WO2016078024A1 - 一种信息提供方法、数据传输方法及装置 - Google Patents

一种信息提供方法、数据传输方法及装置 Download PDF

Info

Publication number
WO2016078024A1
WO2016078024A1 PCT/CN2014/091580 CN2014091580W WO2016078024A1 WO 2016078024 A1 WO2016078024 A1 WO 2016078024A1 CN 2014091580 W CN2014091580 W CN 2014091580W WO 2016078024 A1 WO2016078024 A1 WO 2016078024A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
biem
request
information provider
unit
Prior art date
Application number
PCT/CN2014/091580
Other languages
English (en)
French (fr)
Inventor
李伟
张文华
冯学才
许剑峰
Original Assignee
北京神州泰岳软件股份有限公司
智桥资讯私人有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京神州泰岳软件股份有限公司, 智桥资讯私人有限公司 filed Critical 北京神州泰岳软件股份有限公司
Priority to PCT/CN2014/091580 priority Critical patent/WO2016078024A1/zh
Publication of WO2016078024A1 publication Critical patent/WO2016078024A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/40—Support for services or applications

Definitions

  • the present invention relates to the field of network technologies, and in particular, to an information providing method, a data transmission method, and an apparatus.
  • an information providing method, a data transmission method, and a device are provided to solve the technical problem that the data transmission between the various mechanisms in the prior art is low and the labor cost is increased.
  • the first aspect provides a data transmission method, including:
  • the black box information exchange middleware BIEM receives the information providing request sent by the information provider;
  • the BIEM authorizes the information providing request of the agent and creates an account for the information provider
  • the BIEM when receiving the request for the digital certificate sent by the information provider, assigns a digital certificate to the information provider;
  • the BIEM receives a capability application interface API sent by the information provider, and allows an authorized information requester to invoke an API;
  • the BIEM receives an application service APPS sent by the information provider, and integrates the APPS into a total application APP to become a service.
  • the second aspect provides a method for providing information, including:
  • the information providing direction black box information exchange middleware BIEM sends a message providing request
  • the information provides a request for the BIEM to apply for a digital certificate
  • the information provider synchronizes the digital certificate of the second information provider through the lightweight directory access protocol LDPA interface;
  • the information provider publishes a capability application interface API to the BIEM, so that the information requester invokes the API through the BIEM;
  • the information provider publishes an application service APPS to the BIEM, so that the BIEM integrates the APPS into the total application APP to become a service.
  • a third aspect provides a data transmission apparatus, including:
  • a first receiving unit configured to receive an information providing request sent by the information provider
  • An authorization unit configured to authorize the information providing request of the agent, and create an account for the information provider
  • a second receiving unit configured to receive a request for requesting a digital certificate sent by the information provider
  • An allocating unit configured to allocate a digital certificate to the information provider
  • a first sending unit configured to send the digital certificate to the information provider
  • a third receiving unit configured to receive a capability application interface API sent by the information provider, and allow an authorized information requester to invoke an API
  • a third receiving unit configured to receive an application service APPS sent by the information provider
  • An integration unit for integrating the APPS into a total application APP to become a service.
  • the fourth aspect provides an information providing apparatus, including:
  • a first sending unit configured to send a message providing request to the black box information exchange middleware BIEM;
  • a first receiving unit configured to receive authorization information of the information providing request sent by the BIEM, and an account that is allocated to the information provider;
  • a second sending unit configured to apply for a digital certificate to the BIEM
  • a second receiving unit configured to receive a digital certificate sent by the BIEM
  • a synchronization unit configured to synchronize a digital certificate of the second information providing device by using a lightweight directory access protocol LDPA interface;
  • a third sending unit configured to publish a capability application program interface API to the BIEM, so that the information requester invokes the API through the BIEM;
  • a fourth sending unit configured to publish the application service APPS to the BIEM, so that the BIEM integrates the APPS into the total application APP to become a service.
  • the information provider establishes a secure channel with the BIEM, and applies for a digital certificate from the BIEM, and then publishes its own API and APPS to the BIEM, so that the BIEM publishes the information provider.
  • the API facilitates the authorization of the information requester to call APPS through the API, which improves the data transmission efficiency between the information provider and the BIEM, and reduces the labor cost.
  • FIG. 1 is a flowchart of a method for providing information according to an embodiment of the present invention
  • FIG. 2 is a flowchart of a data transmission method according to an embodiment of the present invention.
  • FIG. 3 is another flowchart of a data transmission method according to an embodiment of the present invention.
  • FIG. 4 is a schematic structural diagram of an information providing apparatus according to an embodiment of the present disclosure.
  • FIG. 5 is a schematic structural diagram of a data transmission apparatus according to an embodiment of the present disclosure.
  • FIG. 6 is another schematic structural diagram of a data transmission apparatus according to an embodiment of the present disclosure.
  • FIG. 7 is a schematic structural diagram of a BIEM system mechanism according to an embodiment of the present invention.
  • FIG. 8 is a flowchart of an application example of an information providing method according to an embodiment of the present disclosure.
  • FIG. 9 is a flowchart of an application example of a data transmission method according to an embodiment of the present invention.
  • FIG. 10 is a schematic diagram of a data processing device implemented based on a computer system according to an embodiment of the present invention.
  • FIG. 1 is a flowchart of a method for providing information according to an embodiment of the present invention.
  • a process for providing information in a black box information exchange middleware (BIEM) is provided. .
  • the method includes:
  • Step 101 The information providing direction black box information exchange middleware BIEM sends a information providing information request
  • the Black Box Information Exchange Middleware includes two functional layer modules, a capability layer module and a management layer module.
  • the capability layer module will provide the relevant functional interfaces, agent applications and back-end applications;
  • the management module will provide the services of the operation and management and system administrator functions.
  • the capability layer module will provide the relevant functional interfaces, agent applications and back-end applications;
  • the management module will provide the services of the operation and management and system administrator functions.
