Software caller verification method and device, equipment and storage medium
By receiving the caller's authorization request and generating corresponding information or allocating key files according to the selected verification method, the verification process of the software caller is simplified, the verification process of the software caller is solved, the verification process of the existing technology is complicated and insufficient security, and the security and management convenience are achieved.
Patent Information
- Application Number
- CN202411673663.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-21
- Publication Date
- 2025-04-25
AI Technical Summary
In the prior art, the verification process of the software caller is complex, especially as the number of callers increases, digital signature technology requires the interface provider to identify the signatures of all callers, resulting in the complex identification process and may involve copyright issues and complex certificate application processes.
Provide a software caller verification method, which determines the verification method (whitelist verification or signature verification) by receiving the caller's authorization request, and generates corresponding information or allocates a key file for the caller according to the selected verification method, and finally receives the caller's interface call request and performs verification.
The verification process is simplified, avoiding the need for the interface provider to provide the original key to the caller, improving security and management convenience, and reducing the complexity of the verification process.
Smart Images
Figure CN119885286A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of software technology, and in particular to a software caller verification method, device, equipment and storage medium. Background Art
[0002] Many software, especially those that provide data, generally provide external interfaces for external calls to obtain data or perform operations. However, for reasons such as data security, the caller needs to be authorized before calling the interface. Only authorized callers are allowed to call the corresponding interface.
[0003] At present, digital signature technology is usually used to verify software callers. However, digital signature technology requires the interface provider to identify the signatures of all callers. As the number of callers increases, the entire identification process becomes complicated. If the above solution is not adopted, the caller needs to use the signature of the interface provider. However, this may involve copyright issues and require the application of a certificate, making the entire operation process more complicated. Summary of the invention
[0004] In view of the defects in the prior art, the purpose of the present invention is to provide a software caller verification method, device, equipment and storage medium.
[0005] In a first aspect, an embodiment of the present application provides a software caller verification method, comprising:
[0006] Receive the authorization request from the caller;
[0007] Determine a verification method for the caller according to the authorization request; the verification method includes: whitelist verification and / or signature verification;
[0008] If the verification method for the caller is whitelist verification, generating whitelist information for the caller program;
[0009] If the verification method for the caller is signature verification, a secret key is allocated to the caller and a secret key file is generated, and a signature file is generated for the caller program according to the secret key file, or the secret key file is sent to the caller so that the caller generates a signature file according to the secret key file;
[0010] Receive an interface call request from the caller, and obtain program information of the caller;
[0011] Verifying the program information;
[0012] If the verification result is passed, the interface function is provided to the caller.
[0013] Optionally, generating whitelist information for the caller program includes:
[0014] Extracting program information of the caller;
[0015] According to a preset rule, the extracted program information is converted into first target data;
[0016] The first target data is written into a first preset file.
[0017] Optionally, allocating a secret key to the caller includes:
[0018] The secret key is associated with the caller and recorded; wherein the secret key associated with the caller is used to generate a secret key file for the caller, and the form of the secret key includes: a character string.
[0019] Optionally, generating a key file includes:
[0020] Converting the secret key assigned to the caller into preset secret key data;
[0021] The preset key data is written into the second preset file.
[0022] Optionally, generating a signature file for the caller program according to the secret key file includes:
[0023] Extracting program information of the caller;
[0024] Combining the program information with the preset key data to obtain second target data;
[0025] The second target data is written into the signature file.
[0026] Optionally, the verifying the program information includes any of the following methods:
[0027] Performing a positive verification on the program information; the positive verification means: obtaining the program information and the secret key used by the caller when signing, regenerating whitelist data or signature data by the same method as used when signing, and verifying the regenerated whitelist data with the preset whitelist data, or verifying the regenerated signature data with the preset signature data;
[0028] Performing a reverse check on the program information; the reverse check refers to: restoring the corresponding secret key and program information according to the preset whitelist data or the preset signature data, and verifying the restored secret key and program information with the actual secret key and the actual program information respectively.
[0029] Optionally, the method further comprises:
[0030] If the verification result is failed, a call failure prompt message is fed back to the caller.
