Communication method and device based on asymmetric encryption

Abstract

The invention provides a communication method and device based on asymmetric encryption. The method comprises the following steps: a client initiates an application access request to a server; the server side audits the application access request, and issues an authorization certificate and a unified service access software development kit after the application access request passes the auditing; the client analyzes the authorization certificate by using the unified service access software development kit, and obtains the application identifier, the public key and the server internet protocol address allocated by the server; an interface request is initiated to the server, the client uses a uniformly packaged request object, the request object adds an application identifier, calls a server internet protocol address and a signature encrypted by a public key, and the interface request is routed to the server; and the server authenticates the interface request and feeds back an interface response result to the client according to an authentication result. The method has remarkable technical advantages and wide application value in the aspect of system interface docking, and powerful support is provided for realizing efficient, safe and reliable system interaction.

Description

Technical Field

[0001] The present disclosure relates to the field of information security technology, and in particular to a communication method and device based on asymmetric encryption. Background Art

[0002] With the increasing popularity of digitalization, the number of business systems within enterprises is increasing. In the current technical environment, there is a large demand for data sharing between systems, so interface docking has become a necessary scenario.

[0003] At present, the common ways of system docking mainly include direct API calls and middleware integration. However, these methods have many shortcomings in practice: First, the security design is not sound, which may lead to the leakage of authentication information, and then cause the risk of key data leakage. The business systems within the enterprise usually contain a large amount of sensitive information, such as customer data, financial data, etc. Once the authentication information is leaked, these key data may be illegally obtained, causing serious losses to the enterprise. For example, in the process of directly calling the API, if the authentication mechanism is not perfect, attackers may illegally access the data of other systems by stealing authentication information. Second, there is a problem of high communication cost in the docking between systems. During the docking process, all parties need to communicate repeatedly about the docking method, which not only wastes a lot of time, but also consumes a lot of human resources. Since the development teams of different systems may come from different departments or suppliers, communication and coordination between them are often difficult, resulting in slow progress in docking. For example, for the middleware integration method, it is necessary to determine the adaptation parameters of each system and the middleware, and this process often requires repeated discussions and debugging by multiple teams. Third, the docking codes between systems are maintained separately, and due to the limitations of technical level, there is a situation of inconsistent development quality. Different developers may use different development specifications and technical solutions, which makes the quality of the docking code uneven. The uneven quality code may contain loopholes and errors, affecting the stability and reliability of the system, and also bringing difficulties to the subsequent maintenance and upgrade. For example, the docking code of some systems may not be fully tested, and it is easy to fail in actual operation, affecting the business process of the entire enterprise.

[0004] To sum up, the existing internal enterprise system docking methods have problems such as insufficient security, high communication costs and inconsistent development quality. Therefore, a new technical solution is urgently needed to solve these problems. Summary of the invention

[0005] In view of this, the purpose of the present invention is to overcome the problems of insufficient security, high communication cost and inconsistent development quality in the existing enterprise internal system docking method, and to provide a communication method and device based on asymmetric encryption.

[0006] Based on the above objectives, the present disclosure provides a communication method based on asymmetric encryption, comprising:

[0007] The client initiates an application access request to the server, wherein the application access request includes identity information of the application;

[0008] The server receives the application access request, reviews the application access request, issues an authorization certificate to the client after the review is passed, and provides a unified service access software development kit;

[0009] The client receives the unified service access software development kit and the authorization certificate provided by the server, and uses the unified service access software development kit to parse the authorization certificate to obtain the application identifier, public key and server Internet Protocol address assigned by the server;

[0010] Initiate an interface request to the server, the client uses the request object uniformly encapsulated in the unified service access software development kit, the request object automatically parses the authorization certificate and adds the application identifier, the calling server Internet Protocol address and the signature encrypted by the public key, and routes the interface request to the server;

[0011] The server receives the interface request from the client, authenticates the interface request, and feeds back the interface response result to the client according to the authentication result.

[0012] In one of the embodiments, the authorization certificate records the identity information, application identifier, public key and server Internet Protocol address of the application in the form of a binary stream.

[0013] In one of the embodiments, the server's review of the application access request includes manual review.

