WO2016008349A1 - 一种获取本地信息的方法、装置及系统 - Google Patents

一种获取本地信息的方法、装置及系统 Download PDF

Info

Publication number
WO2016008349A1
WO2016008349A1 PCT/CN2015/081678 CN2015081678W WO2016008349A1 WO 2016008349 A1 WO2016008349 A1 WO 2016008349A1 CN 2015081678 W CN2015081678 W CN 2015081678W WO 2016008349 A1 WO2016008349 A1 WO 2016008349A1
Authority
WO
WIPO (PCT)
Prior art keywords
acquisition request
information acquisition
information
local
random number
Prior art date
Application number
PCT/CN2015/081678
Other languages
English (en)
French (fr)
Inventor
蒋春华
Original Assignee
阿里巴巴集团控股有限公司
蒋春华
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴集团控股有限公司, 蒋春华 filed Critical 阿里巴巴集团控股有限公司
Priority to US15/325,588 priority Critical patent/US11240210B2/en
Priority to JP2017501640A priority patent/JP6527576B2/ja
Priority to EP15822323.0A priority patent/EP3171543B1/en
Priority to KR1020177004240A priority patent/KR102121399B1/ko
Publication of WO2016008349A1 publication Critical patent/WO2016008349A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/34—Network arrangements or protocols for supporting network services or applications involving the movement of software or configuration parameters 
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/95—Retrieval from the web
    • G06F16/957—Browsing optimisation, e.g. caching or content distillation
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/382—Payment protocols; Details thereof insuring higher security of transaction
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401—Transaction verification
    • G06Q20/4015—Transaction verification using location information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/02—Standardisation; Integration
    • H04L41/0246—Exchanging or transporting network management information using the Internet; Embedding network management web servers in network elements; Web-services-based protocols
    • H04L41/0253—Exchanging or transporting network management information using the Internet; Embedding network management web servers in network elements; Web-services-based protocols using browsers or web-pages for accessing management information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0869—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving random numbers or seeds
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates

Definitions

  • the present application relates to the field of computer technologies, and in particular, to a method, device, and system for acquiring local information.
  • a web application is an application in which a user interface resides in a browser, such as an online web application such as online banking or online payment.
  • the network device When using certain web applications, the network device needs to obtain local information of the terminal. For example, when a user implements an online banking or online payment related operation through a terminal, in order to ensure information security, the network device needs to obtain local information of the terminal to complete the entire operation process. For example, in the process of logging in to the Alipay page, the terminal can obtain the local information of the terminal itself and submit it to the network device through a script in the browser.
  • the local information may be a verification result or the like of a local digital certificate for confirming the reliability of the terminal.
  • the browser cannot directly obtain the local information of the terminal it is in. Therefore, in the prior art, local information is generally acquired through a browser plug-in technology.
  • the user needs to pre-install a plug-in for verifying the digital certificate locally at the prompt of the browser. Then, the terminal directly calls the plug-in through a script in the browser, and obtains a verification result of the digital certificate through the plug-in, and finally submits the verification result to the network device.
  • the embodiment of the present invention provides a method and a device for acquiring local information, which are used to solve the problem that the browser is unstable due to the local information obtained by the browser plug-in technology, and the problem that the website is difficult to maintain.
  • the method for obtaining local information includes:
  • a first information acquisition request sending module configured to send a first information obtaining request to the network device by using a script in the browser, where the first information obtaining request is used to instruct the local application tool to obtain the local information
  • a random number monitoring module configured to monitor, by the local application tool, a random number corresponding to the first information acquisition request returned by the network device;
  • a first information acquisition request acquisition module configured to acquire, by using the local application tool, a first information acquisition request corresponding to the random number saved in the network device, where the random number and the first information acquisition request are Corresponding relationship is established and saved by the network device;
  • a local information obtaining module configured to acquire local information corresponding to the first information obtaining request by using the local application tool
  • a local information sending module configured to send the local information to the network device by using the local application tool.
  • the first information acquisition request receiving module is configured to receive a first information acquisition request sent by the terminal by using a script in the browser, where the first information acquisition request is used to instruct the local application tool of the terminal to obtain local information;
  • a random number determining module configured to determine a random number corresponding to the first information obtaining request
  • a random number sending module configured to return the random number to the terminal
  • a storage module configured to save a random number corresponding to the first information obtaining request
  • a second information acquisition request receiving module configured to receive a second information acquisition request sent by the terminal by using the local application tool
  • a first information acquisition request sending module configured to return, to the terminal, a first information acquisition request corresponding to the random number carried in the second information acquisition request;
  • the local information receiving module is configured to receive local information that is obtained by the terminal by using the local application tool and corresponding to the received first information acquiring request.
  • a terminal configured to send, by using a script in a browser, a first information acquisition request to the network device, where the first information acquisition request is used to instruct the local application tool to obtain local information, and the local application tool is used to monitor the returned by the network device.
  • Acquiring a random number corresponding to the first information acquisition request acquiring, by the local application tool, a first information acquisition request corresponding to the random number saved in the network device; and acquiring, by the local application tool, the first information acquisition request Acquiring local information corresponding to the request, and sending the local information to the network device;
  • a network device configured to receive a first information acquisition request sent by the terminal, determine and save a random number corresponding to the first information acquisition request, return the random number to the terminal, and receive the terminal by using the local application tool Sending a second information acquisition request; returning, to the terminal, a first information acquisition request corresponding to the random number carried in the second information acquisition request; and receiving local information sent by the terminal.
  • the local application tool of the terminal monitors the random number corresponding to the first information acquisition request received by the network device, and obtains the first information acquisition request corresponding to the random number saved by the network device, and acquires the first The local information corresponding to the information acquisition request, and the local information is submitted to the network device for use by other devices. Since there is no need for any interface for information interaction between the local application and the browser, there is no compatibility issue between the browser and the local application tool, which can effectively avoid compatibility when obtaining local information through the browser plug-in technology. Sexuality causes browser instability, which can also effectively reduce the difficulty of website maintenance.
  • FIG. 1 is a schematic flowchart of a method for obtaining local information according to an embodiment of the present application
  • FIG. 2 is a second schematic flowchart of a method for obtaining local information according to an embodiment of the present application
  • FIG. 3 is a third schematic flowchart of a method for obtaining local information according to an embodiment of the present disclosure
  • FIG. 4 is a schematic structural diagram of an apparatus for acquiring local information according to an embodiment of the present application.
  • FIG. 5 is a second structural schematic diagram of an apparatus for acquiring local information according to an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of a system for acquiring local information according to an embodiment of the present application.
  • the browser of the terminal cannot directly obtain the local information of the terminal where the terminal is located, and if the browser directly calls the plug-in to obtain local information, the browser and the plug-in are required to have high compatibility. Therefore, on the premise that the browser does not directly obtain the local information, the application terminal sends a request for acquiring local information to the network device through a script in the browser, and obtains the acquisition request from the network device through the local application tool. Then, the local information is obtained according to the obtaining request, and finally the local information is provided to the network device.
  • the browser does not directly obtain local information, ensures information security, and does not directly interact with the local application tool, and does not need to be compatible with the local application tool, thereby effectively preventing the browser from being incompatible with the plug-in and causing the browser to be unstable.
  • the problem can also effectively avoid the difficulty of maintaining the website.
  • a method for obtaining local information includes:
  • the terminal sends a first information acquisition request to the network device by using a script in the browser, where the first information acquisition request is used to instruct the local application tool to obtain the local information.
  • the script described in the embodiment of the present application is a script that the browser can parse and execute.
  • the script includes but is not limited to a JavaScript script, which is referred to as a JS script.
  • the local information described in this application includes, but is not limited to, the verification result of the digital certificate of the local user, the local device identification information, and the system application interface information (for example, the system application ( Application, App) interface information, local file system information, etc.
  • the server ie, the network device
  • the terminal ie, the network device
  • the result is local information
  • the local application tool may be an executable program capable of verifying a local digital certificate and providing a verification result.
  • the executable program may be stored in a storage medium of the terminal itself (for example, a hard disk of the terminal) or in an external storage medium (for example, a mobile hard disk connected to the terminal) connected to the terminal.
  • the step of the terminal sending the first information acquisition request to the network device by using the script in the browser may be triggered by the step of the terminal sending a service request to the network device.
  • it may also be sent simultaneously with the service request (for example, the first information acquisition request and the service request are integrated into one request message and sent to the network device).
  • the terminal needs to send a login request to the server of the payment application through a browser (the login request is a service request), so that the browser triggers The step of sending a first information acquisition request to the server through the JS script.
  • the first information obtaining request is used to indicate that the local application tool of the terminal acquires the verification result of the local digital certificate of the terminal.
  • the JS script may be returned to the browser and installed in the browser when the server receives the login request. Of course, it can also be pre-configured in the browser.
  • the terminal monitors, by using the local application tool, a random number corresponding to the first information acquisition request returned by the network device.
  • the random number in the embodiment of the present application is a plain number of the plaintext, that is, the random number is a non-encrypted random number, so that the local application tool can directly read the random number after listening to the random number.
  • the network device may generate a random number as the random number corresponding to the first information acquisition request, and return it to the terminal.
  • the terminal receives the random number
  • the local application tool in the terminal can listen to the random number returned by the network device.
  • the network device itself also needs to save the generated correspondence between the random number and the first information acquisition request.
  • the terminal and the network device exchange information based on Hypertext Transfer Protocol Secure HTTPs (HTTPS), wherein the HTTPS protocol is Hypertext Transfer Protocol (HTTP) and A combination of the Secure Sockets Layer (SSL) protocol, that is, each time the terminal sends a message acquisition request to the network device through the JS script in the browser, the terminal performs a secure connection process with the network device based on the SSL protocol. After the secure connection process is completed, the network device receives the information acquisition request based on the secure channel established by the secure connection process.
  • HTTPS Hypertext Transfer Protocol Secure HTTPs
  • SSL Secure Sockets Layer
  • the terminal and the network device respectively generate a random number and provide it to the other party, and the random number exchanged between the terminal and the network device in the secure connection process is a random number of plaintext. Therefore, in the embodiment of the present application, after receiving the first information acquisition request sent by the terminal through the JS script in the browser, the network device does not need to generate a random number and return it specifically for the first information acquisition request, and can directly use the network device.
  • the random number generated by the network device itself during the secure connection process is established, and the corresponding relationship between the random number and the subsequently received first information acquisition request is established and saved.
  • the local application tool of the terminal Since the network device has already returned the random number to the terminal during the secure connection process, the local application tool of the terminal has also monitored the random number, and therefore, the network device establishes and stores the random generated during the secure connection process. After the corresponding relationship between the number and the subsequent received first information acquisition request, the random number is not required to be returned to the terminal again, so as to avoid the problem that the network device repeatedly generates and returns a random number and wastes resources. After the local application tool in the terminal monitors the random number in the secure connection process, the second information acquisition request carrying the random number is periodically sent to the network device to obtain the first information corresponding to the random number. request.
  • the local application tool in the terminal monitors the secure connection process and the network device When the random number is returned, it can be monitored by means of information filtering and copying to avoid affecting the key negotiation process.
  • the local application tool may perform the interaction information between the terminal and the network device at the driver layer by setting the SSL protocol of the driver layer in advance. Filtering, reading the random number returned by the network device during the key negotiation process between the terminal and the network device, thereby quickly and efficiently obtaining the random number returned by the network device.
  • the random number monitored by the terminal by the local application tool uniquely corresponds to the first information acquisition request, that is, the random number of the network device returned to the terminal is required to be unique, so as to prevent the terminal from being provided to the network device.
  • the local information is not accurate.
  • the present application can ensure that the random number generated each time is unique by setting a random number generation algorithm used by the network device for the SSL protocol key negotiation process.
  • the SSL session cache instruction and the connection keepalive instruction may be closed after the terminal sends the first information acquisition request to the network device through the script in the browser, to avoid being saved in the session cache.
  • the random number is repeatedly used by the network device during the secure connection with the terminal, thereby ensuring that the random number returned by the network device to the terminal is unique.
  • the terminal acquires, by using the local application tool, a first information acquiring request corresponding to the random number stored in the network device, where a correspondence between the random number and the first information acquiring request is The network device is created and saved.
  • the terminal may actively obtain the first information acquisition request corresponding to the random number stored in the network device, or may passively acquire the first information acquisition request corresponding to the random number sent by the network device.
  • the terminal may send a second information acquisition request carrying the monitored random number to the network device by using the local application tool, and the network device returns the random number carried in the second information acquisition request to the terminal and the The first information acquisition request corresponding to the random number.
  • the terminal can passively receive the response message carrying the first information acquisition request and the random number provided by the network device by using the local application tool, and after receiving the response message, the local application tool can verify the random number carried in the response message and itself. Whether the monitored random numbers are consistent. If they are consistent, the local information may be obtained through the subsequent step S104. If the information is inconsistent, the response information may be discarded.