  • BIEM can include: Capability Middleware Platform (CMP), providing a secure middleware interface for multiple access organizations or third-party applications; Key Management Center (SKMC), responsible for management and Synchronous digital certificate, the organization applies for digital certificate, Agency Service Management Platform (ASMP), provides service management functions for managers; System Operation & Management Platform (SOMP) provides system administrators with systems Operation and management functions.
  • CMP Capability Middleware Platform
  • SKMC Key Management Center
  • ASMP Agency Service Management Platform
  • SOMP System Operation & Management Platform
  • the information provider may also be referred to as an agent administrator or the like.
  • Step 102 The information provider receives the authorization information of the information providing request sent by the BIEM, and allocates an account for the information provider.
  • the ASMP in the BIEM joins through the authorization information provider on the SOMP platform, and allocates an account to the information provider through the SOMP platform, including the user. Name and password.
  • SOMP in BIEM will whitelist the IP storage of the server where the information provider is located in order to subsequently verify the identity of the information provider.
  • Step 103 The information providing direction sends a request for requesting a digital certificate to the BIEM.
  • the digital certificate in this embodiment is a string of digits of the identity information of the parties in the Internet communication.
  • the digital certificate is a certificate authority digital signature file, and the file includes the public key owner information and Public key.
  • the simplest digital certificate includes: a public key, a name, and a digital signature from a certificate authority. Usually issued by the certificate authority center, it can be used online to identify each other's identity.
  • the information providing direction sends a request for a digital certificate to the SKMC in the BIEM, and the SKMC generates a corresponding digital certificate according to the request, and sends the digital certificate to the information provider.
  • Step 104 The information provider receives the BIEM sending a response including a digital certificate.
  • Step 105 The information provider synchronizes the digital certificate of the second information provider by using a Lightweight Directory Access Protocol (LDPA) interface;
  • LDPA Lightweight Directory Access Protocol
  • the information provider synchronizes the digital certificate of the second information provider through the LDPA interface, so as to obtain the public key of the second information provider, and then use the other party's public when sending the service request to the other party.
  • the key is encrypted.
  • the second information provider may be one organization or multiple institutions.
  • the information provider can also synchronize the digital certificate provided by other information providers through the LDPA interface, and obtain the service information provided by other information providers through the digital certificate.
  • Step 106 The information provider will use a capability application interface (API, Application Program) Interface) is posted to the BIEM to facilitate the information requester to invoke the API through the BIEM;
  • API Application Program
  • the information provider publishes its own capability application interface API to the ASMP platform in BIEM, so that the information requester invokes the API.
  • Step 107 The information provider publishes an application service (APPS, Application Service) to the BIEM, so that the BIEM integrates the APPS into the total application APP to become a service.
  • APPS Application Service
  • the information provider establishes a secure channel with the BIEM, and applies for a digital certificate from the BIEM, and then publishes its own API and APPS to the BIEM, so that the BIEM publishes the information provider's API and facilitates the authorized information.
  • the requester invokes APPS through the API, which improves the data transmission efficiency between the information provider and the BIEM, and reduces the labor cost.
  • FIG. 2 is another flowchart of an information providing method according to an embodiment of the present invention.
  • the BIEM when receiving the information providing request, the BIEM authorizes the information provider and allocates an account. And operations such as digital authentication.
  • the method includes:
  • Step 201 The black box information exchange middleware BIEM receives the information providing request sent by the information provider;
  • Step 202 The BIEM authorizes the information providing request, and creates an account for the information provider.
  • the IP address of the information provider is added to the whitelist for subsequent legal verification.
  • Step 203 The BIEM allocates a digital certificate to the information provider when receiving the request for the digital certificate sent by the information provider.
  • the SKMC in BIEM assigns a digital certificate to the information provider.
  • Step 204 The BIEM receives a capability application interface API sent by the information provider, and allows an authorization information requester to invoke an API.
  • ASMP publishes an API in BIEM to facilitate the request of the authorized information requester to ensure the secure transmission of data.
  • Step 205 The BIEM receives an application service APPS sent by the information provider, and integrates the APPS into a total application APP to become a service.
  • the ASMP in the BIEM integrates the APPS of one or more information providers into the total APP, which is convenient for the authorized information requester to invoke.
  • the method may further include: the BIEM receiving an information request sent by the information requester for requesting the information provider;
  • the information request includes: a digital signature of the information requester; the BIEM verifies the legality of the information requester according to the information request; and the BIEM performs the information request when verifying that the information requester is legal
  • the digital signature is modified to its own digital signature; the BIEM encrypts the modified information request and will
  • the encrypted information request is forwarded to the information provider; the BIEM receives a service corresponding to the information request sent by the information provider; the BIEM encrypts the service, and the encrypted device
  • the service is forwarded to the information requester.
  • the BIEM establishes a secure channel with the information provider, and allocates an account number and a digital certificate to the information provider, so that the information provider can transmit its own API and APPS, and publish and receive the API to facilitate the authorized information requester. Calling APPS through the API improves data transmission and reduces labor costs.
  • FIG. 3 is a flowchart of a data transmission method according to an embodiment of the present invention.
  • the black box information exchange middleware BIEM is separately established with the authorized information provider and the information requester in advance. aisle.
  • the method includes:
  • Step 301 The BIEM receives a request for information sent by the information requester for requesting the information provider; the information request includes: a digital signature of the information requester;
  • the information request may further include: an IP address of the information provider and an account number of the information provider; but is not limited thereto, and may include other information, which is not limited in this embodiment.
  • Step 302 The BIEM verifies the legality of the information requester according to the information request.
  • An authentication method is as follows: the Open Interfaces Management Modules (OIMM) module in BIEM first verifies whether the address IP of the information provider is within the authorized range; if correct, then, the digital certificate is used to verify the account information. Whether it is correct; if it is correct, it is detected whether the digital signature of the information requester is correct, if it is correct, the information requester is legal; if the authentication information provider's address IP is incorrect, or the account information is incorrect, or The digital signature is incorrect and the requester is rejected.
  • OIMM Open Interfaces Management Modules
  • Step 303 The BIEM, when verifying that the information requester is legal, modifying the digital signature in the information request to its own digital signature;
  • BIEM modifies the digital signature in the information request to its own digital signature and converts the format of the information request into information in order to facilitate communication with the information provider.