[0014] In one of the embodiments, when the client initiates an interface request to the server, the request object also includes the calling server media access control address, the current request timestamp, and the request body message digest algorithm version 5 check value information.

[0015] In one embodiment, it also includes:

[0016] After the client routes the interface request to the server, the client records the interface request to the external application request log.

[0017] In one of the embodiments, authenticating the interface request includes application identification verification, server Internet Protocol address verification, and signature verification.

[0018] In one of the embodiments, authenticating the interface request further includes verifying the server media access control address, verifying the current request timestamp, and verifying the request body message digest algorithm version 5 check value information.

[0019] In one embodiment, feeding back an interface response result to the client according to the authentication result includes:

[0020] If the authentication is successful, the server performs corresponding logic processing and returns the interface response result, and records it in the external application call log file;

[0021] If the authentication fails, the server rejects the interface request.

[0022] Based on the same inventive concept, the present disclosure also provides a communication device based on asymmetric encryption, comprising:

[0023] An application access module, which is used by the client to initiate an application access request to the server, wherein the application access request includes the identity information of the application;

[0024] An access review and authorization module, which is used for the server to receive the application access request, review the application access request, issue an authorization certificate to the client after the review is passed, and provide a unified service access software development kit;

[0025] An application initialization module, which is used for the client to receive the unified service access software development kit and authorization certificate provided by the server, and use the unified service access software development kit to parse the authorization certificate to obtain the application identifier, public key and server Internet Protocol address allocated by the server;

[0026] An interface communication module, which is used to initiate an interface request to the server. The client uses the request object uniformly encapsulated in the unified service access software development kit instead. The request object automatically parses the authorization certificate and adds the application identifier, the calling server Internet Protocol address and the signature after public key encryption, and routes the interface request to the server.

[0027] The request authentication feedback module is used for the server to receive the interface request from the client, authenticate the interface request, and feed back the interface response result to the client according to the authentication result.

[0028] In one of the embodiments, in the interface communication module, when the client initiates an interface request to the server, the request object addition also includes calling the server media access control address, the current request timestamp, and the request body message digest algorithm version 5 check value information.

[0029] Based on the same inventive concept, the present disclosure also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the communication method based on asymmetric encryption described in any of the above embodiments is implemented.

[0030] Based on the same inventive concept, the present disclosure also provides a non-transitory computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable a computer to execute the communication method based on asymmetric encryption described in any of the above embodiments.

[0031] From the above, it can be seen that the present disclosure provides a communication method and device based on asymmetric encryption. The system consists of a client and a server. It innovatively constructs a very complete system interface docking framework. In this framework, through carefully designed interface specifications and efficient communication protocols, the client code development work is greatly simplified. Client developers no longer need to spend a lot of time and energy to deal with complex interface interaction logic. They only need to develop according to the standard process provided by the framework to easily achieve seamless docking with the server. At the same time, the present disclosure adopts advanced security technologies, including encryption algorithms, strict authentication mechanisms, and multiple request verification, etc., to comprehensively guarantee the security of the server system. Whether it is to prevent external malicious attacks or to ensure the integrity and confidentiality of data during transmission, it has demonstrated excellent technical advantages and provides solid guarantees for the stable operation and reliable interaction of the system. The present disclosure has significant technical advantages and wide application value in system interface docking, and provides strong support for achieving efficient, safe and reliable system interaction. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the present disclosure or related technologies, the drawings required for use in the embodiments or related technical descriptions are briefly introduced below. Obviously, the drawings described below are only embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0033] Figure 1 is a flow chart of a communication method based on asymmetric encryption according to an implementation method;

[0034] Figure 2 A module structure diagram of a communication device based on asymmetric encryption according to an embodiment;

[0035] Figure 3 A schematic diagram of the hardware structure of an electronic device provided in another embodiment of the present disclosure. DETAILED DESCRIPTION

[0036] In order to make the objectives, technical solutions and advantages of the present disclosure more clearly understood, the present disclosure is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0037] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present disclosure should be understood by people with ordinary skills in the field to which the present disclosure belongs. The "first", "second" and similar words used in the embodiments of the present disclosure do not indicate any order, quantity or importance, but are only used to distinguish different components. "Including" or "comprising" and similar words mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0038] In order to keep the following description of the embodiments of the present disclosure clear and concise, the present disclosure omits detailed descriptions of some known functions and known components.