[0031] In a second aspect, an embodiment of the present application provides a software caller verification device, comprising:
[0032] A receiving module, used for receiving the authorization request from the caller;
[0033] A determination module, used to determine a verification method for the caller according to the authorization request; the verification method includes: whitelist verification and / or signature verification;
[0034] An authorization module, for generating whitelist information for a caller program when the verification method for the caller is whitelist verification; for allocating a secret key to the caller and generating a secret key file when the verification method for the caller is signature verification, and generating a signature file for the caller program according to the secret key file, or sending the secret key file to the caller so that the caller can generate a signature file by itself according to the secret key file;
[0035] The receiving module is further used to receive the interface calling request of the caller and obtain the program information of the caller;
[0036] A verification module, used for verifying the program information;
[0037] The interface providing module is used to provide the interface function to the caller when the verification result is passed.
[0038] In a third aspect, an embodiment of the present application provides a software caller verification device, including: a processor and a memory, wherein the memory stores executable program instructions, and when the processor calls the program instructions in the memory, the processor is used to:
[0039] Execute the steps of the software caller verification method as described in any one of the first aspects.
[0040] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium for storing a program, which, when executed, implements the steps of the software caller verification method as described in any one of the first aspects.
[0041] Compared with the prior art, the present invention has the following beneficial effects:
[0042] In this application, the authorization request of the caller is received; according to the authorization request, the verification method for the caller is determined; the verification method includes: whitelist verification, and / or signature verification; if the verification method for the caller is whitelist verification, whitelist information is generated for the caller program; if the verification method for the caller is signature verification, a secret key is allocated to the caller and a secret key file is generated, and a signature file is generated for the caller program according to the secret key file, or the secret key file is sent to the caller so that the caller generates a signature file according to the secret key file; the interface call request of the caller is received, and the program information of the caller is obtained; the program information is verified; if the verification result is passed, the interface function is provided to the caller. As a result, the interface party does not need to provide the original secret key to the caller, but only needs to distribute the generated secret key file to the licensed caller, and the whole process is very simple. Among them, all secret key files are provided by the interface provider, which is convenient for managing the caller. After obtaining the secret key file, the caller can generate the signature file by itself, which is very simple. Since the interface provider only provides the key file, it is difficult to crack, and if the key file is leaked, the interface provider can cancel the authorization, which improves security. In addition, the interface provider also provides a whitelist mechanism, so trusted callers do not need to sign, which simplifies the verification process while ensuring security. BRIEF DESCRIPTION OF THE DRAWINGS
[0043] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following will briefly introduce the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings in the following descriptions are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without creative work. By reading the detailed description of the non-limiting embodiments with reference to the following drawings, other features, purposes and advantages of the present invention will become more obvious:
[0044] Figure 1 A flowchart of a software caller verification method provided in an embodiment of the present application;
[0045] Figure 2 A flowchart of an interface provider authorization provided in an embodiment of the present application. DETAILED DESCRIPTION
[0046] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0047] It should be noted that when a component is said to be "fixed to" another component, it can be directly on the other component or there can be a central component. When a component is said to be "connected to" another component, it can be directly connected to the other component or there can be a central component at the same time.
[0048] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein in the specification of this application are only for the purpose of describing specific embodiments and are not intended to limit this application. The term "and / or" used herein includes any and all combinations of one or more of the related listed items.
[0049] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein, for example, can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.
[0050] The following specific embodiments are used to describe in detail the technical solution of the present invention and how the technical solution of the present application solves the above technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.
[0051] In conjunction with the accompanying drawings, some embodiments of the present application are described in detail below. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.
[0052] Figure 1 A flowchart of a software caller verification method provided in an embodiment of the present application is shown in FIG. Figure 1As shown, the method can be applied to an interface provider, and the method may include the following steps:
[0053] Step S101: Receive an authorization request from the caller.
[0054] In this embodiment, the caller refers to the interface caller, that is, the interface provider obtains the calling authority of the corresponding interface from the interface provider. The interface provider verifies the program information of the caller and determines whether to provide the interface function to the other party according to the verification result.
[0055] Step S102: Determine a verification method for the caller according to the authorization request.
[0056] The verification method includes: whitelist verification and / or signature verification.