  • Step 304 The BIEM encrypts the modified information request, and forwards the encrypted information request to the information provider.
  • the BIEM encrypts the modified information request by using the public key, and sends the encrypted information request to the information provider, so that the information provider that receives the information request utilizes the public information.
  • the private key corresponding to the key decrypts the information request.
  • the information provider encrypts the service corresponding to the information request using the public key, and transmits the encrypted service to the BIEM.
  • the information provider After receiving the information request sent by the BIEM, the information provider first verifies the message format of the information request, and the digital signature of the BIEM. If they are all correct, the corresponding service will be sent to BIEM.
  • Step 305 The BIEM receives a service corresponding to the information request sent by the information provider.
  • the BIEM When receiving the service corresponding to the information request sent by the information provider, the BIEM decrypts using the private key corresponding to the public key to obtain the corresponding service.
  • the data to be encrypted is decrypted and decrypted, which is well known in the art and will not be described herein.
  • Step 306 The BIEM encrypts the service, and forwards the encrypted service to the information requester.
  • the BIEM then encrypts the decrypted service, encrypts it with the public key, and sends the encrypted service to the information requester, so that the information requester decrypts the service using the private key corresponding to the public key.
  • the BIEM verifies the received request and the response data, and respectively encrypts the data with the corresponding public key and forwards it to the peer end, so that the peer end decrypts with the corresponding private key.
  • BIEM is only responsible for data verification and data forwarding, thus ensuring the security of information.
  • FIG. 4 is a schematic structural diagram of an information providing apparatus according to an embodiment of the present invention.
  • the apparatus includes: a first sending unit 41, a first receiving unit 41, a second sending unit 43, and a second receiving.
  • Unit 44 synchronization unit 45, third transmission unit 46 and fourth transmission unit 47, wherein
  • the first sending unit 41 is configured to send an information providing request to the black box information exchange middleware BIEM;
  • the first receiving unit 42 is configured to receive authorization information of the information providing request sent by the BIEM, and an account that is allocated to the information provider;
  • the second sending unit 43 is configured to apply for a digital certificate to the BIEM
  • the second receiving unit 44 is configured to receive a digital certificate sent by the BIEM.
  • the synchronization unit 45 is configured to synchronize the digital certificate of the second information providing device by using the LDPA interface;
  • the third sending unit 46 is configured to publish a capability application program interface API to the BIEM, so that the information requesting party invokes the API through the BIEM;
  • the fourth sending unit 47 is configured to publish an application service APPS to the BIEM, so that the BIEM integrates the APPS into the total application APP to become a service.
  • the information providing apparatus may be integrated in the server of the information provider, or may be deployed independently. This embodiment is not limited.
  • FIG. 5 is a schematic structural diagram of a data transmission apparatus according to an embodiment of the present invention.
  • the apparatus includes: a first receiving unit 51, an authorization unit 52, a second receiving unit 53, and an allocating unit 54, a transmitting unit 55, a third receiving unit 56, a fourth receiving unit 57 and an integrating unit 58, wherein
  • the first receiving unit 51 is configured to receive an information providing request sent by an information provider
  • the authorization unit 52 is configured to authorize the information providing request of the agent, and create an account for the information provider;
  • the second receiving unit 53 is configured to receive a request for the information provider to apply for a digital certificate
  • the allocating unit 54 is configured to allocate a digital certificate to the information provider
  • the first sending unit 55 is configured to send the digital certificate to the information provider.
  • the third receiving unit 56 is configured to receive a capability application interface API sent by the information provider, and allow an authorized information requester to invoke an API;
  • the fourth receiving unit 57 is configured to receive an application service APPS sent by the information provider;
  • the integration unit 58 is configured to integrate the APPS into a total application APP to become a service.
  • the apparatus may further include: an adding unit, configured to: after the authorization unit creates an account for the information provider, provide the information The party's IP address is added to the whitelist.
  • the embodiment is based on the foregoing embodiment, where the apparatus may further include: a fifth receiving unit, a verifying unit, a modifying unit, an encrypting unit, a second sending unit, and a sixth a receiving unit and a third sending unit (not shown), wherein
  • the fifth receiving unit is configured to: after the integrating unit integrates the APPS into the total application APP to become a service, receive an information request sent by the information requester for requesting the information provider; the information request includes : the digital signature of the information requester;
  • the verification unit is configured to verify validity of the information requester according to the information request
  • the modifying unit is configured to modify the digital signature in the information request to its own digital signature when the verification unit verifies that the information requester is legal;
  • the encryption unit is configured to encrypt the information request modified by the modification unit
  • the second sending unit is configured to forward the information request encrypted by the encryption unit to the information provider;
  • the sixth receiving unit is configured to receive a service corresponding to the information request sent by the information provider;
  • the third sending unit is configured to forward the service to the information requesting party.
  • the information request received by the fifth receiving unit further includes: an IP address of the information provider and an account of the information provider;
  • the verification unit includes: a first verification unit, a second verification unit, Three verification units and confirmation units, wherein
  • the first verification unit is configured to verify whether the address IP of the information provider is within an authorized range
  • the second verification unit is configured to verify whether the account information is correct.
  • the third verification unit is configured to verify whether the digital signature of the information requester is correct
  • the confirmation unit is configured to verify, in the first verification unit, that the IP is within an authorized range, the second verification unit verifies that the account is correct, and the third verification unit verifies that the digital signature is correct, and confirms The information requester is legal.
  • FIG. 6 is a schematic diagram of another structure of a data transmission apparatus according to an embodiment of the present invention.
  • the apparatus is integrated in a black box information exchange middleware BIEM, and the apparatus is respectively associated with an information provider and an information requester.