[0039] The disclosed embodiment provides a communication system based on asymmetric encryption, the system includes a client and a server. The client and the server establish communication to exchange data. The disclosed embodiment also provides a communication method based on asymmetric encryption, which is executed by the client and the server to ensure the data security of the client and the server.

[0040] like Figure 1 The communication method flow based on asymmetric encryption of an embodiment shown includes steps S100 to S104:

[0041] Step S100: The client initiates an application access request to the server, wherein the application access request includes identity information of the application;

[0042] Step S101: The server receives an application access request and reviews the application access request. After the review is passed, the server issues an authorization certificate to the client and provides a unified service access software development kit;

[0043] Step S102: The client receives the unified service access software development kit and the authorization certificate provided by the server, and uses the unified service access software development kit to parse the authorization certificate to obtain the application identifier, public key and server Internet Protocol address assigned by the server;

[0044] Step S103: Initiate an interface request to the server, the client uses the request object uniformly encapsulated in the unified service access software development kit, the request object automatically parses the authorization certificate and adds the application identifier, the calling server Internet Protocol address and the signature encrypted by the public key, and routes the interface request to the server;

[0045] Step S104: The server receives the interface request from the client, authenticates the interface request, and feeds back an interface response result to the client according to the authentication result.

[0046] In the communication method based on asymmetric encryption of the embodiment of the present disclosure, it innovatively constructs a very complete system interface docking framework. In this framework, through the carefully designed interface specifications and efficient communication protocols, the client code development work is greatly simplified. Client developers no longer need to spend a lot of time and energy to deal with complex interface interaction logic. They only need to develop according to the standard process provided by the framework to easily achieve seamless docking with the server. The present disclosure has significant technical advantages and wide application value in system interface docking, and provides strong support for achieving efficient, safe and reliable system interaction.

[0047] In the communication method based on asymmetric encryption of the embodiment of the present disclosure, it adopts advanced security technologies, including encryption algorithms, strict authentication mechanisms, and multiple request verification, etc., which comprehensively guarantee the security of the server system, whether it is to prevent external malicious attacks or to ensure the integrity and confidentiality of data during transmission, it has demonstrated excellent technical advantages and provides a solid guarantee for the stable operation and reliable interaction of the system. The present disclosure has significant technical advantages and wide application value in system interface docking, and provides strong support for achieving efficient, safe and reliable system interaction.

[0048] As a preferred implementation, the authorization certificate records the identity information, application identifier, public key and server Internet Protocol address of the application in a binary stream, which clarifies the specific form of the authorization certificate and the recorded content. The authorization certificate uses a binary stream, which means that it stores information in an efficient and compact format. The binary stream can be read and processed more quickly, reducing the overhead of data transmission and storage. The certificate records the identity information of the application, which may include the Internet Protocol address (IP), media access control address (MAC), application name and other information of the application, which are used to uniquely identify and distinguish different applications. The application identifier is a specific code or string used to quickly identify and locate the application in the system. The public key plays an important role in secure communication. It can be used to encrypt data or verify digital signatures to ensure the confidentiality and integrity of communication. The server Internet Protocol address provides the target address for communication between the client and the server, so that the client can accurately send the request to the correct server. This design enables the authorization certificate to provide the necessary information and security for the interaction between the client and the server, ensuring that only authorized applications can communicate effectively with the server.

[0049] In step S102, first, the client receives the unified service access software development kit (unified service access SDK) and authorization certificate provided by the server. SDK provides the necessary technical support and functional encapsulation for the interaction between the client and the server. The authorization certificate is the key credential for the client to obtain legal access rights. Then, the client uses the unified service access SDK to parse the authorization certificate. Through parsing, the client can obtain important information such as the application identifier, public key, and server Internet Protocol address assigned by the server. This process ensures that the client can interact with the server safely and effectively under the premise of legality, providing important guarantees for the stable operation of the system and the secure transmission of data.

