container deployed by the main calling service, avoiding the phenomenon of the main calling service being attacked and mistakenly sending the communication key, ensuring the security of the communication key. At the same time, the main calling service stores the communication key in the memory corresponding to the main calling service. When the main calling service is shut down, the communication key stored in the memory corresponding to the main calling service will disappear, ensuring the security of the communication key. As a result, the call security is further improved, making the business processing more secure.

[0424] On the one hand, every time the called service is started, the authentication system verifies the container deployed by the called service, avoiding the phenomenon of the called service being attacked and mistakenly sending the communication key, ensuring the security of the communication key. At the same time, the called service stores the communication key in the memory corresponding to the called service. When the called service is shut down, the communication key stored in the memory corresponding to the called service will disappear, ensuring the security of the communication key. As a result, the call security is further improved, making the business processing more secure.

[0425] Fig.19 FIG. 1 is a block diagram of a service processing device according to an embodiment of the present application. Fig.19 As shown, the device is configured on the main calling side, and the device includes:

[0426] The first generating module 1901 is configured to generate a request parameter for obtaining the business data required for processing the business request upon receiving a business request sent by a requester;

[0427] A second generating module 1902 is configured to generate an access token for calling the called party based on the request parameters;

[0428] The sending module 1903 is configured to encrypt and encapsulate the request parameters and the access token to obtain request call information, and send the request call information to the called party, so that the called party performs verification based on the request parameters and the access token;

[0429] The acquisition and processing module 1904 is configured to acquire the business data matching the request parameters returned by the called party after verification, and process the business request based on the acquired business data.

[0430] In one embodiment of the present application, the second generation module 1902 is specifically configured as follows:

[0431] Concatenate the request parameter with the current timestamp to obtain a concatenated string;

[0432] Performing a hash operation on the obtained concatenated string to obtain the signature data of the calling party;

[0433] The current timestamp and the signature data of the calling party are encapsulated to obtain the access token used to call the called party.

[0434] In one embodiment of the present application, the second generating module 1902 is further specifically configured as follows:

[0435] Acquire a communication key based on the identification information of the calling party and the identification information of the called party; wherein the communication key is sent after the authentication system verifies both the container deployed by the calling party and the container deployed by the called party;

[0436] The communication key is used to perform a hash operation on the obtained concatenated character string to obtain the signature data of the calling party.

[0437] In one embodiment of the present application, the second generating module 1902 is further specifically configured as follows:

[0438] Acquire identification information of the calling party and identification information of the called party;

[0439] The identification information of the calling party, the identification information of the called party, the current timestamp, and the signature data of the calling party are encapsulated to obtain the access token used to call the called party.

[0440] In one embodiment of the present application, the sending module 1903 is further specifically configured as follows:

[0441] Acquire a communication key based on the identification information of the calling party and the identification information of the called party; wherein the communication key is sent after the authentication system verifies both the container deployed by the calling party and the container deployed by the called party;

[0442] The request parameters and the access token are encrypted and encapsulated using the communication key to obtain the request call information.

[0443] In one embodiment of the present application, the second generating module 1902 or the sending module 1903 is further specifically configured as follows:

[0444] Performing a specified operation based on the identification information of the calling party and the identification information of the called party to obtain a first operation result;

[0445] Acquire a communication key matching the first operation result from the memory corresponding to the calling party; wherein the communication key required by the calling party for business processing is stored in the memory corresponding to the calling party.

[0446] In one embodiment of the present application, the sending module 1903 is further configured to:

[0447] If a start instruction is received, the credential information of the caller is sent to the authentication system; wherein the credential information is used by the authentication system to verify the container deployed by the caller based on the credential information and the stored credential information, and return the communication key required by the caller for business processing stored locally after the verification is passed;

[0448] The device also includes: a receiving module, configured to receive the communication key sent by the authentication system and store the received communication key in a memory.