  • Establishing a secure channel wherein the device comprises: a first receiving unit 61, a verifying unit 62, a modifying unit 63, an encrypting unit 64, a first transmitting unit 65, a second receiving unit 66 and a second transmitting unit 67, wherein
  • the first receiving unit 61 is configured to receive, by the information requesting party, an information request for requesting the information provider; the information request includes: a digital signature of the information requesting party;
  • the verification unit 62 is configured to verify the legality of the information requester according to the information request;
  • the modifying unit 63 is configured to modify the digital signature in the information request to its own digital signature when the verification unit verifies that the information requester is legal;
  • the encryption unit 64 is configured to encrypt the information request modified by the modification unit
  • the first sending unit 65 is configured to forward the information request encrypted by the encryption unit to the information provider;
  • the second receiving unit 66 is configured to receive a service corresponding to the information request sent by the information provider;
  • the second sending unit 67 is configured to forward the service to the information requesting party.
  • the information request received by the first receiving unit 61 further includes: an IP of the information provider and an account of the information provider;
  • the verification unit 62 includes: a first verification unit, a second verification unit, a third verification unit, and a confirmation unit (not shown), wherein
  • the first verification unit is configured to verify whether the address IP of the information provider is within an authorized range
  • the second verification unit is configured to verify whether the account information is correct.
  • the third verification unit is configured to verify whether the digital signature of the information requester is correct
  • the confirmation unit is configured to verify, in the first verification unit, that the IP is within an authorized range, the second verification unit verifies that the account is correct, and when the third verification unit verifies that the digital signature is correct, confirming the The information requester is legal.
  • FIG. 7 is a schematic structural diagram of a BIEM system mechanism according to an embodiment of the present invention
  • the BIEM 7 includes: a capability middleware platform CMP component 71, a key management center SKMC component 72, and an agent service management platform ASMP component. 73.
  • a system operation management platform SOMP component 74 and an application component 75 wherein the CMP component 71 and the SKMC component 72 are capability layer components, and the ASMP component 73 and the SOMP component 74 are management layer components, and the application component 75 is an application.
  • Layer component, with CMP component 71, SKMC component 72, ASMP The component 73 and the SOMP component 74 are respectively connected, wherein
  • the CMP component 71 is configured to provide a secure middleware interface for multiple access information requesters (institutions or third-party applications);
  • the SKMC component 72 is configured to manage and synchronize a digital certificate provided by an authorized information issuer, and the institution applies for a digital certificate;
  • the ASMP component 73 is configured to provide a service management function for an information provider (ie, a manager);
  • the SOMP component 74 is configured to provide system administrators with system operation and management functions
  • the application component 75 is configured to process corresponding application services for the CMP component 71, the SKMC component 72, the ASMP component 73, and the SOMP component 74.
  • the BIEM establishes a secure channel with the information provider, and allocates an account number and a digital certificate to the information provider, so that the information provider can transmit its own API and APPS, and publish and receive the API to facilitate the authorized information requester. Calling APPS through the API improves data transmission and reduces labor costs.
  • the CMP component 71 includes: an Open Interfaces Management Module (OIMM) module, an Open Interfaces Generator (OIG) module, a Message Processing Queue (MPQ) module, and an identity.
  • OIMM Open Interfaces Management Module
  • OIG Open Interfaces Generator
  • MPQ Message Processing Queue
  • An Authentication Center (AC) module a Client Capabilities Interfaces (CCI) module
  • MCM Message Communication Module
  • the OIMM module is used to provide open interface capabilities for an Agency application or a third-party application through HTTP/HTTPS, including requester authentication, message validity verification, and the like.
  • the OIG module is used to automatically convert to an open capability interface through a capability template.
  • the MPQ module is responsible for processing requests from various agencies, verifying signatures, generating statistics, and transmitting requests to the final receiving organization.
  • the AC module is responsible for authenticating through the digital authentication mechanism from the agency or the third application through the HTTP/HTTPS request.
  • CCI module which is responsible for providing a capability interface for connecting to an organization's applications, such as registration, login/logout, subscription unsubscribe proxy service, etc.
  • the MCM module is responsible for handling communication requests between subscribers and Agencies. It will provide a unified framework and organization for messaging between subscribers, such as instant messaging, automatic replay, and broadcast.
  • the SKMC component 72 includes: a Registration Authority (RA) module, a CA (Certificate Authority) module, a Key Management Center (KMC) module, and Online Certificate Status Query (OCSP) module (not shown), where
  • RA Registration Authority
  • CA Certificate Authority
  • KMC Key Management Center
  • OCSP Online Certificate Status Query
  • the RA module is responsible for processing related certificate request services, such as application certificate control processing, certificate application review, applicant management, and the like.
  • a CA module that is used to issue and manage (such as apply, download, refresh, freeze, logout, etc.) certificates for organizations and third-party applications of back-end applications.
  • the KMC module is responsible for generating and managing the encryption key of the CA module.
  • the OCSP module is used to provide online query function for certificate status.
  • the ASMP component 73 includes: an Agency Service Management (ASM) module, an Agency Capability Publish Management (ACPM) module, and an account management (AM, Account). Management) module (not shown), where
  • An ASM module that allows organizations to publish their custom web applications and push various media content to service subscribers.
  • the ACPM module is designed to allow organizations to publish their capabilities in an open API, publish their capabilities and apply to invoke APIs from other organizations.
  • the AM module is responsible for managing the account information and subscription services of the organization.
  • the SOMP component 74 includes: an Operation Maintenance Center (OMC) module, a System Statistic Analysis (SSA) module, and an Operation Support Platform (OSP, Operation Support). Platform) module, configuration management (CM, Configuration Management) module, system account management (SAM, System Account Management) module (not shown), wherein
  • OMC Operation Maintenance Center
  • SSA System Statistic Analysis
  • OSP Operation Support Platform
  • Platform Platform
  • CM Configuration Management
  • SAM System Account Management
  • OMC module for real-time monitoring of hardware and service status.
  • the SSA module is used to generate statistical analysis reports about services related to daily, monthly, and other related dimensions.
  • OSP module for providing operational support capabilities such as version management for mobile applications, sending service system broadcasts, querying and displaying subscription service information, etc.
  • CM module for configuration management responsible for the management of the global configuration data necessary for the system, such as area code, organization code, etc.
