CN107911344A - A kind of safe docking calculation of cloud platform - Google Patents

A kind of safe docking calculation of cloud platform Download PDF

Info

Publication number
CN107911344A
CN107911344A CN201711038328.2A CN201711038328A CN107911344A CN 107911344 A CN107911344 A CN 107911344A CN 201711038328 A CN201711038328 A CN 201711038328A CN 107911344 A CN107911344 A CN 107911344A
Authority
CN
China
Prior art keywords
cloud platform
safe
tokenid
business
user
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN201711038328.2A
Other languages
Chinese (zh)
Inventor
王超
范渊
黄进
李华生
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
DBAPPSecurity Co Ltd
Original Assignee
DBAPPSecurity Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by DBAPPSecurity Co Ltd filed Critical DBAPPSecurity Co Ltd
Priority to CN201711038328.2A priority Critical patent/CN107911344A/en
Publication of CN107911344A publication Critical patent/CN107911344A/en
Pending legal-status Critical Current

Links

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/08Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0807Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/04Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0435Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/08Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0815Network architectures or network communication protocols for network security for authentication of entities providing single-sign-on or federations
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00Network arrangements or protocols for supporting network services or applications
    • H04L67/01Protocols
    • H04L67/02Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

The present invention relates to a kind of safe docking calculation of cloud platform, cloud platform includes providing the business cloud platform of api interface and passes through the matched safe cloud platform of api interface;Method of the method and safe cloud platform of safe docking calculation including the safe cloud platform of business cloud platform single-sign-on to business cloud platform request data.The present invention by set the safe cloud platform of business cloud platform single-sign-on method and method from safe cloud platform to business cloud platform request data, using business cloud platform user's unique identifier tokenID is provided to safe cloud platform, make to realize single-sign-on between safe cloud platform and business cloud platform, request is required for carrying the tokenID of cryptographic operation every time, ensures that the api interface call operation of safe cloud platform and business cloud platform is normally carried out safely.The present invention effectively solves the API Calls safety problem between business cloud platform and safe cloud platform, tenant's endless number system, favorable expandability by token technologies.