[0449] In one embodiment of the present application,

[0450] The sending module 1903 is further configured to send a registration authorization request to the authentication system; wherein the registration authorization request is used by the authentication system to complete the registration of the caller on the authentication system based on the registration authorization request, and the authorization of the caller by the called party corresponding to the caller, and after completing the registration and authorization, the communication key allocated to the caller and required for the caller to perform business processing is stored locally;

[0451] The receiving module is further configured to receive registration and authorization completion information sent by the authentication system.

[0452] In one embodiment of the present application, the acquisition and processing module 1904 is further configured to:

[0453] Obtaining a response token returned by the called party after verification based on the request parameters and the access token; wherein the response token is generated by the called party based on business data;

[0454] The acquisition and processing module 1904 is specifically configured as follows:

[0455] Perform verification based on the acquired business data and the response token;

[0456] After the verification is passed, the service request is processed based on the acquired service data.

[0457] In one embodiment of the present application, the response token includes a generation timestamp of the response token and signature data of the called party; the acquisition and processing module 1904 is further specifically configured as follows:

[0458] Concatenate the acquired business data with the generated timestamp to obtain a concatenated string;

[0459] Performing a hash operation on the obtained concatenated string to obtain the signature data of the called party;

[0460] The signature data of the called party contained in the response token is verified based on the obtained signature data of the called party.

[0461] In one embodiment of the present application, the response token also includes identification information of the calling party and identification information of the called party; the acquisition and processing module 1904 is further specifically configured as follows:

[0462] Acquire a communication key based on the identification information of the calling party and the identification information of the called party; wherein the communication key is sent after the authentication system verifies both the container deployed by the calling party and the container deployed by the called party;

[0463] The communication key is used to perform a hash operation on the obtained concatenated character string to obtain the signature data of the called party.

[0464] In one embodiment of the present application, the acquisition and processing module 1904 is further specifically configured as follows:

[0465] Receiving the response call information sent by the called party; wherein the response call information is obtained by encrypting and encapsulating the service data and the response token after the called party passes the verification based on the request parameters and the access token;

[0466] The response call information is decrypted to obtain the business data and the response token.

[0467] In one embodiment of the present application, the response token includes identification information of the calling party and identification information of the called party; the acquisition and processing module 1904 is further specifically configured as follows:

[0468] Acquire a communication key based on the identification information of the calling party and the identification information of the called party; wherein the communication key is sent after the authentication system verifies both the container deployed by the calling party and the container deployed by the called party;

[0469] The response call information is decrypted using the communication key to obtain the business data and the response token.

[0470] Fig. 20 FIG. 1 is a block diagram of a service processing device according to an embodiment of the present application. Fig. 20 As shown, the device is configured at the called party, and the device includes:

[0471] The acquisition module 2001 is configured to acquire the request parameters sent by the calling party for acquiring the business data required for processing the business request and the access token for calling the called party; wherein the request parameters and the access token are generated by the calling party after receiving the business request sent by the requesting party, and the access token is generated based on the request parameters;

[0472] A verification module 2002, configured to perform verification based on the request parameters and the access token;

[0473] The return module 2003 is configured to return the service data matching the request parameters to the calling party after verification, so that the calling party processes the service request based on the service data returned by the called party.

[0474] In one embodiment of the present application, the access token includes a generation timestamp of the access token and signature data of the calling party; the verification module 2002 is specifically configured as follows:

[0475] Concatenate the request parameter with the generated timestamp to obtain a concatenated string;

[0476] Performing a hash operation on the obtained concatenated string to obtain the signature data of the calling party;

[0477] The signature data of the caller contained in the access token is verified based on the obtained signature data of the caller.

[0478] In one embodiment of the present application, the access token also includes identification information of the calling party and identification information of the called party; the verification module 2002 is further specifically configured as follows:

[0479] Acquire a communication key based on the identification information of the calling party and the identification information of the called party; wherein the communication key is sent after the authentication system verifies both the container deployed by the calling party and the container deployed by the called party;

[0480] The communication key is used to perform a hash operation on the obtained concatenated character string to obtain the signature data of the calling party.