  • the terminal acquires local information corresponding to the first information acquisition request by using the local application tool, and sends the local information to the network device.
  • the first information acquisition request is an acquisition request for obtaining a verification result of the local digital certificate.
  • the local application tool may verify the local digital certificate according to the first information acquisition request, and then send the verification result of the local digital certificate to the network device.
  • the step of the terminal sending the first information acquisition request is triggered when the terminal sends a login request to the network device to log in to the page of the payment application.
  • the login request sent by the terminal may be processed correspondingly, that is, if the verification result is that the verification is successful, the login request of the terminal is allowed, and the terminal is allowed to log in to the interface of the payment application. If the verification result is that the verification fails, the terminal is rejected. Login request.
  • the terminal does not directly obtain the local information through the script in the browser, but obtains the local information through the local application tool, thereby ensuring the security of the information interaction under the HTTPS protocol.
  • the browser does not directly invoke the local application tool to obtain the local information, but sends a first information acquisition request to the network device through the script, and the local application tool obtains the first information acquisition request from the network device, and according to the The first information acquisition request acquires local information. Therefore, the local application tool does not need to provide any browser-compatible interface, and there is no compatibility problem between the two, so that the browser does not directly call the plug-in process, and the browser and the plug-in do not. Compatible problems that cause browser instability can further avoid the difficulty of maintaining website maintenance in order to ensure compatibility between different types of browsers or different versions of browsers and native application tools.
  • the network device provides the first information acquisition request to the local application tool of the terminal.
  • the network device provides the first information acquisition request to the terminal.
  • the first information acquisition request may be encrypted, and the encrypted first information acquisition request is provided to the local application tool of the terminal.
  • the network device receives the second information acquisition request sent by the local application tool of the terminal.
  • the first information acquisition request corresponding to the random number carried in the second information acquisition request may be encrypted, and then the encrypted first information acquisition request is returned to the local application tool of the terminal.
  • the local application tool of the terminal may perform decryption processing on the first information acquisition request, and then obtain local information according to the decrypted first information acquisition request. Send local information to the network device.
  • another method for obtaining local information includes:
  • the network device receives a first information acquisition request sent by the terminal by using a script in the browser, where the first information acquisition request is used to instruct the local application tool of the terminal to obtain local information.
  • the network device determines and saves a random number corresponding to the first information acquisition request.
  • the network device may generate a random number corresponding to the first information acquisition request, and save a correspondence between the first information acquisition request and the random number, or directly use the The random number generated in the process of performing the secure connection with the terminal before the first information acquisition request is received, and the random number is determined as the random number corresponding to the first information acquisition request, and details are not described herein again.
  • the local application tool of the terminal can listen to the random number, and send a second information acquisition request for acquiring the first information acquisition request to the network device.
  • step 203 may be omitted, that is, the network device has already used the random number in the secure connection process. It is sent to the terminal, so the network device does not need to send the random number again after receiving the first information acquisition request.
  • the network device receives a second information acquisition request sent by the terminal by using the local application tool, where the second information acquisition request carries a random number monitored by the local application tool.
  • the network device returns, to the terminal, a first information acquisition request corresponding to the random number carried in the second information acquisition request.
  • the process is a process in which the terminal actively obtains the first information acquisition request from the network device.
  • the terminal may periodically send the second information acquisition request carrying the random number to the network device by using the local application tool, and the network device may find, by each time the second information acquisition request is received, whether the second information is saved by the network device.
  • the first information acquisition request corresponding to the random number carried in the request is obtained, and if found, the first information acquisition request is directly returned, and if not found, the second information acquisition request may be directly discarded.
  • the network device can directly return the response message carrying the random number and the first information acquisition request to the terminal after performing the step S203, and the terminal passively receives the response message sent by the network device, and details are not described herein again.
  • the network device receives local information that is obtained by the terminal by using the local application tool and that is corresponding to the received first information acquisition request.
  • the terminal can obtain the local information according to the first information acquisition request by the local application tool, and send the local information to the network device.
  • the network device may include a gateway and a server, and the step of generating a random number may be performed by the gateway, and the correspondence between the establishment of the random number and the first information acquisition request may be The gateway is executed by the server, and the correspondence between the random number and the first information acquisition request is saved in the server for the local application tool of the terminal to obtain.
  • the server may further include a service server and a secure channel server, and the correspondence between the random number and the first information acquisition request may be saved by the secure channel server to ensure the security of the first information acquisition request.
  • the following takes the network device including the gateway, the secure channel server, and the service server as an example to describe in detail the process of logging in the page of the payment application.
  • the method for obtaining local information includes the following steps:
  • Step a1 The terminal sends a login request to the service server through the browser.
  • Step a2 The service server returns a script to the terminal.
  • the script may be a JS script.
  • step a3 the terminal installs the received script in the browser, and sends a first information acquisition request to the gateway through a script installed in the browser.
  • the terminal can generate the first information acquisition request and send it to the gateway by executing a script installed in the browser.
  • Step a4 The gateway initiates a secure connection to the terminal, and sends a random number generated during the secure connection process to the terminal.
  • Step a5 The gateway establishes a correspondence between the random number and the received first information acquisition request, and transparently transmits the random number, the first information acquisition request, and the corresponding relationship to the secure channel server for storage.
  • step a6 the terminal listens to the random number received by the terminal from the gateway through the local application tool.
  • step a7 the terminal sends a second information acquisition request carrying the random number it listens to to the secure channel server through the local application tool.
  • Step a8 The secure channel server queries the first information acquisition request corresponding to the random number carried in the second information acquisition request, and returns the first information acquisition request that is queried to the terminal.
  • Step a9 The terminal verifies the local digital certificate by using a local application tool according to the received first information acquisition request, and returns the verification result to the secure channel server.
  • step a10 the secure channel server saves the verification result for the service server to query.
  • the login request sent by the terminal may be processed according to the verification result, that is, if the verification result is successful, the terminal is allowed to log in.
  • the request allows the terminal to log in to the interface of the payment application, and if the verification result is that the verification fails, the terminal's login request is rejected.
  • the embodiment of the present application further provides an apparatus and system for acquiring local information, as shown in FIG. 4, FIG. 5, and FIG.
  • an apparatus for obtaining local information includes:
  • the first information acquisition request sending module 11 is configured to send a first information acquisition request to the network device by using a script in the browser, where the first information acquisition request is used to instruct the local application tool to obtain the local information;
  • the random number monitoring module 12 is configured to monitor, by the local application tool, a random number corresponding to the first information acquisition request returned by the network device;
  • the first information acquisition request obtaining module 13 is configured to acquire, by using the local application tool, a first information acquisition request corresponding to the random number stored in the network device, where the random number and the first information are obtained.
  • the corresponding relationship of the request is established and saved by the network device;
  • the local information obtaining module 14 is configured to acquire local information corresponding to the first information obtaining request by using the local application tool;
  • the local information sending module 15 is configured to send the local information to the network device by using the local application tool.
  • the random number monitoring module 12, the first information acquisition request obtaining module 13, the local information obtaining module 14, and the local information sending module 15 in the embodiment of the present application may be disposed in the local application tool.
  • the apparatus shown in FIG. 4 further includes: a decryption module 16 configured to: before the local information acquisition module acquires local information corresponding to the first information acquisition request by using the local application tool, The first information acquisition request acquired by the information acquisition request acquisition module performs decryption processing.
  • the script may be, but not limited to, a JavaScript script.
  • another apparatus for obtaining local information includes:
  • the first information acquisition request receiving module 21 is configured to receive a first information acquisition request sent by the terminal by using a script in the browser, where the first information acquisition request is used to instruct the local application tool of the terminal to acquire local information;
  • the random number determining module 22 is configured to determine a random number corresponding to the first information obtaining request
  • a random number sending module 23 configured to return the random number to the terminal
  • the storage module 24 is configured to save the random number corresponding to the first information obtaining request determined by the random number determining module 22, that is, the first information obtaining request, the random number, and the correspondence between the first information acquiring request and the random number;
  • the second information acquisition request receiving module 25 is configured to receive a second information acquisition request sent by the terminal by using the local application tool;
  • the first information acquisition request sending module 26 is configured to return, to the terminal, a first information acquisition request corresponding to the random number carried in the second information acquisition request;
  • the local information receiving module 27 is configured to receive local information that is obtained by the terminal by using the local application tool and corresponding to the received first information acquiring request.
  • the storage module 24 is further configured to store local information received by the local information receiving module 27.
  • the second information acquisition request receiving module 25, the first information acquisition request sending module 26 and the local information receiving module 27 are disposed in the secure channel server.
  • the apparatus shown in FIG. 5 further includes: an encryption module 28, configured to return the second information acquisition request to the terminal at the first information acquisition request sending module 26
  • the first information acquisition request corresponding to the random number carried in the second information acquisition request is subjected to encryption processing before the first information acquisition request corresponding to the random number carried in the second information acquisition request.
  • a system for obtaining local information includes:
  • the terminal 100 is configured to send a first information acquisition request to the network device by using a script in the browser 101, where the first information acquisition request is used to instruct the local application tool to acquire local information, and the local application tool 102 listens to the network.
  • the first information acquires local information corresponding to the request, and sends the local information to the network device;
  • the network device 200 is configured to receive the first information acquisition request, generate a random number, and The random number is sent to the terminal; the process can be performed by the gateway 201 in the network device 200.
  • the method further includes: establishing and storing a correspondence between the random number and the first information acquisition request; receiving a second information acquisition request sent by the terminal by using the local application tool; and returning, to the terminal, the second information acquisition request a first information acquisition request corresponding to the random number; and receiving local information returned by the terminal.
  • This process can be performed by the secure channel server 202 connected to the gateway 201.
  • the browser of the terminal cannot directly obtain the local information of the terminal where the terminal is located, and if the browser directly calls the plug-in to obtain local information, the browser and the plug-in are required to be higher. Compatibility. Therefore, on the premise that the browser does not directly obtain the local information, the application terminal sends a request for acquiring local information to the network device through a script in the browser, and obtains the acquisition request from the network device through the local application tool. Then, the local information is obtained according to the obtaining request, and finally the local information is provided to the network device.
  • the browser does not directly obtain local information, ensures information security, and does not directly interact with the local application tool, and does not need to be compatible with the local application tool, thereby effectively preventing the browser from being incompatible with the plug-in and causing the browser to be unstable.
  • the problem can also effectively reduce the difficulty of website maintenance.
  • embodiments of the present application can be provided as a method, system, or computer program product.
  • the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment in combination of software and hardware.
  • the application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.