[0057] In this embodiment, two verification methods are provided, and one of the two verification methods can be selected or used simultaneously. It should be noted that, generally speaking, as long as any verification method passes the verification, the verification result is considered to be passed.
[0058] Step S103: If the verification method for the caller is whitelist verification, whitelist information is generated for the caller program.
[0059] In this embodiment, the interface provider generates whitelist information for the caller program through a whitelist generation module.
[0060] Exemplarily, the process of generating the whitelist information includes: extracting the program information of the caller; converting the extracted program information into first target data according to a preset rule; and writing the first target data into a first preset file.
[0061] In this embodiment, the whitelist information may be specific data converted from the extracted caller program information and written into a specific file according to a certain rule.
[0062] Step S104: If the verification method for the caller is signature verification, a key is allocated to the caller and a key file is generated, and a signature file is generated for the caller program based on the key file, or the key file is sent to the caller so that the caller can generate a signature file based on the key file.
[0063] In this embodiment, the interface provider distributes a key to the caller through the key distribution module, generates a key file, and gives the key file and the signature module to the caller. After the caller program is generated, the signature module and the key file are used to generate a signature file for the program.
[0064] Exemplarily, the secret key is associated with the caller and recorded; wherein the secret key associated with the caller is used to generate a secret key file for the caller, and the form of the secret key includes: a character string.
[0065] In this embodiment, the interface provider associates the key with the caller and records it. That is, the interface provider determines that the key is used to generate the key file of the caller. The key generally refers to a specific data string, such as a specific character string.
[0066] Exemplarily, the key assigned to the caller is converted into preset key data; and the preset key data is written into a second preset file.
[0067] In this embodiment, the interface provider uses the key distribution module to convert the key allocated to the caller into specific key data and write the data into a file.
[0068] Exemplarily, extract the program information of the caller; combine the program information with the preset key data to obtain second target data; and write the second target data into a signature file.
[0069] In this embodiment, the caller obtains the key file and the signature module, and after the calling program is generated, uses the signature module to obtain program information. Finally, the program information is combined with the key data in the key file to generate a specific data and write it into the signature file.
[0070] For example, in Figure 2 The authorization process of the interface provider is shown in the figure. First, the caller initiates an authorization request, and the interface provider determines the verification method based on the authorization request sent by the caller. Generally, there are two ways to verify, the first is whitelist verification, and the other is signature verification. If whitelist verification is used, whitelist information is generated for the caller program; if signature verification is used, a secret key is assigned to the caller, and a secret key file is generated, and a signature file is generated through the key file.
[0071] It should be noted that when two methods are used for verification, if only one of the methods passes the verification, it is considered that the verification has passed, and the caller can execute the interface function normally. If both methods fail to verify, it is considered that the verification has failed.
[0072] Step S105: Receive an interface call request from the caller, and obtain program information of the caller.
[0073] Step S106: Verify the program information.
[0074] In this embodiment, when extracting program information for verification, more or less program information may be extracted as needed.
[0075] Exemplarily, the program information can be positively verified; the positive verification refers to: obtaining the program information and the secret key used by the caller to sign, regenerating the whitelist data or signature data by the same method used when signing, and verifying the regenerated whitelist data with the preset whitelist data, or verifying the regenerated signature data with the preset signature data.
[0076] In this embodiment, the preset whitelist data refers to the existing whitelist data of the interface provider; the preset signature data refers to the existing signature data of the interface provider.
[0077] Exemplarily, the program information may also be reverse checked; the reverse check refers to: restoring the corresponding secret key and program information according to preset whitelist data or preset signature data, and respectively verifying the restored secret key and program information with the actual secret key and actual program information.
[0078] In this embodiment, the actual key refers to the key actually used by the caller, and the actual program information refers to the actual program information of the caller.
[0079] Step S107: If the verification result is passed, the interface function is provided to the caller.
[0080] Exemplarily, if the verification result is failure, a call failure prompt message is fed back to the caller.
[0081] In this embodiment, when the calling program calls the interface, the interface obtains program information and uses the verification module to verify it. If the verification passes, the interface function is provided, and if the verification fails, the call failure is returned.