Description

A kind of safe docking calculation of cloud platform
Technical field
It is more particularly to a kind of effectively to solve the present invention relates to the technical field of the transmission of digital information, such as telegraph communication The safe docking calculation of the cloud platform of the safety problem of API Calls between business cloud platform and safe cloud platform.
Background technology
Cloud platform is one of important step that cloud computing is implemented, and it is inner that it allows developers that the program finished writing is placed on " cloud " Operation, or " cloud " inner service provided is provided, or the two is all.
Cloud platform generally comprises safe cloud platform and business cloud platform, wherein, safe cloud platform, that is, client, business cloud is put down Platform, that is, third party's access platform, is server-side.When safe cloud platform and business cloud platform are docked, often business cloud is put down Platform provides api interface and supplies safe cloud platform application virtualization resource, and running environment is provided for safety service, the API of these docking Generally comprise the establishment of virtual machine(The VPC network lists containing acquisition, virtual machine template list, image listing, network card configuration, disk Configuration), delete, the interface such as restart, shut down.
In order to ensure business cloud platform is not invaded, generally require and authentication is done to the user of above-mentioned API, it is traditional Authentication is completed by Cookie.Api interface is generally completed by http protocol, and HTTP is a kind of association without state View, it is who is accessing application that it, which is not aware that, and in order to complete authentication, when user asks to log in, server-side can give birth to Into a record, the ID number of this record, is then sent to client by the user information additionally logged in this record End, client is stored in this ID number in Cookie receiving after, this next user sent again to server-side ask when Time can carry this Cookie, be verified by server-side, if in server-side corresponding record can be found here, illustrate to use Family has already been through authentication, and the data that user asks are returned to client.
However, in the prior art, there are certain technological deficiency, since the security of Cookie is relatively low, malice by Cookie Personnel can analyze the operation be stored in local Cookie and carry out Cookie deceptions, if the peace of API Calls cannot be solved Full problem, business cloud platform will be exposed, at any time can by other calling services, trigger resource be deleted or distort wait seriously The problem of;In addition, since Cookie data is stored on disk, in order to reduce the occupancy of disk, many systems will The data volume of single Cookie is asked at most to preserve 20 Cookie no more than 4K, a user, above-mentioned specification can constrain safety Tenant's quantity in cloud platform, autgmentability are poor.
The content of the invention
In order to solve the problems in the existing technology, the present invention provides a kind of safe docking side of cloud platform of optimization Method, realizes by token technologies and the encrypted purpose of safety is carried out to api interface, it is ensured that secure cloud issues business cloud platform Instruction is legal, ensures the safety of API Calls between business cloud platform and safe cloud platform.
The technical solution adopted in the present invention is a kind of safe docking calculation of cloud platform, and the cloud platform includes safety Cloud platform and business cloud platform, the business cloud platform provide api interface, and the safe cloud platform passes through api interface and business Cloud platform coordinates;The safe docking calculation includes the method for the safe cloud platform of business cloud platform single-sign-on and safe cloud platform To the method for business cloud platform request data.
Preferably, the method for the safe cloud platform of business cloud platform single-sign-on comprises the following steps:
Step 1.1:User's registering service cloud platform;
Step 1.2:Business cloud platform verifies username and password;If being verified, user's unique identifier is generated TokenID, carries out in next step, otherwise, return to step 1.1;
Step 1.3:Solicited message is generated using user's unique identifier tokenID, from business cloud platform single-sign-on to safety Cloud platform;
Step 1.4:User's unique identifier tokenID is by business cloud platform unicast to the success of safe cloud platform, secure cloud Platform allows to be used, single-sign-on success.
Preferably, in the step 1.3, solicited message is using user's unique identifier tokenID as request header.
Preferably, in the step 1.4, user's unique identifier tokenID is transmitted by HTTPS security protocols.
Preferably, the method for the safe cloud platform to business cloud platform request data comprises the following steps:
Step 2.1:Safe cloud platform searches user's unique identifier tokenID;
Step 2.2:Safe cloud platform adds tokenID characters in each HTTP request;
Step 2.3:HTTP request is sent to business cloud platform, business cloud platform verification tokenID by safe cloud platform;
Step 2.4:TokenID is verified, then business cloud platform returns to the corresponding data result of request;Otherwise, return not Authorization message.
Preferably, in the step 2.2, tokenID characters are added in the request header of each HTTP request.
Preferably, user's unique identifier tokenID includes being used for the user information for identifying user identity uniqueness Character.
Preferably, user's unique identifier tokenID further include for identify tokenID generated times and its effectively User's login time information character of phase.
Preferably, the tokenID is the character string of symmetric cryptography.
Preferably, the tokenID is encoded using Base64.
The present invention provides a kind of safe docking calculation of the cloud platform of optimization, and api interface is provided by business cloud platform, Safe cloud platform is coordinated by api interface and business cloud platform, the method for setting the safe cloud platform of business cloud platform single-sign-on Method with from safe cloud platform to business cloud platform request data, by the use of business cloud platform to the secure cloud as API Calls side Platform provides user's unique identifier tokenID so that needs to realize single-point between safe cloud platform and business cloud platform Log in, and each request is required for carrying this user unique identifier tokenID, since operation can be encrypted in tokenID, Thus it can guarantee that the api interface call operation between safe cloud platform and business cloud platform safely, can be carried out normally.The present invention By token technologies, the safety problem of the API Calls between business cloud platform and safe cloud platform is efficiently solved, for renting Amount amount does not limit, favorable expandability.
Brief description of the drawings
Fig. 1 is the method flow diagram of the safe cloud platform of business cloud platform single-sign-on of the present invention;
Fig. 2 is the method flow diagram of safe cloud platform of the invention to business cloud platform request data.
Embodiment
The present invention is described in further detail with reference to embodiment, but protection scope of the present invention is not limited to This.
The present invention relates to a kind of safe docking calculation of cloud platform, the cloud platform includes safe cloud platform and business cloud is put down Platform, the business cloud platform provide api interface, and the safe cloud platform is coordinated by api interface and business cloud platform;The peace Full docking calculation includes the method for the safe cloud platform of business cloud platform single-sign-on and safe cloud platform is asked to business cloud platform The method of data.