[0050] As a preferred implementation, when initiating an interface request to the server, the request object also includes the media access control address of the calling server, the current request timestamp, and the request body message digest algorithm version 5 check value information, which describes the specific information contained in the request object when initiating an interface request to the server. Among them, adding the media access control address (MAC address) of the calling server can help the server better identify the source device of the request, especially in a local area network environment, the MAC address is unique and can be used for accurate identification and positioning of the device. The addition of the current request timestamp allows the server to understand the time sequence of the requests, which helps to process concurrent requests, determine the timeliness of requests, and perform logging and troubleshooting. The timestamp can be accurate to milliseconds or even higher, ensuring that each request has a clear time identifier. The provision of the request body message digest algorithm version 5 (MD5) check value information can enhance the integrity verification of the request. The MD5 check value is a fixed-length value obtained by performing a hash operation on the request body content. The server can recalculate the MD5 checksum based on the received request body and compare it with the checksum carried in the request object. If the two are consistent, it means that the request has not been tampered with during transmission, ensuring the integrity and security of the data. Therefore, the addition of the above information provides more comprehensive identification, time reference and data integrity protection for interface requests, which helps to improve the stability, security and maintainability of the system.

[0051] In step S103, when the client initiates an interface request to the server, the client uses the request object uniformly encapsulated in the unified service access software development kit instead. The request object adds application identification, calling server Internet Protocol address, calling server media access control address, current request timestamp, request body message digest algorithm version 5 check value information, and public key encrypted signature. First, the client uses the request object uniformly encapsulated in the unified service access SDK instead, which reflects the standardization and consistency of the system. The unified request object helps to improve development efficiency, reduce maintenance costs, and ensure that the request format of different clients is unified, which is convenient for the server to process. Secondly, the information added in the request object is of great significance. The application identification is used to clarify the initiator of the request, so that the server can identify different applications and perform corresponding permission management and processing. Calling the server Internet Protocol address and media access control address can help the server accurately determine the source location of the request, especially in a complex network environment, which is helpful for network management and troubleshooting. The current request timestamp provides the server with the time information of the request, which can be used to process concurrent requests, determine the timeliness of requests, and perform log recording and analysis. The fifth version of the request body message digest algorithm checksum information ensures the integrity of the request body during transmission and prevents data tampering. The signature after public key encryption provides higher security for the request. The server can verify the authenticity and legitimacy of the request by verifying the signature. These detailed request object content designs make the interface requests between the client and the server more secure, reliable, and manageable, providing a strong guarantee for the stable operation and efficient interaction of the system.

[0052] As a preferred implementation, step S103 also includes that after the interface request is routed to the server, the client records the interface request to an external application request log. On the one hand, recording the interface request can provide valuable clues for subsequent troubleshooting and fault diagnosis. If a problem occurs during the processing of the interface request, the developer can view the request log to understand the detailed information of the request, including the time, parameters, source, etc. of the request, so as to locate the problem more quickly. On the other hand, the request log can also be used for performance analysis and optimization. By analyzing the request data in the log, the load of the system, the frequency and response time of the request, etc. can be understood, providing a basis for the performance optimization of the system. In addition, recording the interface request can also meet the compliance requirements. In some specific industries and scenarios, it is necessary to record and audit the operation of the system to ensure the security and compliance of the system. Therefore, it is an important operation for the client to record the interface request to an external application request log, which helps to improve the maintainability, performance and compliance of the system.

[0053] As a preferred implementation, the authentication of the interface request includes application identification verification, server Internet Protocol address verification, server media access control address verification, current request timestamp verification, request body message digest algorithm version 5 check value information verification and signature verification. That is, when the server receives an interface request from the client, it performs the following verification on the request, and rejects the request if any item does not match.