Landscapes

  • Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • Computer Security & Cryptography (AREA)
  • Accounting & Taxation (AREA)
  • Theoretical Computer Science (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Finance (AREA)
  • General Business, Economics & Management (AREA)
  • Strategic Management (AREA)
  • General Engineering & Computer Science (AREA)
  • Databases & Information Systems (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • Data Mining & Analysis (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

本申请公开了一种获取本地信息的方法、装置及系统，用以解决现有通过浏览器插件技术获取本地信息导致浏览器不稳定的问题，以及网站维护困难的问题。所述方法包括：通过浏览器中的脚本向网络设备发送第一信息获取请求，其中，所述第一信息获取请求用于指示本地应用工具获取本地信息；通过所述本地应用工具监听网络设备返回的所述第一信息获取请求对应的随机数；通过所述本地应用工具获取所述网络设备中保存的所述随机数对应的第一信息获取请求；其中，所述随机数与所述第一信息获取请求的对应关系是由所述网络设备建立并保存的；通过所述本地应用工具获取与所述第一信息获取请求对应的本地信息，并将所述本地信息发送给所述网络设备。

Description

一种获取本地信息的方法、装置及系统 技术领域
本申请涉及计算机技术领域，尤其涉及一种获取本地信息的方法、装置及系统。
背景技术
网页(Web)应用是用户界面驻留在浏览器中的应用程序，例如，网上银行或网上支付等在线Web应用。
在使用某些Web应用时，网络设备需要获取终端的本地信息。例如，用户通过终端实现网上银行或网上支付的相关操作时，为了保证信息安全，网络设备需要获取终端的本地信息以完成整个操作过程。以网上支付为例，在用户登录支付宝页面的过程中，终端可通过浏览器中的脚本获取该终端自身的本地信息，并提交给网络设备。所述本地信息可以为用于确认该终端可靠性的本地数字证书的验证结果等。
但是，出于信息安全考虑，浏览器不能直接获取其所在的终端的本地信息。因此，在现有技术中，一般通过浏览器插件技术实现对本地信息的获取。具体的，上述网上支付实例，用户需要在浏览器的提示下，在本地预先安装验证数字证书的插件。则终端通过浏览器中的脚本直接调用所述插件，并通过该插件获取数字证书的验证结果，最后将验证结果提交给网络设备。
然而，采用上述浏览器插件技术获取本地信息存在以下不足：首先，浏览器与插件之间还存在兼容性的问题，当当前获取本地信息的浏览器与本地安装的相应插件的兼容性不高或者完全不兼容时，容易导致网页上获取本地信息无法进行，甚至还会导致浏览器崩溃，从而导致浏览器使用不稳定。此外，不同类型的浏览器或同一类型浏览器的不同版本对应的插件技术可能不同(如，插件与不同浏览器进行交互的接口不同)，因此，这就需要网站适配不同浏览器 插件技术，这会大大增加网站维护的难度。
发明内容
本申请实施例提供一种获取本地信息的方法和装置，用以解决现有通过浏览器插件技术获取本地信息导致浏览器不稳定的问题，以及网站维护困难的问题。
为实现上述目的，本申请实施例提供的一种获取本地信息的方法，包括：
通过浏览器中的脚本向网络设备发送第一信息获取请求，其中，所述第一信息获取请求用于指示本地应用工具获取本地信息；
通过所述本地应用工具监听网络设备返回的所述第一信息获取请求对应的随机数；
通过所述本地应用工具获取所述网络设备中保存的所述随机数对应的第一信息获取请求；其中，所述随机数与所述第一信息获取请求的对应关系是由所述网络设备建立并保存的；
通过所述本地应用工具获取与所述第一信息获取请求对应的本地信息，并将所述本地信息发送给所述网络设备。
本申请实施例提供的另一种获取本地信息的方法，包括：
接收终端通过浏览器中的脚本发送的第一信息获取请求，其中，所述第一信息获取请求用于指示终端的本地应用工具获取本地信息；
确定并保存所述第一信息获取请求对应的随机数；
将所述随机数返回所述终端；
接收终端通过所述本地应用工具发送的第二信息获取请求；
向终端返回所述第二信息获取请求中携带的随机数对应的第一信息获取请求；
接收终端通过所述本地应用工具获取的与接收到的所述第一信息获取请求对应的本地信息。
本申请实施例提供的一种获取本地信息的装置，包括：
第一信息获取请求发送模块，用于通过浏览器中的脚本向网络设备发送第一信息获取请求，其中，所述第一信息获取请求用于指示本地应用工具获取本地信息；
随机数监听模块，用于通过所述本地应用工具监听网络设备返回的所述第一信息获取请求对应的随机数；
第一信息获取请求获取模块，用于通过所述本地应用工具获取所述网络设备中保存的所述随机数对应的第一信息获取请求；其中，所述随机数与所述第一信息获取请求的对应关系是由所述网络设备建立并保存的；
本地信息获取模块，用于通过所述本地应用工具获取与所述第一信息获取请求对应的本地信息；
本地信息发送模块，用于通过所述本地应用工具将所述本地信息发送给所述网络设备。
本申请实施例提供的另一种获取本地信息的装置，包括：
第一信息获取请求接收模块，用于接收终端通过浏览器中的脚本发送的第一信息获取请求，其中，所述第一信息获取请求用于指示终端的本地应用工具获取本地信息；
随机数确定模块，用于确定所述第一信息获取请求对应的随机数；
随机数发送模块，用于将所述随机数返回所述终端；
存储模块，用于保存所述第一信息获取请求对应的随机数；
第二信息获取请求接收模块，用于接收终端通过所述本地应用工具发送的第二信息获取请求；
第一信息获取请求发送模块，用于向终端返回所述第二信息获取请求中携带的随机数对应的第一信息获取请求；
本地信息接收模块，用于接收终端通过所述本地应用工具获取的与接收到的所述第一信息获取请求对应的本地信息。
本申请实施例提供的一种获取本地信息的系统，包括：
终端，用于通过浏览器中的脚本向网络设备发送第一信息获取请求，其中，所述第一信息获取请求用于指示本地应用工具获取本地信息；通过所述本地应用工具监听网络设备返回的所述第一信息获取请求对应的随机数；通过所述本地应用工具获取所述网络设备中保存的所述随机数对应的第一信息获取请求；以及通过所述本地应用工具获取与所述第一信息获取请求对应的本地信息，并将所述本地信息发送给所述网络设备；
网络设备，用于接收所述终端发送的第一信息获取请求；确定并保存所述第一信息获取请求对应的随机数；将所述随机数返回所述终端；接收终端通过所述本地应用工具发送的第二信息获取请求；向终端返回所述第二信息获取请求中携带的随机数对应的第一信息获取请求；以及接收所述终端发送的本地信息。
本申请通过终端的本地应用工具监听网络设备返回的与自身接收到的第一信息获取请求对应的随机数，获取网络设备保存的与所述随机数对应的第一信息获取请求，获取所述第一信息获取请求对应的本地信息，以及将所述本地信息提交给网络设备供其他设备获取使用。由于本地应用工具与浏览器之间无需任何用于信息交互的接口，因此，浏览器与本地应用工具之间不存在兼容性的问题，从而可有效避免通过浏览器插件技术获取本地信息时因兼容性导致浏览器不稳定的问题，也可有效降低网站维护的难度。
附图说明
此处所说明的附图用来提供对本申请的进一步理解，构成本申请的一部分，本申请的示意性实施例及其说明用于解释本申请，并不构成对本申请的不当限定。在附图中：
图1为本申请实施例提供的获取本地信息的方法流程示意图之一；
图2为本申请实施例提供的获取本地信息的方法流程示意图之二；
图3为本申请实施例提供的获取本地信息的方法流程示意图之三；
图4为本申请实施例提供的获取本地信息的装置结构意图之一；
图5为本申请实施例提供的获取本地信息的装置结构意图之二；
图6为本申请实施例提供的获取本地信息的系统结构意图。
具体实施方式
本申请实施例基于信息安全的考虑，终端的浏览器不能直接获取其所在的终端的本地信息，而如果浏览器直接调用插件获取本地信息，又要求浏览器与插件具有较高的兼容性。因此，在浏览器不直接获取本地信息这个前提下，本申请终端通过浏览器中的脚本向网络设备发送用于获取本地信息的获取请求，并通过本地应用工具从网络设备中获取该获取请求，再根据该获取请求获取相应的本地信息，最后将该本地信息提供给网络设备。这样，浏览器既不直接获取本地信息，保证了信息安全，又不直接与本地应用工具进行交互，无需与本地应用工具兼容，从而可有效避免浏览器与插件不兼容而导致浏览器不稳定的问题，也可有效避免网站维护难度的问题。
为使本申请的目的、技术方案和优点更加清楚，以下将结合本申请具体实施例及相应的附图对本申请技术方案进行清楚、完整地描述。显然，所描述的实施例仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