In the present invention, safe cloud platform access service cloud platform, using the service of its virtualization resource, safe cloud platform will The api interface request data of business cloud platform is frequently called, for the safety for reducing service end pressure, ensuring data, and will Confirm the identity of safe cloud platform, business cloud platform can issue user's unique identifier tokenID to safe cloud platform and make For token, and the tokenID should be unique in the world, this and the relevant tokenID of user are whole docking sides The key of method.
In the present invention, safe docking calculation includes two submethods:The side of the safe cloud platform of business cloud platform single-sign-on The method of method and safe cloud platform to business cloud platform request data.The method of the safe cloud platform of business cloud platform single-sign-on is Referring to needs to realize single-sign-on between safe cloud platform and business cloud platform, and user's registering service cloud platform will generate a use The relevant unique tokenID in family, when from business cloud platform single-sign-on to safe cloud platform, tokenID will It is issued to safe cloud platform;The method of safe cloud platform to business cloud platform request data refers to that safe cloud platform is being called During API, it is necessary to carry vouchers of the foregoing tokenID as certification.
The method of the safe cloud platform of business cloud platform single-sign-on comprises the following steps.
Step 1.1:User's registering service cloud platform.
Step 1.2:Business cloud platform verifies username and password;If being verified, user's unique identifier is generated TokenID, carries out in next step, otherwise, return to step 1.1.
Step 1.3:Using user's unique identifier tokenID generate solicited message, from business cloud platform single-sign-on to Safe cloud platform.
In the step 1.3, solicited message is using user's unique identifier tokenID as request header.
Step 1.4:User's unique identifier tokenID is by business cloud platform unicast to the success of safe cloud platform, peace Full cloud platform allows to be used, single-sign-on success.
In the step 1.4, user's unique identifier tokenID is transmitted by HTTPS security protocols.
In the present invention, HTTPS security protocols are that transmission, identity is encrypted by what HTTP and ssl protocol were built jointly The procotol of certification, relative to http protocol, HTTPS security protocols are safer.
The method of the safe cloud platform to business cloud platform request data comprises the following steps.
Step 2.1:Safe cloud platform searches user's unique identifier tokenID.
Step 2.2:Safe cloud platform adds tokenID characters in each HTTP request.
In the step 2.2, tokenID characters are added in the request header of each HTTP request.
Step 2.3:HTTP request is sent to business cloud platform, business cloud platform verification tokenID by safe cloud platform.
Step 2.4:TokenID is verified, then business cloud platform returns to the corresponding data result of request;Otherwise, return Return unauthorized information.
In the present invention, unauthorized information is generally " 401 Unauthorized ".
User's unique identifier tokenID includes being used for the user information character for identifying user identity uniqueness.
User's unique identifier tokenID further includes the use for identifying tokenID generated times and its term of validity Family login time information character.
The tokenID is the character string of symmetric cryptography.
The tokenID is encoded using Base64.
In the present invention, tokenID is generated, it is necessary to ensure singularity, security and guarantor based on token technologies under normal circumstances Close property.
In the present invention, in order to ensure the security of API docking, since each steps of the tokenID making will ensure to pacify Entirely, the generation of tokenID represents user and authorizes this operation, and business cloud platform is put down by issuing tokenID to secure cloud Platform mandate obtains the qualification of user's protected data, and therefore will not reveal the logging on authentication information of user.
In the present invention, tokenID should be nontransparent for safe cloud platform, and safe cloud platform should only be known This is a character string, and the locked resource of user can be obtained with it, should nothing for the information contained by character string inside From knowing, can not go to decrypt information therein by other methods.
In the present invention, the confidentiality based on tokenID, it should be the character string that a kind of symmetric cryptography obtains, and use Base64 is encoded, and only authorization server holds symmetric key, for the tokenID of generation to be encrypted and verified.
In the present invention, in order to ensure security, tokenID will also ensure to leak in transmitting procedure, not be decrypted. The tokenID of BEARER types is a kind of token types defined in RFC6750, and RFC6749 is to it for OAuth2.0 agreements Mentioned by having, at last to a supplement of RFC6749.The tokenID of BEARER types is built upon on HTTP/1.1 versions Token types, it is necessary to TLS(Transport Layer Security)There is provided safety to support, which mainly defines The detail of client request and the server-side verification of BEARER types tokenID.So either business cloud platform single-point Sign in security platform or security platform request API, be all based on HTTPS, use RSA rivest, shamir, adelmans, it is ensured that Transmit the security of data.The bi-directional of tokenID is added in the header information of request, without being directly exposed to In URL.
In the present invention, a kind of embodiment is provided, i.e. the generation of tokenID relies on the user informations such as user name, obtains one Character string sequence, is carried to business cloud platform when follow-up API Calls using this character string as parameter, equivalent to can know Other user, i.e. user's unique identifier tokenID include being used for the user information character for identifying user identity uniqueness.
In the present invention, further, user's unique identifier tokenID is further included for identifying tokenID generated times And its user's login time information character of the term of validity, the complexity higher of guarantee user's unique identifier tokenID.
In the present invention, since each business cloud platform can voluntarily be set for encrypted operation according to the demand of technical staff Put and externally maintain secrecy, therefore those skilled in the art voluntarily can select cryptographic means to be encrypted accordingly.
The present invention provides api interface by business cloud platform, and safe cloud platform is matched somebody with somebody by api interface and business cloud platform Close, set the safe cloud platform of business cloud platform single-sign-on method and safe cloud platform to the side of business cloud platform request data Method, provides a user unique identifier tokenID by the use of business cloud platform to the safe cloud platform as API Calls side, makes Need to realize single-sign-on between safe cloud platform and business cloud platform, and each request be required for carrying this user it is unique Identifier tokenID, since operation can be encrypted in tokenID, thus can guarantee that between safe cloud platform and business cloud platform Api interface call operation can safely, normally carry out.The present invention by token technologies, efficiently solve business cloud platform with The safety problem of API Calls between safe cloud platform, does not limit, favorable expandability for tenant's quantity.