[0054] Specifically, in step S104, first, check whether the IP in the request header is consistent with the official source IP, which can prevent requests from illegal sources from entering the system. If the IP is inconsistent, it may mean that the request is forged or comes from an unauthorized location. The server will reject the request and feedback the "401 Unauthorized" status code. Secondly, check whether the timestamp in the request header is within a reasonable range. The timestamp can be used to determine the timeliness of the request and prevent security issues such as replay attacks. If the timestamp exceeds the reasonable range, the server will consider that the request may be risky and reject it. Then, obtain the application registration information according to the application identifier in the request header, including the application registration IP, MAC and the assigned private key. This step helps to confirm whether the requested application is a legally registered application and obtain the necessary information for subsequent verification. Then, check whether the application registration IP and MAC are consistent with those provided in the request header. This further ensures that the source device of the request is consistent with the registration information, preventing illegal devices from impersonating the identifier of a legal application to make requests. Furthermore, the signature in the request header is decrypted using the private key assigned by the application, and the data in the signature information is compared with the relevant information in the header to see if they are consistent. The signature can ensure the integrity and authenticity of the request. By decrypting the signature and comparing it, it can be verified whether the request has been tampered with and whether it comes from a legitimate application. Finally, the request body is subjected to an MD5 check to see if it is consistent with the information in the signature. This once again ensures the integrity of the request body and prevents data from being tampered with during transmission. Through these strict verification steps, the server can effectively ensure the security of the system and prevent unauthorized access and malicious attacks.

[0055] As a preferred implementation, the interface response result is fed back to the client according to the authentication result, including that if the authentication is passed, the server performs corresponding logic processing, returns the interface response result, and records it in the external application call log file; if the authentication is not passed, the server rejects the interface request. Specifically, if the authentication is passed, it means that the client's request is legal and safe. At this time, the server will perform corresponding logic processing, which may include querying data from the database, performing specific business logic operations, etc. After the processing is completed, the server will return the interface response result to the client. This result can be a data query result, confirmation information of successful operation, etc. At the same time, the processing process is recorded in the external application call log file, which is helpful for subsequent auditing, troubleshooting and performance analysis. By recording the log, you can understand the system's operating conditions, which interfaces are frequently called, processing time and other information, and provide a basis for system optimization and maintenance. On the contrary, if the authentication is not passed, it means that there is a problem with the client's request, which may be an illegal request, a signature error, an inconsistent IP, etc. In this case, the server will reject the interface request and return a corresponding error status code to the client, such as "401Unauthorized". This can prevent illegal requests from entering the system and ensure the security and stability of the system. Therefore, the present embodiment performs different processing methods according to the authentication results, which not only ensures the security of the system, but also provides efficient services for legal requests.

[0056] The communication method based on asymmetric encryption in the above-mentioned embodiment has constructed a comprehensive and standardized system interface docking framework with innovative concepts, and has highly unified the interface docking process between different systems. Through clear interface specifications, standardized communication protocols and unified development processes, each system can follow consistent standards when performing interface interaction, avoiding compatibility issues and development confusion caused by inconsistent interfaces. This not only improves development efficiency, but also reduces maintenance costs, laying a solid foundation for efficient collaboration between systems.

[0057] The communication method based on asymmetric encryption in the above-mentioned embodiment greatly simplifies the code development work of interface calls, and provides developers with convenient development tools and clear development guides. Developers no longer need to get caught up in complex interface logic processing, but only need to follow the steps specified by the framework to quickly implement interface calls. This simplification not only shortens the development cycle, but also reduces the possibility of code errors and improves the quality and maintainability of the code.

[0058] The communication method based on asymmetric encryption in the above embodiment adopts advanced security technologies, such as encryption algorithms, strict authentication mechanisms, and multiple request verification, to comprehensively ensure the security of the system after opening the interface to the outside world. These security measures can effectively prevent external malicious attacks and ensure the integrity and confidentiality of data during transmission. At the same time, the present disclosure also avoids system security issues caused by the leakage of docking parameters, providing reliable protection for the stable operation of the system.

[0059] The communication method based on asymmetric encryption in the above-mentioned embodiment realizes the log recording function of both parties of the call. Both the client and the server can record the process and data of the interface call in detail, providing a strong basis for subsequent problem troubleshooting and data analysis. This log recording function not only improves the maintainability of the system, but also provides valuable reference information for the optimization and improvement of the system.