下面将从终端侧说明本申请实施例提供的获取本地信息的方法。
参见图1，为本申请实施例提供的获取本地信息的方法，包括：
S101、终端通过浏览器中的脚本向网络设备发送第一信息获取请求，其中，所述第一信息获取请求用于指示本地应用工具获取本地信息。
本申请实施例所述的脚本为浏览器可以解析并执行的脚本，具体的，所述脚本包括但不限于JavaScript脚本，简称JS脚本。
不同的Web应用可能需要终端提供不同的本地信息，本申请所述的本地信息包括但不限于：本地用户的数字证书的验证结果、本地设备标识信息、系统应用程序接口信息(如，系统应用(Application，App)接口信息)、本地文件系统信息等。
下面以Web应用为支付应用为实例进行说明，假设用户要登录该支付应用的页面，则该支付应用的服务器(即，网络设备)需要终端提供对该终端的本地数字证书的验证结果(该验证结果即为本地信息)。
其中，所述的本地应用工具可以为能够对本地数字证书进行验证并提供验证结果的可执行程序。所述的可执行程序可存储在所述终端自身的存储介质(如，该终端的硬盘)中，或者存储在与该终端相连的外部存储介质(如，与该终端相连的移动硬盘)中。
需要说明的是，所述终端通过浏览器中的脚本向网络设备发送第一信息获取请求的步骤可以是由终端向网络设备发送业务请求的步骤触发的。当然，也可以是与业务请求同时发送的(如，将第一信息获取请求和业务请求整合为一个请求消息发送给网络设备)。
具体的，延用上述实例，用户在登录该支付应用的页面的过程中，终端需要先通过浏览器向该支付应用的服务器发送登录请求(该登录请求即为业务请求)，从而，浏览器触发通过JS脚本向服务器发送第一信息获取请求的步骤。该第一信息获取请求用于指示该终端的本地应用工具获取该终端的本地数字证书的验证结果。
其中，该JS脚本可以是当服务器接收到该登录请求后向浏览器返回并安装在浏览器中的。当然，也可以是预先配置在浏览器中的。
S102、终端通过所述本地应用工具监听网络设备返回的所述第一信息获取请求对应的随机数。
本申请实施例所述的随机数为明文的随机数，即，该随机数是未经过加密的随机数，从而，本地应用工具监听到该随机数后可直接读取。
网络设备在接收到终端发送的第一信息获取请求后，则可生成一个随机数，作为该第一信息获取请求对应的随机数，并返回给终端。当终端接收到该随机数时，终端中的本地应用工具即可监听到网络设备返回的该随机数。当然，网络设备自身也要保存生成的该随机数与该第一信息获取请求的对应关系。
进一步的，在实际应用场景中，终端与网络设备是基于超文本传输安全协议(Hypertext Transfer Protocol Securehttps，HTTPS)进行信息交互的，其中，HTTPS协议是超文本传输协议(Hypertext Transfer Protocol，HTTP)和安全套接层(Secure Sockets Layer，SSL)协议的组合，也即，终端每次通过浏览器中的JS脚本向网络设备发送一个信息获取请求时，终端都会与网络设备基于SSL协议进行一次安全连接过程，在安全连接过程执行完毕后，网络设备才会基于由该安全连接过程所建立的安全通道接收到该信息获取请求。而在该安全连接过程的密钥协商过程中，终端和网络设备会分别生成随机数并提供给对方，并且安全连接过程中终端和网络设备之间交互的随机数均为明文的随机数。因此，在本申请实施例中，网络设备在接收到终端通过浏览器中的JS脚本发送的第一信息获取请求后，不必再专门针对该第一信息获取请求生成随机数并返回，可直接利用该网络设备自身在安全连接过程中所生成的随机数，建立该随机数与后续接收到的该第一信息获取请求的对应关系并保存即可。而由于在安全连接过程中，网络设备已经将该随机数返回给了终端，终端的本地应用工具也已经监听到了该随机数，因此，网络设备建立并保存了在安全连接过程中所生成的随机数与后续接收到的该第一信息获取请求的对应关系后，也无需再次向终端返回该随机数，以达到避免网络设备重复生成和返回随机数而浪费资源的问题。终端中的本地应用工具监听到了该安全连接过程中的随机数后，则可周期性的向网络设备发送携带该随机数的第二信息获取请求，用以获取该随机数对应的第一信息获取请求。
而且，如果将安全连接过程中网络设备返回的随机数作为该第一信息获取请求对应的随机数，则终端中的本地应用工具在监听安全连接过程中网络设备 返回的随机数时，可采用信息过滤和复制的方法进行监听，以避免影响密钥协商过程。具体的，终端通过本地应用工具监听密钥协商过程中网络设备返回的随机数时，可通过预先设置驱动层的SSL协议，使得本地应用工具在驱动层对终端与网络设备之间的交互信息进行过滤，读取终端与网络设备之间密钥协商过程中网络设备返回的随机数，从而快捷有效地获取网络设备返回的随机数。另外，还需要保证终端通过所述本地应用工具监听到的随机数与所述第一信息获取请求唯一对应，即需要保证网络设备每次返回给终端的随机数唯一，以避免终端提供给网络设备的本地信息不准确的问题。
具体的，本申请可以通过设置网络设备用于SSL协议密钥协商过程的随机数的生成算法，首先保证每次生成的随机数是唯一的。还可以通过设置SSL协议使得会话缓存(SSL session cache)指令和安全连接(connection keepalive)指令在终端通过浏览器中的脚本向网络设备发送第一信息获取请求之后关闭，避免因会话缓存中保存的随机数被网络设备在与终端安全连接过程中重复使用，从而又保证了网络设备返回给终端的随机数唯一。
S103、终端通过所述本地应用工具获取所述网络设备中保存的所述随机数对应的第一信息获取请求；其中，所述随机数与所述第一信息获取请求的对应关系是由所述网络设备建立并保存的。
终端可主动获取网络设备中保存的随机数对应的第一信息获取请求，也可被动获取网络设备发送的随机数对应的第一信息获取请求。
具体的，终端可通过本地应用工具主动向网络设备发送携带监听到的随机数的第二信息获取请求，则网络设备会根据所述第二信息获取请求中携带的随机数返回给终端与所述随机数对应的第一信息获取请求。或者，终端可通过本地应用工具被动接收网络设备提供的携带第一信息获取请求和随机数的响应消息，则本地应用工具接收到该响应消息后，可验证该响应消息中携带的随机数与自身监听到的随机数是否一致，若一致，则可通过后续的步骤S104获取本地信息，若不一致，则可丢弃该响应信息。
S104、终端通过所述本地应用工具获取与所述第一信息获取请求对应的本地信息，将所述本地信息发送给所述网络设备。
继续延用上述实例，该第一信息获取请求为获取本地数字证书的验证结果的获取请求。步骤S103中本地应用工具从网络设备中获取到该第一信息获取请求后，则可根据该第一信息获取请求，对本地数字证书的验证，再将本地数字证书的验证结果发送给网络设备，而由于终端发送该第一信息获取请求的步骤是在终端向网络设备发送登录该支付应用的页面的登录请求时触发的，因此，网络设备接收到该验证结果(也即，本地信息)后，可根据该验证结果，相应处理终端发送的登录请求，即，如果验证结果为验证成功，则允许终端的登录请求，允许终端登录该支付应用的界面，如果验证结果为验证失败，则拒绝终端的登录请求。
本申请上述实施例提供的获取本地信息的方法，终端并非通过浏览器中的脚本直接获取本地信息，而是通过本地应用工具获取本地信息，因此保证了HTTPS协议下信息交互的安全性。而且，浏览器也并非直接调用本地应用工具，以获取本地信息，而是通过脚本向网络设备发送第一信息获取请求，本地应用工具再从网络设备中获取该第一信息获取请求，并根据该第一信息获取请求获取本地信息，因此，本地应用工具无需提供任何与浏览器兼容的接口，二者之间不存在兼容性的问题，可避免浏览器直接调用插件过程中，浏览器与插件不兼容而导致浏览器不稳定的问题，也可进一步避免为了保证不同类型浏览器或不同版本浏览器与本地应用工具兼容而导致网站维护困难的难度。
为了保证网络设备向终端的本地应用工具提供第一信息获取请求时，该第一信息获取请求不被第三方截获并修改，在本申请实施例中，网络设备将第一信息获取请求提供给终端的本地应用工具之前，可先对该第一信息获取请求进行加密处理，再将加密后的第一信息获取请求提供给终端的本地应用工具。
具体的，如果终端的本地应用工具主动根据监听到的随机数获取第一信息获取请求，则网络设备在接收到终端的本地应用工具发送的第二信息获取请求 时，可先对该第二信息获取请求中携带的随机数对应的第一信息获取请求进行加密处理，再将加密后的第一信息获取请求返回给终端的本地应用工具。
相应的，终端的本地应用工具接收到该加密后的第一信息获取请求后，则可对所述第一信息获取请求进行解密处理，再根据解密后的第一信息获取请求，获取本地信息，并将本地信息发送给网络设备。
下面将从网络设备侧说明对应于上述实施例的另一种获取本地信息的方法。
参见图2，本申请实施例提供的另一种获取本地信息的方法，包括：
S201、网络设备接收终端通过浏览器中的脚本发送的第一信息获取请求，其中，所述第一信息获取请求用于指示终端的本地应用工具获取本地信息；
S202、网络设备确定并保存所述第一信息获取请求对应的随机数。
具体的，网络设备可在接收到该第一信息获取请求时，生成该第一信息获取请求对应的随机数，并保存该第一信息获取请求与该随机数的对应关系，也可直接利用在接收到该第一信息获取请求之前与终端进行安全连接过程中产生的随机数，将该随机数确定为第一信息获取请求对应的随机数，这里不再赘述。