  • the SAM module is responsible for providing system administrators with authorization management for service programs.
  • the application component 75 includes: a lightweight directory access protocol LDAP service module, an email interface module, a short message interface module, a file storage module, and a log service module (not shown) ,among them,
  • An LDAP service module for providing an LDAP service for requesting certificates from other organizations for batch retrieval
  • An email interface module that allows the BIEM system to integrate with the current mail server, sending or receiving emails related to the organization administrator or end user.
  • the email interface will connect to the email server using the SMTP protocol;
  • the short message interface module is configured to send a short message verification code to the SMS gateway to be registered;
  • a file storage module for providing temporary or permanent storage of file storage, such as saving an audio clip/image of an application
  • the log service module is used to provide daily statistics and regular log storage of the system.
  • the application uses the https protocol to connect to the BIEM system, complete login, logout, and so on.
  • the BIEM system performs information interaction with an external system through the https protocol and/or the LDAP protocol, for example,
  • the information provider and the third-party background application will use the LDAP protocol to connect to BIEM to complete the certificate synchronization operation.
  • BIEM can also use the SMTP interface to complete the sending and receiving of emails.
  • BIEM will also be able to use SMSP or other HTTP interfaces to connect to the SMS gateway to complete the operation of sending and receiving text messages.
  • FIG. 8 is a flowchart of an application example of an information providing method according to an embodiment of the present invention.
  • a new information provider or proxy joins a process of requesting information to BIEM.
  • the method includes:
  • Step 801 The agency manager (ie, the information provider) applies for an application service to the ASMP component through an agency application (Agency Application);
  • Step 802 The ASMP component sends the application service applied by the agent management party to the SOMP component for authorization;
  • Step 803 The SOMP component authorizes the application service, and allocates an account for the proxy manager, where the account includes a username and a password;
  • Step 804 The SOMP component adds the IP address of the server where the agent application is located to the whitelist
  • Step 805 The SOMP component sends the account to the agent application through the ASMP component, and is displayed by the agent application to the agent management party.
  • Step 806 The agent application sends a request for requesting a digital certificate to the RA/CA module.
  • Step 807 The RA/CA module sends a response including the digital certificate to the agent application.
  • Step 808 After the digital certificate application is successful, the agent application synchronizes the digital certificate provided by other institutions through the LDAP server.
  • synchronizing the digital certificates of other institutions means acquiring the public key of other institutions, so that when the service request is sent to the other party, the public key of the other party is used for encryption, and the recipient can only decrypt by using the private key of the other party.
  • the encryption method can be implemented by the RSA (Rivest-Shamir-Adleman public key algorithm) public key algorithm. The encryption principle is well known to those skilled in the art, and details are not described herein.
  • Step 809 The LDAP server sends the digital certificate of the other application service to the agent application.
  • Step 810 The agent application sends its own capability API to the ASMP component;
  • Step 811 The ASMP component issues the received capability API.
  • Step 812 The ASMP component generates an open interface through the CMP to facilitate application service calls of other information requesters.
  • Step 813 The ASMP component sends its own APPS to the ASMP component.
  • Step 814 The ASMP component publishes the APPS, and integrates the APPS into the total APP to become a service.
  • the agent management party ie, the information provider
  • the agent management party applies for the application service to the BIEM component through the agent application, establishes a secure channel with the BIEM component, and then applies for a digital certificate from the BIEM component, and synchronizes the digital certificate of other organizations through the LDAP interface.
  • the API and APPS are published to the BIEM component, so that the BIEM component can publish the API, so that other authorized agent (ie, the information requester) of the authorization can call the APPS through the API, and the data between the information provider and the BIEM is improved. Transmission efficiency reduces labor costs.
  • FIG. 9 is a flowchart of an application example of a data transmission method according to an embodiment of the present invention.
  • a data interaction process between an information provider and an information requester may also be referred to as Data transfer between different agent manageies.
  • the method includes:
  • Step 901 The Agency Application sends a specific service operation request to the Agency A Backend server.
  • Step 902 The agent backend server A connects to the BIEM through the HTTPS interface;
  • Step 903 The agent backend server A sends a specific service operation request to the OIMM module to request data in the agent backend server B.
  • Step 904 The OIMM module first verifies whether the requested IP address is within the authorized range by the AC module, and if it is within the authorized range, checks the requested message format.
  • Step 905 The OIMM module uses the HTTP digital certificate to verify the account information of the agency application through the MPQ module.
  • Step 906 The OIMM module continues to check whether the digital signature of the agent backend server A is correct through the OCSP module.
  • the OCSP module continues to check whether the digital signature of the agent backend server A is correct. If it is correct, the identity of the background server A of the MPQ authentication agent is legal. Otherwise, the MPQ confirms that the identity of the agent backend server A is invalid.
  • Step 907 After the verification is passed, the MPQ module in the BIEM component will generate a raw record for later statistics.
  • Step 908 The OIMM module in BIEM replaces the digital signature in the specific service operation request with its own digital signature;
  • Step 909 The OIMM module forwards the modified specific service operation request to the agency B Backengd server B.
  • Step 910 After receiving the specific service operation request, the agent backend server B verifies the message format of the specific service operation request, the digital signature of the BIEM, and the like;
  • Step 911 the agent backend server B generates return structure information according to the specific service operation request
  • Step 912 The agent backend server B sends a response including the generated structural information to the OIMM;
  • Step 913 The OIMM sends the response including the structure information to the agent backend server A through the HTTPS interface;
  • Step 914 The agent backend server A verifies the digital signature of the BIEM in the response, and if correct, the structural information can be obtained;
  • Step 915 The agent backend server A sends the structure information to the agent management party.
  • the data of the request and response is encrypted during the transmission process, and the content of the message can only be decrypted by the receiver through its own private key, and the BIEM is only responsible for data verification and data flow, and Generating statistics, the BIEM has no ability to decrypt the message content, thus ensuring the security of information transmission.
  • the information provider encrypts the request data, the response data is encrypted, and the decryption process is well known to those skilled in the art, and details are not described herein.