Claims (10)

1. a kind of safe docking calculation of cloud platform, the cloud platform includes safe cloud platform and business cloud platform, its feature exists In:The business cloud platform provides api interface, and the safe cloud platform is coordinated by api interface and business cloud platform;The peace Full docking calculation includes the method for the safe cloud platform of business cloud platform single-sign-on and safe cloud platform is asked to business cloud platform The method of data.
A kind of 2. safe docking calculation of cloud platform according to claim 1, it is characterised in that:The business cloud platform list The method that point logs in safe cloud platform comprises the following steps:
Step 1.1:User's registering service cloud platform;
Step 1.2:Business cloud platform verifies username and password;If being verified, user's unique identifier is generated TokenID, carries out in next step, otherwise, return to step 1.1;
Step 1.3:Solicited message is generated using user's unique identifier tokenID, from business cloud platform single-sign-on to safety Cloud platform;
Step 1.4:User's unique identifier tokenID is by business cloud platform unicast to the success of safe cloud platform, secure cloud Platform allows to be used, single-sign-on success.
A kind of 3. safe docking calculation of cloud platform according to claim 2, it is characterised in that:, please in the step 1.3 Information is sought using user's unique identifier tokenID as request header.
A kind of 4. safe docking calculation of cloud platform according to claim 2, it is characterised in that:In the step 1.4, use Family unique identifier tokenID is transmitted by HTTPS security protocols.
A kind of 5. safe docking calculation of cloud platform according to claim 1, it is characterised in that:The safe cloud platform to The method of business cloud platform request data comprises the following steps:
Step 2.1:Safe cloud platform searches user's unique identifier tokenID;
Step 2.2:Safe cloud platform adds tokenID characters in each HTTP request;
Step 2.3:HTTP request is sent to business cloud platform, business cloud platform verification tokenID by safe cloud platform;
Step 2.4:TokenID is verified, then business cloud platform returns to the corresponding data result of request;Otherwise, return not Authorization message.
A kind of 6. safe docking calculation of cloud platform according to claim 1, it is characterised in that:In the step 2.2, TokenID characters are added in the request header of each HTTP request.
A kind of 7. safe docking calculation of cloud platform according to claim 2 or 5, it is characterised in that:The user is unique Identifier tokenID includes being used for the user information character for identifying user identity uniqueness.
A kind of 8. safe docking calculation of cloud platform according to claim 7, it is characterised in that:User's unique mark Symbol tokenID further includes user's login time information character for identifying tokenID generated times and its term of validity.
A kind of 9. safe docking calculation of cloud platform according to claim 2 or 5, it is characterised in that:The tokenID is The character string of symmetric cryptography.
A kind of 10. safe docking calculation of cloud platform according to claim 2 or 5, it is characterised in that:The tokenID Encoded using Base64.
CN201711038328.2A 2017-10-28 2017-10-28 A kind of safe docking calculation of cloud platform Pending CN107911344A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201711038328.2A CN107911344A (en) 2017-10-28 2017-10-28 A kind of safe docking calculation of cloud platform

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201711038328.2A CN107911344A (en) 2017-10-28 2017-10-28 A kind of safe docking calculation of cloud platform

Publications (1)

Publication Number Publication Date
CN107911344A true CN107911344A (en) 2018-04-13

Family

ID=61842378

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201711038328.2A Pending CN107911344A (en) 2017-10-28 2017-10-28 A kind of safe docking calculation of cloud platform

Country Status (1)