S203、将所述随机数返回所述终端。
网络设备将第一信息获取请求对应的随机数返回给终端后，终端的本地应用工具即可监听到该随机数，并向网络设备发送用于获取该第一信息获取请求的第二信息获取请求。
需要说明的是，如果网络设备直接将安全连接过程中所产生的随机数作为该第一信息获取请求对应的随机数，则步骤203可以省略，即，安全连接过程中网络设备已经将该随机数发送给了终端，因此网络设备在接收到第一信息获取请求后也就无需再次发送该随机数。
S204、网络设备接收终端通过所述本地应用工具发送的第二信息获取请求，所述第二信息获取请求携带本地应用工具监听到的随机数。
S205、网络设备向终端返回所述第二信息获取请求中携带的随机数对应的第一信息获取请求。
其中，该过程为终端主动向网络设备获取第一信息获取请求的过程。终端可通过本地应用工具周期性的向网络设备发送携带该随机数的第二信息获取请求，网络设备则可在每次接收到该第二信息获取请求时，查找自身是否保存有该第二信息获取请求中携带的随机数对应的第一信息获取请求，若查找到，则直接返回相应的第一信息获取请求，若未查找到，则可直接丢弃该第二信息获取请求。
当然，网络设备也可以在执行完步骤S203后直接向终端返回携带该随机数以及该第一信息获取请求的响应消息，则终端被动接收网络设备发送的响应消息，这里不再赘述。
S206、网络设备接收终端通过所述本地应用工具获取的与接收到的所述第一信息获取请求对应的本地信息。
也即，网络设备通过步骤S205将第一信息获取请求返回给终端后，终端即可通过本地应用工具根据该第一信息获取请求获取本地信息，并将本地信息发送给网络设备。
本申请实施例提供的上述两种获取本地信息的方法中，所述的网络设备可包括网关和服务器，则生成随机数的步骤可由网关执行，建立随机数与第一信息获取请求的对应关系可由网关执行，也可由服务器执行，随机数与第一信息获取请求的对应关系保存在服务器中，以供终端的本地应用工具获取。进一步的，所述的服务器还可包括业务服务器和安全通道服务器，则可由安全通道服务器保存随机数与第一信息获取请求的对应关系，以确保第一信息获取请求的安全性。
下面以网络设备包括网关、安全通道服务器和业务服务器为例，对登录支付应用的页面的过程进行详细说明。
参见图3，获取本地信息的方法包括以下步骤：
步骤a1、终端通过浏览器向业务服务器发送登录请求。
步骤a2、业务服务器向终端返回脚本。
具体的，所述的脚本可以是JS脚本。
步骤a3、终端将接收到的脚本安装在浏览器中，并通过浏览器中安装的脚本向网关发送第一信息获取请求。
终端可通过执行安装在浏览器中的脚本，生成该第一信息获取请求并向网关发送。
步骤a4、网关向所述终端发起安全连接，将安全连接过程中生成的随机数发送给所述终端。
步骤a5、网关建立该随机数与接收到的第一信息获取请求的对应关系，将该随机数、第一信息获取请求以及该对应关系透传给安全通道服务器保存。
步骤a6、终端通过本地应用工具监听该终端接收到的来自网关的随机数。
步骤a7、终端通过本地应用工具向安全通道服务器发送携带其监听到的随机数的第二信息获取请求。
步骤a8、安全通道服务器查询第二信息获取请求中携带的随机数对应的第一信息获取请求，将与查询到的第一信息获取请求返回终端。
步骤a9、终端根据接收到的第一信息获取请求，通过本地应用工具验证所述本地数字证书，并将验证结果返回安全通道服务器。
步骤a10、安全通道服务器保存验证结果，供业务服务器查询。
业务服务器从所述安全通道服务器查询到该验证结果(也即，本地信息)后，可根据该验证结果，相应处理终端发送的登录请求，即，如果验证结果为验证成功，则允许终端的登录请求，允许终端登录该支付应用的界面，如果验证结果为验证失败，则拒绝终端的登录请求。
以上为本申请实施例提供的获取本地信息的方法，基于同样的思路，本申请实施例还提供了获取本地信息的装置和系统，如图4、图5、图6所示。
参见图4，为本申请实施例提供的获取本地信息的装置，该装置包括：
第一信息获取请求发送模块11，用于通过浏览器中的脚本向网络设备发送第一信息获取请求，其中，所述第一信息获取请求用于指示本地应用工具获取本地信息；
随机数监听模块12，用于通过所述本地应用工具监听网络设备返回的所述第一信息获取请求对应的随机数；
第一信息获取请求获取模块13，用于通过所述本地应用工具获取所述网络设备中保存的所述随机数对应的第一信息获取请求；其中，所述随机数与所述第一信息获取请求的对应关系是由所述网络设备建立并保存的；
本地信息获取模块14，用于通过所述本地应用工具获取与所述第一信息获取请求对应的本地信息；
本地信息发送模块15，用于通过所述本地应用工具将所述本地信息发送给所述网络设备。
本申请实施例中的随机数监听模块12、第一信息获取请求获取模块13、本地信息获取模块14，和本地信息发送模块15可以设置在所述本地应用工具中。
进一步地，第一信息获取请求获取模块13通过所述本地应用工具获取的所述第一信息获取请求为加密后的第一信息获取请求。因此，图4所示的装置还包括：解密模块16，用于在所述本地信息获取模块通过所述本地应用工具获取与所述第一信息获取请求对应的本地信息之前，对所述第一信息获取请求获取模块获取的第一信息获取请求进行解密处理。
本申请实施例中，所述脚本可以但不限于为JavaScript脚本。
参见图5，为本申请实施例提供的获取本地信息的另一种装置，该装置包括：
第一信息获取请求接收模块21，用于接收到终端通过浏览器中的脚本发送的第一信息获取请求，其中，所述第一信息获取请求用于指示终端的本地应用工具获取本地信息；
随机数确定模块22，用于确定所述第一信息获取请求对应的随机数；
随机数发送模块23，用于将所述随机数返回所述终端；
存储模块24，用于保存随机数确定模块22确定的第一信息获取请求对应的随机数，即保第一信息获取请求、随机数以及该第一信息获取请求和随机数的对应关系；
第二信息获取请求接收模块25，用于接收终端通过所述本地应用工具发送的第二信息获取请求；
第一信息获取请求发送模块26，用于向终端返回所述第二信息获取请求中携带的随机数对应的第一信息获取请求；
本地信息接收模块27，用于接收终端通过所述本地应用工具获取的与接收到的所述第一信息获取请求对应的本地信息。
存储模块24还用于存储本地信息接收模块27接收的本地信息。
第二信息获取请求接收模块25，第一信息获取请求发送模块26和本地信息接收模块27设置于安全通道服务器中。
对应于图4所示的装置中的解密模块16，图5所示的装置还包括：加密模块28，用于在所述第一信息获取请求发送模块26向终端返回所述第二信息获取请求中携带的随机数对应的第一信息获取请求之前，对所述第二信息获取请求中携带的随机数对应的第一信息获取请求进行加密处理。
参见图6，为本申请实施例提供的一种获取本地信息的系统，包括：
终端100，用于通过浏览器101中的脚本向网络设备发送第一信息获取请求，其中，所述第一信息获取请求用于指示本地应用工具获取本地信息；通过所述本地应用工具102监听网络设备返回的所述第一信息获取请求对应的随机数；通过所述本地应用工具获取所述网络设备中保存的所述随机数对应的第一信息获取请求；以及通过所述本地应用工具获取与所述第一信息获取请求对应的本地信息，并将所述本地信息发送给所述网络设备；
网络设备200，用于接收所述第一信息获取请求，生成随机数，以及将所 述随机数发送给所述终端；该过程可以通过网络设备200中的网关201执行。
还用于建立并保存所述随机数与所述第一信息获取请求的对应关系；接收终端通过所述本地应用工具发送的第二信息获取请求；向终端返回所述第二信息获取请求中携带的随机数对应的第一信息获取请求；以及接收所述终端返回的本地信息。该过程可以通过与网关201相连的安全通道服务器202执行。
综上所述，本申请实施例基于信息安全的考虑，终端的浏览器不能直接获取其所在的终端的本地信息，而如果浏览器直接调用插件获取本地信息，又要求浏览器与插件具有较高的兼容性。因此，在浏览器不直接获取本地信息这个前提下，本申请终端通过浏览器中的脚本向网络设备发送用于获取本地信息的获取请求，并通过本地应用工具从网络设备中获取该获取请求，再根据该获取请求获取相应的本地信息，最后将该本地信息提供给网络设备。这样，浏览器既不直接获取本地信息，保证了信息安全，又不直接与本地应用工具进行交互，无需与本地应用工具兼容，从而可有效避免浏览器与插件不兼容而导致浏览器不稳定的问题，也可有效降低网站维护的难度。
还需要说明的是，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、商品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、商品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、商品或者设备中还存在另外的相同要素。
本领域技术人员应明白，本申请的实施例可提供为方法、系统或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
以上所述仅为本申请的实施例而已，并不用于限制本申请。对于本领域技术人 员来说，本申请可以有各种更改和变化。凡在本申请的精神和原理之内所作的任何修改、等同替换、改进等，均应包含在本申请的权利要求范围之内。