  • An embodiment of the present invention further provides a server, where the server includes:
  • a transceiver configured to receive a request for information provided by an information provider
  • a processor configured to authorize the information providing request, and create an account for the information provider
  • the transceiver is further configured to receive a request for requesting a digital certificate sent by the information provider;
  • the processor is further configured to allocate a digital certificate to the information provider
  • the transceiver is further configured to receive a capability application interface API sent by the information provider, and allow an authorized information requester to invoke an API;
  • the transceiver is further configured to receive an application service APPS sent by the information provider;
  • the processor is further configured to integrate the APPS into a total application APP to become a service.
  • the processor is further configured to add an address of the information provider to the whitelist after creating an account for the information provider.
  • the transceiver is further configured to receive, by the information requesting party, an information request for requesting the information provider; the information request includes: a digital signature of the information requester;
  • the processor is further configured to verify validity of the information requester according to the information request; And when verifying that the information requester is legal, modifying the digital signature in the information request to its own digital signature; and encrypting the modified information request;
  • the transceiver is further configured to forward the encrypted information request to the information provider; and receive a service corresponding to the information request sent by the information provider;
  • the processor is further configured to encrypt the service
  • the transceiver is further configured to forward the encrypted service to the information requester.
  • the information request received by the transceiver further includes: an IP address of the information provider and an account of the information provider;
  • Verifying, by the processor, the legality of the information requester including: verifying whether the address IP of the information provider is within an authorized range; and verifying whether the account information is correct; verifying the number of the information requester Whether the signature is correct; if the IP is within the authorization scope, the account number is correct, and the digital signature is correct, it is confirmed that the information requester is legal.
  • the embodiment of the present invention further provides a server, where the server includes:
  • transceiver configured to send a message providing request to the black box information exchange middleware BIEM; and receive the authorization information of the information providing request sent by the BIEM
  • a processor configured to allocate an account for the information provider
  • the transceiver is further configured to request a request for a digital certificate from the BIEM; and receive the BIEM to send a response including a digital certificate;
  • the transceiver is further configured to synchronize a digital certificate of the second information provider by using a lightweight directory access protocol LDPA interface; and publishing a capability application interface API to the BIEM, so that the information requester invokes through the BIEM Said API; and publishing an application service APPS to the BIEM; so that the APPS is integrated into the total application APP to become a service.
  • LDPA interface lightweight directory access protocol
  • the present invention further provides a data processing apparatus based on a computer system.
  • the data processing apparatus may include: a processor 1701, a memory 1702, and a bus 1703; the processor 1701 and the memory 1702 pass through the bus.
  • the memory 1702 is configured to store a computer execution instruction
  • the processor 1701 is configured to execute the computer execution instruction stored by the memory 1702, and send an information providing request to the black box information exchange middleware BIEM; Determining, by the BIEM, the authorization information of the information providing request, and assigning an account to the information provider; requesting the BIEM to apply for a digital certificate; receiving the BIEM to send a response including a digital certificate; and synchronizing the LDPA interface a digital certificate;
  • a capability application interface API is published to the BIEM, so that the information requester invokes the API through the BIEM; an application service APPS is published to the BIEM, so that the BIEM integrates the APPS into the total application Become a service in the APP. or
  • the processor 1701 is configured to receive information provided by an authorized information requester for requesting authorization
  • the information request includes: a digital signature of the information requester; verifying the legality of the information requester according to the information request; and requesting the information when verifying that the information requester is legal
  • the digital signature in the modification is modified into its own digital signature; the modified information request is encrypted, and the encrypted information request is forwarded to the information provider; and the information request sent by the information provider is received Corresponding service; encrypting the service and forwarding the encrypted service to the information requester.
  • the processor may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or the like.
  • the computer storage medium may store a program, which may include some or all of the steps in various embodiments of the data transmission method provided by the embodiments of the present invention.
  • the storage medium may be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).
  • the present invention can be implemented by means of software plus a necessary general hardware platform, and of course, can also be through hardware, but in many cases, the former is a better implementation. the way.
  • the technical solution of the present invention which is essential or contributes to the prior art, may be embodied in the form of a software product, which may be stored in a storage medium such as a ROM/RAM or a disk. , an optical disk, etc., includes instructions for causing a computer device (which may be a personal computer, server, or network device, etc.) to perform the methods described in various embodiments of the present invention or portions of the embodiments.