[0060] Correspondingly, the embodiment of the present disclosure also provides a communication device based on asymmetric encryption, such as Figure 2 As shown, the device comprises:

[0061] An application access module 100, which is used for the client to initiate an application access request to the server, wherein the application access request includes identity information of the application;

[0062] The access review and authorization module 101 is used for receiving the application access request at the server end, reviewing the application access request, issuing an authorization certificate to the client after the review is passed, and providing a unified service access software development kit;

[0063] Application initialization module 102, which is used for the client to receive the unified service access software development kit and authorization certificate provided by the server, and use the unified service access software development kit to parse the authorization certificate to obtain the application identifier, public key and server Internet Protocol address allocated by the server;

[0064] The interface communication module 103 is used to initiate an interface request to the server. The client uses the request object uniformly encapsulated in the unified service access software development kit instead. The request object automatically parses the authorization certificate and adds the application identifier, the calling server Internet Protocol address and the signature encrypted by the public key, and routes the interface request to the server.

[0065] The request authentication feedback module 104 is used for the server to receive the interface request from the client, authenticate the interface request, and feed back the interface response result to the client according to the authentication result.

[0066] In the communication device based on asymmetric encryption of the embodiment of the present disclosure, it innovatively constructs a very complete system interface docking framework. In this framework, through the carefully designed interface specifications and efficient communication protocols, the client code development work is greatly simplified. Client developers no longer need to spend a lot of time and energy to deal with complex interface interaction logic. They only need to develop according to the standard process provided by the framework to easily achieve seamless docking with the server. The present disclosure has significant technical advantages and wide application value in system interface docking, and provides strong support for achieving efficient, safe and reliable system interaction.

[0067] In the communication device based on asymmetric encryption of the embodiment of the present disclosure, it adopts advanced security technology, including encryption algorithm, strict authentication mechanism and multiple request verification, etc., which comprehensively guarantees the security of the server system, whether it is to prevent external malicious attacks or to ensure the integrity and confidentiality of data during transmission, it has demonstrated excellent technical advantages and provides a solid guarantee for the stable operation and reliable interaction of the system. The present disclosure has significant technical advantages and wide application value in system interface docking, and provides strong support for achieving efficient, safe and reliable system interaction.

[0068] The device of the above-mentioned embodiment is used to implement the corresponding communication method based on asymmetric encryption in the above-mentioned embodiment, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0069] It should be noted that the drawings of the embodiments of the present disclosure only involve structures related to the embodiments of the present disclosure, and other structures may refer to general designs.

[0070] It should be noted that the method of the embodiment of the present disclosure can be performed by a single device, such as a computer or a server. The method of the present embodiment can also be applied in a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present disclosure, and the multiple devices will interact with each other to complete the described method.

[0071] It should be noted that the above describes some embodiments of the present disclosure. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0072] Based on the same inventive concept, corresponding to any of the above-mentioned embodiments and methods, the present disclosure also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the communication method based on asymmetric encryption described in any of the above embodiments is implemented.

[0073] Figure 3 A more specific schematic diagram of the hardware structure of an electronic device provided in this embodiment is shown, and the device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are connected to each other through the bus 1050 in the device.

[0074] The processor 1010 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0075] The memory 1020 may be implemented in the form of ROM (Read On ly Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 may store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 1020 and are called and executed by the processor 1010.

[0076] The input / output interface 1030 is used to connect the input / output module to realize information input and output. The input / output module can be configured in the device as a component (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.

[0077] The communication interface 1040 is used to connect a communication module (not shown) to realize communication interaction between the device and other devices. The communication module can realize communication through a wired mode (such as USB, network cable, etc.) or a wireless mode (such as mobile network, WI FI, Bluetooth, etc.).

[0078] The bus 1050 includes a path that transmits information between the various components of the device (eg, the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040).

[0079] It should be noted that, although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040 and the bus 1050, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the embodiments of the present specification, and does not necessarily include all the components shown in the figure.

[0080] The electronic device of this embodiment is used to implement the corresponding communication method based on asymmetric encryption in any of the aforementioned embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be described in detail here.

[0081] Based on the same inventive concept, corresponding to any of the above-mentioned embodiment methods, the present disclosure also provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the communication method based on asymmetric encryption as described in any of the above embodiments.

[0082] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0083] The computer instructions stored in the storage medium of the above embodiment are used to enable the computer to execute the communication method based on asymmetric encryption as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0084] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present disclosure (including the claims) is limited to these examples. Based on the concept of the present disclosure, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the embodiments of the present disclosure as described above, which are not provided in detail for the sake of simplicity.