Claims (11)

  1. 一种获取本地信息的方法，其特征在于，包括：
    通过浏览器中的脚本向网络设备发送第一信息获取请求，其中，所述第一信息获取请求用于指示本地应用工具获取本地信息；
    通过所述本地应用工具监听网络设备返回的所述第一信息获取请求对应的随机数；
    通过所述本地应用工具获取所述网络设备中保存的所述随机数对应的第一信息获取请求；其中，所述随机数与所述第一信息获取请求的对应关系是由所述网络设备建立并保存的；
    通过所述本地应用工具获取与所述第一信息获取请求对应的本地信息，并将所述本地信息发送给所述网络设备。
  2. 如权利要求1所述的方法，其特征在于，通过所述本地应用工具获取的所述第一信息获取请求为加密后的第一信息获取请求；
    通过所述本地应用工具获取与所述第一信息获取请求对应的本地信息之前，还包括：
    通过所述本地应用工具对所述第一信息获取请求进行解密处理。
  3. 如权利要求1所述的方法，其特征在于，所述脚本包括JavaScript脚本。
  4. 一种获取本地信息的方法，其特征在于，包括：
    接收终端通过浏览器中的脚本发送的第一信息获取请求，其中，所述第一信息获取请求用于指示终端的本地应用工具获取本地信息；
    确定并保存所述第一信息获取请求对应的随机数；
    将所述随机数返回所述终端；
    接收终端通过所述本地应用工具发送的第二信息获取请求；
    向终端返回所述第二信息获取请求中携带的随机数对应的第一信息获取请求；
    接收终端通过所述本地应用工具获取的与接收到的所述第一信息获取请求对应的本地信息。
  5. 如权利要求4所述的方法，其特征在于，向终端返回所述第二信息获取请求中携带的随机数对应的第一信息获取请求之前，还包括：
    对所述第二信息获取请求中携带的随机数对应的第一信息获取请求进行加密处理。
  6. 一种获取本地信息的装置，其特征在于，包括：
    第一信息获取请求发送模块，用于通过浏览器中的脚本向网络设备发送第一信息获取请求，其中，所述第一信息获取请求用于指示本地应用工具获取本地信息；
    随机数监听模块，用于通过所述本地应用工具监听网络设备返回的所述第一信息获取请求对应的随机数；
    第一信息获取请求获取模块，用于通过所述本地应用工具获取所述网络设备中保存的所述随机数对应的第一信息获取请求；其中，所述随机数与所述第一信息获取请求的对应关系是由所述网络设备建立并保存的；
    本地信息获取模块，用于通过所述本地应用工具获取与所述第一信息获取请求对应的本地信息；
    本地信息发送模块，用于通过所述本地应用工具将所述本地信息发送给所述网络设备。
  7. 根据权利要求6所述的装置，其特征在于，所述第一信息获取请求获取模块通过所述本地应用工具获取的所述第一信息获取请求为加密后的第一信息获取请求；
    所述装置还包括：解密模块，用于在所述本地信息获取模块通过所述本地应用工具获取与所述第一信息获取请求对应的本地信息之前，对所述第一信息获取请求获取模块获取的第一信息获取请求进行解密处理。
  8. 根据权利要求6所述的装置，其特征在于，所述脚本包括JavaScript 脚本。
  9. 一种获取本地信息的装置，其特征在于，包括：
    第一信息获取请求接收模块，用于接收终端通过浏览器中的脚本发送的第一信息获取请求，其中，所述第一信息获取请求用于指示终端的本地应用工具获取本地信息；
    随机数确定模块，用于确定所述第一信息获取请求对应的随机数；
    随机数发送模块，用于将所述随机数返回所述终端；
    存储模块，用于保存所述第一信息获取请求对应的随机数；
    第二信息获取请求接收模块，用于接收终端通过所述本地应用工具发送的第二信息获取请求；
    第一信息获取请求发送模块，用于向终端返回所述第二信息获取请求中携带的随机数对应的第一信息获取请求；
    本地信息接收模块，用于接收终端通过所述本地应用工具获取的与接收到的所述第一信息获取请求对应的本地信息。
  10. 根据权利要求9所述的装置，其特征在于，所述装置还包括：加密模块，用于在所述第一信息获取请求发送模块向终端返回所述第二信息获取请求中携带的随机数对应的第一信息获取请求之前，对所述第二信息获取请求中携带的随机数对应的第一信息获取请求进行加密处理。
  11. 一种获取本地信息的系统，其特征在于，包括：
    终端，用于通过浏览器中的脚本向网络设备发送第一信息获取请求，其中，所述第一信息获取请求用于指示本地应用工具获取本地信息；通过所述本地应用工具监听网络设备返回的所述第一信息获取请求对应的随机数；通过所述本地应用工具获取所述网络设备中保存的所述随机数对应的第一信息获取请求；以及通过所述本地应用工具获取与所述第一信息获取请求对应的本地信息，并将所述本地信息发送给所述网络设备；
    网络设备，用于接收所述终端发送的第一信息获取请求；确定并保存所述 第一信息获取请求对应的随机数；将所述随机数返回所述终端；接收终端通过所述本地应用工具发送的第二信息获取请求；向终端返回所述第二信息获取请求中携带的随机数对应的第一信息获取请求；以及接收所述终端发送的本地信息。
PCT/CN2015/081678 2014-07-17 2015-06-17 一种获取本地信息的方法、装置及系统 WO2016008349A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
US15/325,588 US11240210B2 (en) 2014-07-17 2015-06-17 Methods, apparatuses, and systems for acquiring local information
JP2017501640A JP6527576B2 (ja) 2014-07-17 2015-06-17 ローカル情報を取得するための方法、機器、及びシステム
EP15822323.0A EP3171543B1 (en) 2014-07-17 2015-06-17 Local information acquisition method, apparatus and system
KR1020177004240A KR102121399B1 (ko) 2014-07-17 2015-06-17 로컬 정보 취득 방법, 장치 및 시스템

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410342583.6 2014-07-17
CN201410342583.6A CN105262605B (zh) 2014-07-17 2014-07-17 一种获取本地信息的方法、装置及系统

Publications (1)

Publication Number Publication Date
WO2016008349A1 true WO2016008349A1 (zh) 2016-01-21

Family

ID=55077899

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/081678 WO2016008349A1 (zh) 2014-07-17 2015-06-17 一种获取本地信息的方法、装置及系统

Country Status (7)

Country Link
US (1) US11240210B2 (zh)
EP (1) EP3171543B1 (zh)
JP (1) JP6527576B2 (zh)
KR (1) KR102121399B1 (zh)
CN (1) CN105262605B (zh)
HK (1) HK1215828A1 (zh)
WO (1) WO2016008349A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111131358B (zh) * 2018-10-31 2021-10-22 比亚迪股份有限公司 信息获取方法、装置、系统、可读存储介质及电子设备
CN109660331A (zh) * 2018-12-31 2019-04-19 北京广成同泰科技有限公司 开放式的互联网程序白名单策略服务系统、方法及终端
US11539755B1 (en) * 2021-03-22 2022-12-27 Trend Micro Incorporated Decryption of encrypted network traffic using an inline network traffic monitor