[0481] In one embodiment of the present application, the acquisition module 2001 is specifically configured as follows:

[0482] Receiving the request call information sent by the calling party; wherein the request call information is obtained by the calling party through encryption and encapsulation based on the request parameters and the access token;

[0483] The request calling information is decrypted to obtain the request parameters and the access token.

[0484] In one embodiment of the present application, the access token includes identification information of the calling party and identification information of the called party; the acquisition module 2001 is further specifically configured as follows:

[0485] Acquire a communication key based on the identification information of the calling party and the identification information of the called party; wherein the communication key is sent after the authentication system verifies both the container deployed by the calling party and the container deployed by the called party;

[0486] The communication key is used to decrypt the request call information to obtain the request parameters and the access token.

[0487] In one embodiment of the present application, the device further comprises:

[0488] A generating module, configured to generate a response token for responding to the calling party based on the business data after verification based on the request parameters and the access token is passed;

[0489] The return module 2003 is further configured to return the response token to the caller, so that the caller performs verification based on the business data and the response token, and processes the business request based on the acquired business data after the verification is passed.

[0490] In one embodiment of the present application, the generation module is specifically configured as follows:

[0491] Concatenate the business data with the current timestamp to obtain a concatenated string;

[0492] Performing a hash operation on the obtained concatenated string to obtain the signature data of the called party;

[0493] The current timestamp and the signature data of the called party are encapsulated to obtain the response token.

[0494] In one embodiment of the present application, the generation module is further specifically configured as follows:

[0495] Acquire a communication key based on the identification information of the calling party and the identification information of the called party; wherein the communication key is sent after the authentication system verifies both the container deployed by the calling party and the container deployed by the called party;

[0496] The communication key is used to perform a hash operation on the obtained concatenated character string to obtain the signature data of the called party.

[0497] In one embodiment of the present application, the generation module is further specifically configured as follows:

[0498] Acquire identification information of the calling party and identification information of the called party;

[0499] The identification information of the calling party, the identification information of the called party, the current timestamp, and the signature data of the called party are encapsulated to obtain the response token.

[0500] In one embodiment of the present application, the return module 2003 is specifically configured as follows:

[0501] After the verification is passed, the business data and the response token are encrypted and encapsulated to obtain response call information;

[0502] The response call information is sent to the calling party.

[0503] In one embodiment of the present application, the return module 2003 is further specifically configured as follows:

[0504] After the verification is successful, a communication key is obtained based on the identification information of the calling party and the identification information of the called party; wherein the communication key is sent by the authentication system after the container deployed by the calling party and the container deployed by the called party are verified successfully;

[0505] The business data and the response token are encrypted and encapsulated using the communication key to obtain the response call information.

[0506] In one embodiment of the present application, the verification module 2002 or the return module 2003 is further specifically configured as follows:

[0507] Performing a specified operation based on the identification information of the calling party and the identification information of the called party to obtain a second operation result;

[0508] Acquire a communication key matching the second operation result from the memory corresponding to the called party; wherein the memory corresponding to the called party stores the communication key required by the called party for business processing.

[0509] It should be noted that the apparatus provided in the aforementioned embodiment and the method provided in the aforementioned embodiment belong to the same concept, wherein the specific manner in which each module and unit performs the operation has been described in detail in the method embodiment.

[0510] An embodiment of the present application also provides an electronic device, comprising: one or more processors; a memory for storing one or more programs, and when the one or more programs are executed by the one or more processors, the electronic device implements the above-mentioned business processing method.

[0511] Fig.21 It is a structural diagram of a computer system suitable for implementing an electronic device of an embodiment of the present application.

[0512] It should be noted that Fig.21 The computer system 2100 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0513] like Fig.21 As shown, the computer system 2100 includes a central processing unit (CPU) 2101, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 2102 or the program loaded from the storage part 2108 to the random access memory (RAM) 2103, such as executing the method in the above embodiment. In the RAM 2103, various programs and data required for system operation are also stored. The CPU 2101, ROM 2102 and RAM 2103 are connected to each other through a bus 2104. An input / output (I / O) interface 2105 is also connected to the bus 2104.