[0082] In this embodiment, the authorization request of the caller is received; according to the authorization request, the verification method for the caller is determined; the verification method includes: whitelist verification, and / or signature verification; if the verification method for the caller is whitelist verification, whitelist information is generated for the caller program; if the verification method for the caller is signature verification, a secret key is allocated to the caller and a secret key file is generated, and a signature file is generated for the caller program according to the secret key file, or the secret key file is sent to the caller so that the caller generates a signature file according to the secret key file; the interface call request of the caller is received, and the program information of the caller is obtained; the program information is verified; if the verification result is passed, the interface function is provided to the caller. As a result, the interface party does not need to provide the original secret key to the caller, but only needs to distribute the generated secret key file to the permitted caller, and the whole process is very simple. Among them, all secret key files are provided by the interface provider, which is convenient for managing the caller. After obtaining the secret key file, the caller can generate the signature file by itself, which is very simple. Since the interface provider only provides the key file, it is difficult to crack, and if the key file is leaked, the interface provider can cancel the authorization, which improves security. In addition, the interface provider also provides a whitelist mechanism, so trusted callers do not need to sign, which simplifies the verification process while ensuring security.
[0083] Exemplarily, a specific embodiment of a whitelist verification method is as follows:
[0084] Department B of Company A provides a set of interfaces for external calls to obtain the running data of its SA software. At the same time, Department C of the company is commissioned to develop a program SC to call these interfaces to obtain data. Department C applies for authorization from Department B. Department B believes that whitelist verification can be used for the company's products. It obtains SC's program information from Department C and generates whitelist information for it. When SC calls these interfaces, the interface obtains SC program information, generates whitelist data and signature data according to the original method, and there is actually no signature data but the whitelist data is consistent. The verification passes and the interface function is executed.
[0085] Exemplarily, a specific implementation example of signature verification is as follows:
[0086] Company F uses the SE software developed by Company E. The SE software provides a set of interfaces for external calls to obtain the operating data of the SE software. Company F develops the SF software as needed, hoping to call these interfaces to obtain the operating data of the SE software to generate reports. After negotiation, Company E agrees to authorize Company F in the form of signature authorization. Company E uses the string "FFF" as a secret key and uses the secret key distribution tool to convert "FFF" into specific data to generate a secret key file, and then provides the file and the signature module to Company F. After Company F develops the SF software, it uses the signature module and the secret key file in combination with the SF program information obtained by the signature module to generate a signature file. When the SF software calls the interface provided by the SE software, the SE software obtains the SF program information and generates the whitelist data and signature data according to the original method. There is actually no whitelist data but the signature data is consistent, the verification passes, and the interface function is executed.
[0087] In each of the above embodiments, the whitelist information, key data, and signature data can be stored in a file, which is very simple and feasible. Of course, in addition to storing in a file, these data and information can also be written into the software for use. The key data is based on the key to generate special data. The method of using the key data is based on security considerations. It can hide the original key and encryption algorithm, so that the interface provider does not need to directly provide the original key to the caller.
[0088] An embodiment of the present application also provides a software caller verification device, which includes: a receiving module for receiving an authorization request from a caller; a determination module for determining a verification method for the caller based on the authorization request; the verification method includes: whitelist verification, and / or signature verification; an authorization module for generating whitelist information for the caller program when the verification method for the caller is whitelist verification; when the verification method for the caller is signature verification, a secret key is allocated to the caller and a secret key file is generated, and a signature file is generated for the caller program based on the secret key file; the receiving module is also used to receive an interface call request from the caller, and obtain the program information of the caller based on the interface call request; a verification module is used to verify the program information; an interface providing module is used to provide an interface function to the caller when the verification result is passed.
[0089] The device in this embodiment can implement the relevant steps in the above-mentioned various mode embodiments, and its specific implementation process and technical effects are not repeated here.
[0090] It should be noted that those skilled in the art will appreciate that various aspects of the present invention may be implemented as systems, methods or program products. Therefore, various aspects of the present invention may be specifically implemented in the following forms, namely: complete hardware implementation, complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to as "circuit", "module" or "platform" herein.