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20010045451A1 (en) * 2000-02-28 2001-11-29 Tan Warren Yung-Hang Method and system for token-based authentication
US20070300292A1 (en) * 2006-06-21 2007-12-27 Ebay Inc. Computer system authentication using security indicator
CN101541002A (zh) * 2008-03-21 2009-09-23 展讯通信（上海）有限公司 一种基于Web服务器的移动终端的软件许可证下载方法
CN103581145A (zh) * 2012-08-06 2014-02-12 联想(北京)有限公司 一种电子设备及应用于电子设备的安全防护方法

Family Cites Families (28)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH11184818A (ja) 1997-12-25 1999-07-09 Ntt Data Corp 認証システム及び方法、並びに同システムのためのクライアントマシン
US7487130B2 (en) * 2000-11-07 2009-02-03 Grdn. Net Solutions, Llc Consumer-controlled limited and constrained access to a centrally stored information account
US20080281969A1 (en) 2000-12-15 2008-11-13 Horton John C Controlling access to versions of application software by a server, based on site ID
CN1784673A (zh) * 2003-03-14 2006-06-07 汤姆森特许公司 用于嵌入平台的、基于安全网络浏览器的系统管理
CN1271485C (zh) 2004-01-08 2006-08-23 中国工商银行股份有限公司 对网上银行数据进行加密、认证方法
US7752448B1 (en) 2004-02-17 2010-07-06 The Weather Channel, Inc. Domain-based application functionality
US20060173981A1 (en) * 2004-03-11 2006-08-03 Junbiao Zhang Secure web browser based system administration for embedded platforms
CN1787513A (zh) 2004-12-07 2006-06-14 上海鼎安信息技术有限公司 安全远程访问系统和方法
US8327142B2 (en) * 2006-09-27 2012-12-04 Secureauth Corporation System and method for facilitating secure online transactions
US9055107B2 (en) * 2006-12-01 2015-06-09 Microsoft Technology Licensing, Llc Authentication delegation based on re-verification of cryptographic evidence
WO2008096396A1 (ja) * 2007-02-02 2008-08-14 Panasonic Corporation 無線通信装置および暗号鍵更新方法
JP5016678B2 (ja) * 2007-10-19 2012-09-05 日本電信電話株式会社 利用者認証システム及びその方法
JP4733167B2 (ja) * 2008-08-20 2011-07-27 フェリカネットワークス株式会社 情報処理装置、情報処理方法、情報処理プログラムおよび情報処理システム
CN101807998A (zh) * 2009-02-13 2010-08-18 英飞凌科技股份有限公司 认证
CN101610157B (zh) 2009-07-28 2012-09-05 江苏先安科技有限公司 一种Web表单中使用数字证书自动签名的系统和方法
DE102009036179A1 (de) * 2009-08-05 2011-02-10 Siemens Aktiengesellschaft Verfahren zur Ausstellung eines digitalen Zertifikats durch eine Zertifizierungsstelle, Anordnung zur Durchführung des Verfahrens und Rechnersystem einer Zertifizierungsstelle
CN101799821B (zh) 2010-02-11 2013-01-02 北京易路联动技术有限公司 一种通过微件实现网页应用的方法及系统
KR101317342B1 (ko) * 2010-08-27 2013-10-11 한국전자통신연구원 리소스 연동 모바일 단말, 모바일 단말 내 리소스 연동 방법 및 웹서버와 단말 간의 리소스 연동 방법
CN102118504B (zh) 2011-02-28 2014-12-10 中兴通讯股份有限公司 移动终端浏览器调用本地应用的方法及装置
CN102819451B (zh) 2011-06-09 2015-08-19 财付通支付科技有限公司 一种浏览器插件调用方法及系统
CN103179159B (zh) 2011-12-22 2015-11-04 腾讯科技（深圳）有限公司 一种处理第三方应用的方法和终端浏览器
ES2644593T3 (es) * 2012-06-29 2017-11-29 Huawei Technologies Co., Ltd. Método y dispositivo de autentificación de identidad
US9077725B2 (en) * 2012-08-27 2015-07-07 Vmware, Inc. Configuration profile validation on iOS based on root certificate validation
EP3296891A3 (en) * 2012-12-18 2018-07-04 Huawei Technologies Co., Ltd. Web application interaction method, apparatus, and system
CN103067398A (zh) * 2012-12-31 2013-04-24 北京百度网讯科技有限公司 一种用于实现第三方应用访问用户数据的方法和设备
US10404475B2 (en) * 2015-01-22 2019-09-03 Visa International Service Association Method and system for establishing a secure communication tunnel
US9787643B2 (en) * 2015-01-30 2017-10-10 Facebook, Inc. Transport layer security latency mitigation
CN107924437A (zh) * 2015-06-17 2018-04-17 瑞典爱立信有限公司 用于使得能够实现凭证的安全供应的方法以及相关无线装置和服务器

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20010045451A1 (en) * 2000-02-28 2001-11-29 Tan Warren Yung-Hang Method and system for token-based authentication
US20070300292A1 (en) * 2006-06-21 2007-12-27 Ebay Inc. Computer system authentication using security indicator
CN101541002A (zh) * 2008-03-21 2009-09-23 展讯通信（上海）有限公司 一种基于Web服务器的移动终端的软件许可证下载方法
CN103581145A (zh) * 2012-08-06 2014-02-12 联想(北京)有限公司 一种电子设备及应用于电子设备的安全防护方法

Also Published As

Publication number Publication date
EP3171543A1 (en) 2017-05-24
JP2017523702A (ja) 2017-08-17
EP3171543B1 (en) 2018-07-18
CN105262605B (zh) 2018-09-25
JP6527576B2 (ja) 2019-06-05
CN105262605A (zh) 2016-01-20
US20170163610A1 (en) 2017-06-08
KR20170051415A (ko) 2017-05-11
EP3171543A4 (en) 2017-06-14
US11240210B2 (en) 2022-02-01
HK1215828A1 (zh) 2016-09-15
KR102121399B1 (ko) 2020-06-11

Similar Documents

Publication Publication Date Title
US10848310B2 (en) Method and device for identifying user identity
US10721320B2 (en) Redirection method, apparatus, and system
KR102375777B1 (ko) 온보드 단말기를 위한 지불 인증 방법, 장치 및 시스템
TWI688253B (zh) 授權方法、請求授權的方法及裝置
US10402797B2 (en) Secured authentication and transaction authorization for mobile and internet-of-things devices
WO2017028804A1 (zh) 一种Web实时通信平台鉴权接入方法及装置
WO2016107333A1 (zh) 一种在线激活移动终端令牌的设备和系统的工作方法
WO2016201732A1 (zh) 一种虚拟sim卡参数管理方法、移动终端及服务器
JP2015526776A (ja) 機器同士の間の通信セッション転送
WO2019062666A1 (zh) 一种实现安全访问内部网络的系统、方法和装置
WO2020140407A1 (zh) 基于云安全的云桌面登陆方法、装置、设备和存储介质
CN103220259A (zh) Oauth API的使用、调用方法、设备及系统
CN106161475B (zh) 用户鉴权的实现方法和装置
WO2016045541A1 (zh) 一种对中间人的存在进行辨识的方法及装置
CN106936759A (zh) 一种单点登录方法、服务器及客户端
WO2016008349A1 (zh) 一种获取本地信息的方法、装置及系统
WO2018099407A1 (zh) 账户认证登录方法及装置
JP6240102B2 (ja) 認証システム、認証鍵管理装置、認証鍵管理方法および認証鍵管理プログラム
JP6307610B2 (ja) データ改竄検知装置、データ改竄検知方法、及びプログラム
WO2019184206A1 (zh) 身份认证方法及装置
JPWO2019234801A1 (ja) サービス提供システム及びサービス提供方法
US9826064B2 (en) Securing sensitive data between a client and server using claim numbers
CN111555888B (zh) 一种基于区块链的数据交互方法及装置
WO2019036967A1 (zh) 具有数据备份功能的装置和相关产品
KR20100038730A (ko) 컨텐츠 제공자에 제공되는 회원 정보의 보안을 강화한 인증방법 및 시스템

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15822323

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 15325588

Country of ref document: US

ENP Entry into the national phase

Ref document number: 2017501640

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 20177004240

Country of ref document: KR

Kind code of ref document: A

REEP Request for entry into the european phase

Ref document number: 2015822323

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2015822323

Country of ref document: EP