[0514] The following components are connected to the I / O interface 2105: an input section 2106 including a keyboard, a mouse, etc.; an output section 2107 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 2108 including a hard disk, etc.; and a communication section 2109 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 2109 performs communication processing via a network such as the Internet. A drive 2110 is also connected to the I / O interface 2105 as needed. A removable medium 2111, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 2110 as needed so that a computer program read therefrom is installed into the storage section 2108 as needed.

[0515] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a computer program for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication section 2109, and / or installed from a removable medium 2111. When the computer program is executed by a central processing unit (CPU) 2101, various functions defined in the system of the present application are executed.

[0516] It should be noted that the computer-readable medium shown in the embodiment of the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. Computer-readable media may be, for example, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples of computer-readable media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable medium may be any tangible medium containing or storing a program, which may be used by an instruction execution system, device or device or used in combination with it. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a computer-readable computer program is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. A computer program contained on a computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0517] The flowchart and block diagram in the accompanying drawings illustrate the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present application. Wherein, each box in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0518] The units involved in the embodiments described in this application may be implemented by software or hardware, and the units described may also be set in a processor. The names of these units do not, in some cases, constitute limitations on the units themselves.

[0519] Another aspect of the present application also provides a computer readable medium on which a computer program is stored, and when the computer program is executed by a processor, the business processing method as described above is implemented. The computer readable medium can be included in the electronic device described in the above embodiment, or it can exist independently without being assembled into the electronic device.

[0520] Another aspect of the present application also provides a computer program product or a computer program, which includes a computer instruction stored in a computer-readable medium. A processor of a computer device reads the computer instruction from the computer-readable medium, and the processor executes the computer instruction, so that the computer device executes the service processing method provided in each of the above embodiments.

[0521] The above content is only a preferred exemplary embodiment of the present application and is not intended to limit the implementation scheme of the present application. A person skilled in the art can easily make corresponding changes or modifications based on the main concept and spirit of the present application. Therefore, the scope of protection of the present application shall be based on the scope of protection required by the claims.

Claims

1. A business processing method, characterized in that: include: If the calling party receives the service request sent by the requesting party, it generates a request parameter for obtaining the service data required for processing the service request; The calling party generates an access token for calling the called party based on the request parameters; The calling party encrypts and encapsulates the request parameters and the access token to obtain request calling information, and sends the request calling information to the called party, so that the called party performs verification based on the request parameters and the access token; The calling party obtains the service data matching the request parameters returned by the called party after verification, and processes the service request based on the obtained service data.

2. The method according to claim 1, characterized in that The calling party generates an access token for calling the called party based on the request parameters, including: The calling party concatenates the request parameter with the current timestamp to obtain a concatenated string; The calling party performs a hash operation on the obtained concatenated string to obtain the signature data of the calling party; The calling party encapsulates the current timestamp and the signature data of the calling party to obtain the access token used to call the called party.

3. The method according to claim 2, characterized in that The calling party performs a hash operation on the obtained concatenated string to obtain the signature data of the calling party, including: The calling party obtains a communication key based on the identification information of the calling party and the identification information of the called party; wherein the communication key is sent after the authentication system verifies both the container deployed by the calling party and the container deployed by the called party; The calling party uses the communication key to perform a hash operation on the obtained concatenated character string to obtain the signature data of the calling party.

4. The method according to claim 2, characterized in that: The calling party encapsulates the current timestamp and the signature data of the calling party to obtain the access token for calling the called party, including: The calling party obtains identification information of the calling party and identification information of the called party; The calling party encapsulates the identification information of the calling party, the identification information of the called party, the current timestamp, and the signature data of the calling party to obtain the access token used to call the called party.

5. The method according to claim 1, characterized in that: The calling party encrypts and encapsulates the request parameters and the access token to obtain request call information, including: The calling party obtains a communication key based on the identification information of the calling party and the identification information of the called party; wherein the communication key is sent after the authentication system verifies both the container deployed by the calling party and the container deployed by the called party; The calling party uses the communication key to encrypt and encapsulate the request parameters and the access token to obtain the request calling information.