Landscapes

  • Engineering & Computer Science (AREA)
  • Multimedia (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

一种信息提供方法、数据传输方法及装置，所述信息提供方法包括：黑盒子信息交换中间件BIEM接收信息提供方发送的信息提供请求(201)；所述BIEM对所述信息提供请求进行授权，并为所述信息提供方创建账号(202)；所述BIEM在接收所述信息提供方发送的申请数字证书的请求时，为所述信息提供方分配数字证书(203)；所述BIEM接收所述信息提供方发送的能力应用程序接口API，并允许授权的信息请求方调用API(204)；所述BIEM接收所述信息提供方发送的应用服务APPS，并将所述APPS整合到总应用APP中成为一个服务(205)。提高了各个机构间数据传输效率，降低了人力成本。

Description

一种信息提供方法、数据传输方法及装置 技术领域
本发明涉及网络技术领域，特别涉及一种信息提供方法、数据传输方法及装置。
背景技术
随着终端技术的发展，各个公司、政府机构都有其存在的系统或移动应用程序来处理各自的日常服务。由于公司、机构本身的限制，服务能力很难在不同机构、公司之间进行协调。比如，某机构中的敏感数据(或内部文件等)不能对外查询，导致一些身份鉴权只能在特定部门内部进行处理，其他机构很难获取这些敏感数据信息；再比如，业务数据需要在各个机构之间传输流转时，由于各个机构之间缺少统一接口，不方便传输，现有方式中，通常是通过人力来传递的，从而导致业务数据传输效率低，同时还增加了人力成本。
因此，如何提高各个机构间的数据传输效率，降低人力成本是目前有待解决的技术问题。
发明内容
本发明实施例中提供了一种信息提供方法、数据传输方法及装置，以解决现有技术中各个机构间数据传输低，导致人力成本增加的技术问题。
为了解决上述技术问题，本发明实施例公开了如下技术方案：
第一方面提供了一种数据传输方法，包括：
黑盒子信息交换中间件BIEM接收信息提供方发送的信息提供请求；
所述BIEM对代理的所述信息提供请求进行授权，并为所述信息提供方创建账号；
所述BIEM在接收所述信息提供方发送的申请数字证书的请求时，为所述信息提供方分配数字证书；
所述BIEM接收所述信息提供方发送的能力应用程序接口API，并允许授权的信息请求方调用API；
所述BIEM接收所述信息提供方发送的应用服务APPS，并将所述APPS整合到总应用APP中成为一个服务。
第二方面提供了一种信息提供方法，包括：
信息提供方向黑盒子信息交换中间件BIEM发送信息提供请求；
所述信息提供方接收所述BIEM发送的所述信息提供请求的授权信息，以及为所述信息提供方分配账号；
所述信息提供方向所述BIEM申请数字证书的请求；
所述信息提供方接收所述BIEM发送包括数字证书的响应；
所述信息提供方通过轻量目录访问协议LDPA接口同步第二信息提供方的数字证书；
所述信息提供方将能力应用程序接口API发布到所述BIEM，以便于信息请求方通过所述BIEM调用所述API；
所述信息提供方将应用服务APPS发布到所述BIEM，以便于所述BIEM将所述APPS整合到总应用APP中成为一个服务。
第三方面提供了一种数据传输装置，包括：
第一接收单元，用于接收信息提供方发送的信息提供请求；
授权单元，用于对代理的所述信息提供请求进行授权，并为所述信息提供方创建账号；
第二接收单元，用于接收所述信息提供方发送的申请数字证书的请求；
分配单元，用于为所述信息提供方分配数字证书；
第一发送单元，用于将所述数字证书发送给所述为所述信息提供方；
第三接收单元，用于接收所述信息提供方发送的能力应用程序接口API，并允许授权的信息请求方调用API；
第三接收单元，用于接收所述信息提供方发送的应用服务APPS；
整合单元，用于将所述APPS整合到总应用APP中成为一个服务。
第四方面提供了一种信息提供装置，包括：
第一发送单元，用于向黑盒子信息交换中间件BIEM发送信息提供请求；
第一接收单元，用于接收所述BIEM发送的所述信息提供请求的授权信息，以及为所述信息提供方分配的账号；
第二发送单元，用于向所述BIEM申请数字证书；
第二接收单元，用于接收所述BIEM发送的数字证书；
同步单元，用于通过轻量目录访问协议LDPA接口同步第二信息提供装置的数字证书；
第三发送单元，用于将能力应用程序接口API发布到所述BIEM，以便于信息请求方通过所述BIEM调用所述API；
第四发送单元，用于将应用服务APPS发布到所述BIEM，以便于所述BIEM将所述APPS整合到总应用APP中成为一个服务。
由上述技术方案可知，本发明实施例中，信息提供方与BIEM建立安全通道，并从BIEM申请到数字证书，然后，将自己的API和APPS发布到BIEM上，以便于BIEM公布信息提供方的API，方便授权的信息请求方通过API调用APPS，提高了信息提供方与BIEM之间数据传输效率，降低了人力成本。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1为本发明实施例提供的一种信息提供方法的流程图；
图2为本发明实施例提供的一种数据传输方法的流程图；
图3为本发明实施例提供的一种数据传输方法的另一流程图；
图4为本发明实施例提供的一种信息提供装置的结构示意图；
图5为本发明实施例提供的一种数据传输装置的结构示意图；
图6为本发明实施例提供的一种数据传输装置的另一结构示意图；
图7为本发明实施例提供的一种BIEM系统机构的结构示意图；
图8为本发明实施例提供的一种信息提供方法的应用实例的流程；
图9为本发明实施例提供的一种数据传输方法的应用实例的流程；
图10为本发明实施例提供的一种基于计算机系统实现的数据处理装置。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整的描述，显然，所描述的实施例仅仅是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
请参阅图1，图1为本发明实施例提供的一种信息提供方法的流程图，该实施例中，信息提供方向黑盒子信息交换中间件(BIEM，Blackbox Information Exchange Middleware)申请信息提供的过程。所述方法包括：
步骤101：信息提供方向黑盒子信息交换中间件BIEM发送信息提供信息请求；
其中，黑盒子信息交换中间件(BIEM)包括两个功能层模块，能力层模块和管理层模块。能力层模块将提供相关的功能接口，代理机构应用程序和后端应用程序；管理层模块将提供服务的运作和管理机构和系统管理员的功能。本实施例中，
BIEM可以包括：能力中间件平台(CMP，Capability Middleware Platform)，为多个接入的机构或者第三方应用提供安全的中间件接口；密钥管理中心(SKMC，Secret Key Management Center)，负责管理和同步数字证书，机构申请数字证书、代理服务管理平台(ASMP，Agency Service Management Platform)，为管理者提供服务管理功能；系统操作和管理平台(SOMP，System Operation& Management Platform)，为系统管理员提供系统操作和管理功能。