Country Link
CN (1) CN107911344A (en)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109391689A (en) * 2018-10-08 2019-02-26 郑州云海信息技术有限公司 A kind of method and device that micro services application programming interface is called
CN110581897A (en) * 2019-09-30 2019-12-17 山东浪潮通软信息科技有限公司 Method for realizing data interaction between two systems under unidirectional network environment
CN111556047A (en) * 2020-04-24 2020-08-18 杭州安恒信息技术股份有限公司 Deployment method of security service in private cloud environment
CN113127109A (en) * 2021-05-12 2021-07-16 平安信托有限责任公司 Interface calling method and device, electronic equipment and readable storage medium

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101202753A (en) * 2007-11-29 2008-06-18 中国电信股份有限公司 Method and device for accessing plug-in connector applied system by client terminal
CN103747076A (en) * 2013-12-31 2014-04-23 曙光云计算技术有限公司 Cloud platform access method and device
CN103795712A (en) * 2014-01-17 2014-05-14 歌尔声学股份有限公司 Method and device for authentication during Web Service calling
CN106302346A (en) * 2015-05-27 2017-01-04 阿里巴巴集团控股有限公司 The safety certifying method of API Calls, device, system
US20170140146A1 (en) * 2015-11-13 2017-05-18 Microsoft Technology Licensing, Llc Unlock and recovery for encrypted devices

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101202753A (en) * 2007-11-29 2008-06-18 中国电信股份有限公司 Method and device for accessing plug-in connector applied system by client terminal
CN103747076A (en) * 2013-12-31 2014-04-23 曙光云计算技术有限公司 Cloud platform access method and device
CN103795712A (en) * 2014-01-17 2014-05-14 歌尔声学股份有限公司 Method and device for authentication during Web Service calling
CN106302346A (en) * 2015-05-27 2017-01-04 阿里巴巴集团控股有限公司 The safety certifying method of API Calls, device, system
US20170140146A1 (en) * 2015-11-13 2017-05-18 Microsoft Technology Licensing, Llc Unlock and recovery for encrypted devices

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109391689A (en) * 2018-10-08 2019-02-26 郑州云海信息技术有限公司 A kind of method and device that micro services application programming interface is called
CN110581897A (en) * 2019-09-30 2019-12-17 山东浪潮通软信息科技有限公司 Method for realizing data interaction between two systems under unidirectional network environment
CN111556047A (en) * 2020-04-24 2020-08-18 杭州安恒信息技术股份有限公司 Deployment method of security service in private cloud environment
CN113127109A (en) * 2021-05-12 2021-07-16 平安信托有限责任公司 Interface calling method and device, electronic equipment and readable storage medium

Similar Documents

Publication Publication Date Title
US10880732B2 (en) Authentication of phone caller identity
EP3424195B1 (en) Encrypted password transport across untrusted cloud network
US9137223B2 (en) Apparatus and method for transmitting data, and recording medium storing program for executing method of the same in computer
US8925046B2 (en) Device, method, and recording medium
CN104113534B (en) The login system and method for application APP
US8745394B1 (en) Methods and systems for secure electronic communication
US9825917B2 (en) System and method of dynamic issuance of privacy preserving credentials
US10356079B2 (en) System and method for a single sign on connection in a zero-knowledge vault architecture
US20130061298A1 (en) Authenticating session passwords
US20080155267A1 (en) Identity management system with an untrusted identity provider
CN105072125B (en) A kind of http communication system and method
CN107251035A (en) Account recovers agreement
US20180062863A1 (en) Method and system for facilitating authentication
CN107026824A (en) A kind of message encryption, decryption method and device
CN107911344A (en) A kind of safe docking calculation of cloud platform
CN105516157A (en) Independent encryption based network information safe input system and method
CN105827395A (en) Network user authentication method
CN105897746A (en) Cross-website login method, terminal and website server
CN109740319A (en) Digital identity verification method and server
CN106357669B (en) A kind of Web system login method and log in auxiliary system
CN110022207A (en) Key management and the method and apparatus for handling data
CN113545004A (en) Authentication system with reduced attack surface
JP2023532976A (en) Method and system for verification of user identity
EP3511852B1 (en) Method for providing an enhanced level of authentication related to a secure software client application that is provided, by an application distribution entity, in order to be transmitted to a client computing device; system, software client application instance or client computing device, third party server entity, and program and computer program product
CN114503105A (en) Password service for browser applications

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
RJ01 Rejection of invention patent application after publication
RJ01 Rejection of invention patent application after publication

Application publication date: 20180413