6. The method according to claim 3 or 5, characterized in that: The calling party obtains a communication key based on the identification information of the calling party and the identification information of the called party, including: The calling party performs a specified operation based on the identification information of the calling party and the identification information of the called party to obtain a first operation result; The calling party obtains a communication key matching the first operation result from a memory corresponding to the calling party; wherein the memory corresponding to the calling party stores the communication key required by the calling party for business processing.

7. The method according to claim 6, characterized in that The method further comprises: If the caller receives the start instruction, the credential information of the caller is sent to the authentication system; wherein the credential information is used by the authentication system to verify the container deployed by the caller based on the credential information and the stored credential information, and after the verification is passed, the communication key required by the caller for business processing stored locally is returned; The calling party receives the communication key sent by the authentication system, and stores the received communication key in a memory.

8. The method according to claim 7, characterized in that Before sending the credential information of the calling party to the authentication system, the method further includes: The calling party sends a registration authorization request to the authentication system; wherein the registration authorization request is used by the authentication system to complete the registration of the calling party on the authentication system based on the registration authorization request, and the authorization of the calling party by the called party corresponding to the calling party, and after completing the registration and authorization, the communication key allocated to the calling party and required for the calling party to perform business processing is stored locally; The calling party receives the registration and authorization completion information sent by the authentication system.

9. A business processing method, characterized in that: include: The called party obtains the request parameters sent by the calling party for obtaining the business data required to process the business request and the access token for calling the called party; wherein the request parameters and the access token are generated by the calling party after receiving the business request sent by the requesting party, and the access token is generated based on the request parameters; The called party performs verification based on the request parameters and the access token; The called party returns the service data matching the request parameters to the calling party after passing the verification, so that the calling party processes the service request based on the service data returned by the called party.

10. The method according to claim 9, characterized in that The access token includes a generation timestamp of the access token and signature data of the calling party; The called party performs verification based on the request parameter and the access token, including: The called party concatenates the request parameter with the generation timestamp to obtain a concatenated string; The called party performs a hash operation on the obtained concatenated string to obtain the signature data of the calling party; The called party verifies the signature data of the caller contained in the access token based on the obtained signature data of the caller.

11. The method according to claim 10, characterized in that The access token also includes identification information of the calling party and identification information of the called party; The called party performs a hash operation on the obtained concatenated string to obtain the signature data of the calling party, including: The called party obtains a communication key based on the identification information of the calling party and the identification information of the called party; wherein the communication key is sent after the authentication system verifies both the container deployed by the calling party and the container deployed by the called party; The called party uses the communication key to perform a hash operation on the obtained concatenated character string to obtain the signature data of the calling party.

12. The method according to claim 9, characterized in that The called party obtains the request parameters sent by the calling party for obtaining the service data required for processing the service request and the access token for calling the called party, including: The called party receives the request call information sent by the calling party; wherein the request call information is obtained by the calling party through encryption and encapsulation based on the request parameters and the access token; The called party decrypts the request calling information to obtain the request parameters and the access token.

13. The method according to claim 12, characterized in that The access token includes identification information of the calling party and identification information of the called party; The called party decrypts the request call information to obtain the request parameters and the access token, including: The called party obtains a communication key based on the identification information of the calling party and the identification information of the called party; wherein the communication key is sent after the authentication system verifies both the container deployed by the calling party and the container deployed by the called party; The called party uses the communication key to decrypt the request call information to obtain the request parameters and the access token.

14. An electronic device, characterized in that: include: one or more processors; A memory for storing one or more programs, which, when executed by the electronic device, enables the electronic device to implement the business processing method as described in any one of claims 1 to 13.

15. A computer readable medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the service processing method according to any one of claims 1 to 13 is implemented.

16. A computer program product comprising computer instructions, characterized in that When the computer instructions are executed by a processor, the business processing method according to any one of claims 1 to 13 is implemented.

Images