[0091] In addition, an embodiment of the present application further provides a computer-readable storage medium, in which computer-executable instructions are stored. When at least one processor of a user device executes the computer-executable instructions, the user device executes the above-mentioned various possible methods. Among them, the computer-readable medium includes a computer storage medium and a communication medium, wherein the communication medium includes any medium that facilitates the transmission of a computer program from one place to another. The storage medium can be any available medium that can be accessed by a general-purpose or special-purpose computer. An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an ASIC. In addition, the ASIC can be located in a user device. Of course, the processor and the storage medium can also exist in a communication device as discrete components.
[0092] The present application also provides a program product, which includes a computer program. The computer program is stored in a readable storage medium. At least one processor of the server can read the computer program from the readable storage medium. At least one processor executes the computer program so that the server implements any method of the above-mentioned embodiments of the present invention.
[0093] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.
[0094] The above describes the specific embodiments of the present invention. It should be understood that the present invention is not limited to the above specific embodiments, and those skilled in the art may make various modifications or variations within the scope of the claims, which do not affect the essence of the present invention.
Claims
1. A software caller verification method, characterized in that: include: Receive the authorization request from the caller; Determining a verification method for the caller according to the authorization request; The verification method includes: whitelist verification and / or signature verification; If the verification method for the caller is whitelist verification, generating whitelist information for the caller program; If the verification method for the caller is signature verification, a secret key is allocated to the caller and a secret key file is generated, and a signature file is generated for the caller program according to the secret key file, or the secret key file is sent to the caller so that the caller generates a signature file according to the secret key file; Receive an interface call request from the caller, and obtain program information of the caller; Verifying the program information; If the verification result is passed, the interface function is provided to the caller.
2. The software caller verification method according to claim 1, characterized in that: The generating of whitelist information for the calling program includes: Extracting program information of the caller; According to a preset rule, the extracted program information is converted into first target data; The first target data is written into a first preset file.
3. The software caller verification method according to claim 1, characterized in that: The allocating a secret key to the caller includes: The secret key is associated with the caller and recorded; wherein the secret key associated with the caller is used to generate a secret key file for the caller, and the form of the secret key includes: a character string.
4. The software caller verification method according to claim 1, characterized in that: The generating of the secret key file comprises: Converting the secret key assigned to the caller into preset secret key data; The preset key data is written into the second preset file.
5. The software caller verification method according to claim 4, characterized in that: The step of generating a signature file for the caller program according to the secret key file includes: Extracting program information of the caller; Combining the program information with the preset key data to obtain second target data; The second target data is written into the signature file.
6. The software caller verification method according to claim 1, characterized in that: The verifying of the program information includes any of the following methods: Performing a positive verification on the program information; the positive verification means: obtaining the program information and the secret key used by the caller when signing, regenerating whitelist data or signature data by the same method as used when signing, and verifying the regenerated whitelist data with the preset whitelist data, or verifying the regenerated signature data with the preset signature data; Performing reverse verification on the program information; The reverse verification refers to: restoring the corresponding secret key and program information according to the preset whitelist data or the preset signature data, and verifying the restored secret key and program information with the actual secret key and the actual program information respectively.
7. The software caller verification method according to any one of claims 1 to 6, characterized in that: The method further comprises: If the verification result is failed, a call failure prompt message is fed back to the caller.
8. A software caller verification device, characterized in that: include: A receiving module, used for receiving the authorization request from the caller; A determination module, used to determine a verification method for the caller according to the authorization request; The verification method includes: whitelist verification and / or signature verification; An authorization module, for generating whitelist information for a caller program when the verification method for the caller is whitelist verification; for allocating a secret key to the caller and generating a secret key file when the verification method for the caller is signature verification, and generating a signature file for the caller program according to the secret key file, or sending the secret key file to the caller so that the caller can generate a signature file by itself according to the secret key file; The receiving module is further used to receive the interface calling request of the caller and obtain the program information of the caller; A verification module, used for verifying the program information; The interface providing module is used to provide the interface function to the caller when the verification result is passed.
9. A software caller verification device, characterized in that: include: A processor and a memory, wherein the memory stores executable program instructions, and when the processor calls the program instructions in the memory, the processor is used to: Execute the steps of the software caller verification method described in any one of claims 1 to 7.
10. A computer-readable storage medium for storing a program, characterized in that: When the program is executed, the steps of the software caller verification method described in any one of claims 1 to 7 are implemented.