[0085] In addition, to simplify the description and discussion, and in order not to make the embodiments of the present disclosure difficult to understand, the known power / ground connections to the integrated circuit (IC) chips and other components may or may not be shown in the provided figures. In addition, the device can be shown in the form of a block diagram to avoid making the embodiments of the present disclosure difficult to understand, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform on which the embodiments of the present disclosure will be implemented (that is, these details should be fully within the scope of understanding of those skilled in the art). Where specific details (e.g., circuits) are set forth to describe exemplary embodiments of the present disclosure, it is apparent to those skilled in the art that the embodiments of the present disclosure can be implemented without these specific details or with changes in these specific details. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0086] Although the present disclosure has been described in conjunction with specific embodiments of the present disclosure, many replacements, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the embodiments discussed.

[0087] The embodiments of the present disclosure are intended to cover all such substitutions, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present disclosure should be included in the scope of protection of the present disclosure.

Claims

1. A communication method based on asymmetric encryption, characterized in that: include: The client initiates an application access request to the server, wherein the application access request includes identity information of the application; The server receives the application access request, reviews the application access request, issues an authorization certificate to the client after the review is passed, and provides a unified service access software development kit; The client receives the unified service access software development kit and the authorization certificate provided by the server, and uses the unified service access software development kit to parse the authorization certificate to obtain the application identifier, public key and server Internet Protocol address assigned by the server; Initiate an interface request to the server, the client uses the request object uniformly encapsulated in the unified service access software development kit, the request object automatically parses the authorization certificate and adds the application identifier, the calling server Internet Protocol address and the signature encrypted by the public key, and routes the interface request to the server; The server receives the interface request from the client, authenticates the interface request, and feeds back the interface response result to the client according to the authentication result.

2. The communication method based on asymmetric encryption according to claim 1, characterized in that: The authorization certificate records the identity information, application identifier, public key and server Internet Protocol address of the application in the form of binary stream.

3. The communication method based on asymmetric encryption according to claim 1 or 2, characterized in that: The server reviews the application access request, including manual review.

4. The communication method based on asymmetric encryption according to claim 1 or 2, characterized in that: When the client initiates an interface request to the server, the request object also includes the calling server media access control address, the current request timestamp, and the request body message digest algorithm version 5 checksum information.

5. The communication method based on asymmetric encryption according to claim 4, characterized in that: Also includes: After the client routes the interface request to the server, the client records the interface request to the external application request log.

6. The communication method based on asymmetric encryption according to claim 4, characterized in that: Authentication of the interface request includes application identification verification, server Internet Protocol address verification and signature verification.

7. The communication method based on asymmetric encryption according to claim 6, characterized in that: Authentication of the interface request also includes server side media access control address verification, current request timestamp verification, and request body message digest algorithm version 5 verification value information verification.

8. The communication method based on asymmetric encryption according to claim 4, characterized in that: Feedback an interface response result to the client according to the authentication result, including: If the authentication is successful, the server performs corresponding logic processing and returns the interface response result, and records it in the external application call log file; If the authentication fails, the server rejects the interface request.

9. A communication device based on asymmetric encryption, characterized in that: include: An application access module, which is used by the client to initiate an application access request to the server, wherein the application access request includes the identity information of the application; An access review and authorization module, which is used for the server to receive the application access request, review the application access request, issue an authorization certificate to the client after the review is passed, and provide a unified service access software development kit; An application initialization module, which is used for the client to receive the unified service access software development kit and authorization certificate provided by the server, and use the unified service access software development kit to parse the authorization certificate to obtain the application identifier, public key and server Internet Protocol address allocated by the server; An interface communication module, which is used to initiate an interface request to the server. The client uses the request object uniformly encapsulated in the unified service access software development kit instead. The request object automatically parses the authorization certificate and adds the application identifier, the calling server Internet Protocol address and the signature after public key encryption, and routes the interface request to the server. The request authentication feedback module is used for the server to receive the interface request from the client, authenticate the interface request, and feed back the interface response result to the client according to the authentication result.

10. The communication device based on asymmetric encryption according to claim 9, characterized in that: In the interface communication module, when the client initiates an interface request to the server, the request object also includes the calling server media access control address, the current request timestamp and the request body message digest algorithm version 5 check value information.

Images