本实施例中，信息提供方也可以称为代理管理员等。
该步骤中，当一个新的信息提供方需要将信息提供给BIEM时，需要向BIEM中的ASMP申请加入。
步骤102：所述信息提供方接收所述BIEM发送的所述信息提供请求的授权信息，以及为所述信息提供方分配账号；
该步骤中，BIEM中的ASMP在接收到信息提供方发送的信息提供请求时，会通过SOMP平台上授权信息提供方加入，以及通过SOMP平台为该信息提供方分配账号，所述账号，包括用户名和密码。
进一步，为了安全起见，BIEM中的SOMP会将信息提供方所在服务器的IP存储白名单中，以便于后续验证信息提供方的身份。
步骤103：所述信息提供方向所述BIEM发送申请数字证书的请求；
其中，该实施例中的数字证书，是互联网通信中标志通信各方身份信息的一串数字，简单来说，数字证书就是一个证书授权机构数字签名文件，该文件包含公开密钥拥有者信息以及公开密钥。最简单的数字证书包括：一个公开密钥、名称及证书授权机构的数字签名。通常情况下由证书授权机构中心发行，可以在网上用它来识别对方身份。
该步骤中，所述信息提供方向BIEM中的SKMC发送申请数字证书的请求，SKMC根据所述请求生成相应的数字证书，并将该数字证书发送给所述信息提供方。
步骤104：所述信息提供方接收所述BIEM发送包括数字证书的响应；
步骤105：所述信息提供方通过轻量目录访问协议(LDPA，Lightweight Directory Access Protocol)接口同步第二信息提供方的数字证书；
该步骤中，信息提供方在获得数字证书后，通过LDPA接口同步第二信息提供方的数字证书，以便于获取第二信息提供方的公钥，然后给对方发送业务请求时，利用对方的公钥进行加密。其中，第二信息提供方可以是一个机构，也可以是多个机构。
当然，信息提供方也可以通过LDPA接口去同步其他信息提供方提供的数字证书，通过所述数字证书获取其他信息提供方提供的服务信息。
步骤106：所述信息提供方将能力应用程序接口(API，Application Program  Interface)发布到所述BIEM，以便于信息请求方通过所述BIEM调用API；
其中，该步骤中，所述信息提供方将自身的能力应用程序接口API发布到BIEM中的ASMP平台，以便于信息请求方调用API。
步骤107：所述信息提供方将应用服务(APPS，Application service)发布到所述BIEM，以便于所述BIEM将所述APPS整合到总应用APP中成为一个服务。
本发明实施例中，信息提供方与BIEM建立安全通道，并从BIEM申请到数字证书，然后，将自己的API和APPS发布到BIEM上，以便于BIEM公布信息提供方的API，方便授权的信息请求方通过API调用APPS，提高了信息提供方与BIEM之间数据传输效率，降低了人力成本。
还请参阅图2，图2为本发明实施例提供的一种信息提供方法的另一流程图，该实施例中，BIEM在接收到信息提供请求时，为信息提供方进行授权，分配账号，以及数字认证等操作。所述方法包括：
步骤201：黑盒子信息交换中间件BIEM接收信息提供方发送的信息提供请求；
步骤202：所述BIEM对所述信息提供请求进行授权，并为所述信息提供方创建账号；
进一步，BIEM中的SOMP在为所述信息提供方创建账号后，将所述信息提供方的IP地址添加到白名单中，以便于后续的合法验证。
步骤203：所述BIEM在接收所述信息提供方发送的申请数字证书的请求时，为所述信息提供方分配数字证书；
该步骤中，BIEM中的SKMC为该信息提供方分配数字证书。
步骤204：所述BIEM接收所述信息提供方发送的能力应用程序接口API，并允许授权信息请求方调用API；
该步骤中，BIEM中ASMP发布API，以便于授权的信息请求方调用，从而保证数据的安全传输。
步骤205：所述BIEM接收所述信息提供方发送的应用服务APPS，并将所述APPS整合到总应用APP中成为一个服务。
该步骤中，BIEM中的ASMP将接收到一个或多个信息提供方的APPS分别整合到总APP中，方便授权的信息请求方调用。
可选的，在另一实施例中，该实施例在上述图2实施例的基础上，所述方法还可以包括：BIEM接收信息请求方发送的用于请求信息提供方的信息请求；所述信息请求包括：信息请求方的数字签名；所述BIEM根据所述信息请求对所述信息请求方的合法性进行验证；所述BIEM在验证所述信息请求方合法时，将所述信息请求中的数字签名修改为自己的数字签名；所述BIEM对修改的所述信息请求进行加密，并将 加密后的所述信息请求转发给所述信息提供方；所述BIEM接收所述信息提供方发送的所述信息请求对应的服务；所述BIEM对所述服务进行加密，并将加密后的所述服务转发给所述信息请求方。其具体的实现过程详见上述图3实施例，在此不再赘述。
本发明实施例中，BIEM与信息提供方建立安全通道，并为信息提供方分配账号和数字证书，方便信息提供方传输自己的API和APPS，并发布接收到API，以便于授权的信息请求方通过API调用APPS，提高了数据传输，降低了人力成本。
还请参阅图3，图3为本发明实施例提供的一种数据传输方法的流程图，该实施例中，黑盒子信息交换中间件BIEM预先分别与授权的信息提供方与信息请求方建立安全通道。所述方法包括：
步骤301：BIEM接收信息请求方发送的用于请求信息提供方的信息请求；所述信息请求包括：信息请求方的数字签名；
所述信息请求包括还可以包括：信息提供方的IP和所述信息提供方的账号；但并不限于此，还可以适应性包括其他信息，本实施例不作限制。
步骤302：所述BIEM根据所述信息请求对所述信息请求方的合法性进行验证；
一种验证方式为：BIEM中的开放接口管理(OIMM,Open Interfaces Management Modules)模块先验证所述信息提供方的地址IP是否在授权范围内；如果正确，然后，利用数字证书验证所述账号信息是否正确；如果正确，检测所述信息请求方的数字签名是否正确，如果正确，说明该信息请求方合法；如果验证信息提供方的地址IP不正确，或者，所述账号信息不正确，或者所述数字签名不正确，均拒绝该信息请求方。
步骤303：所述BIEM在验证所述信息请求方合法时，将所述信息请求中的数字签名修改为自己的数字签名；
该步骤中，在BIEM中OIMM模块在验证该信息请求方合法时，BIEM为了方便与信息提供方通信，将信息请求中的数字签名修改为自己的数字签名，并将信息请求的格式转换成信息提供方能识别的请求格式。
步骤304：所述BIEM对修改的所述信息请求进行加密，并将加密后的所述信息请求转发给所述信息提供方；
为了保证传输信息的安全性，BIEM利用公钥对修改的所述信息请求进行加密，并将加密后的信息请求发送给信息提供方，以便于接收到该信息请求的信息提供方利用与该公钥对应的私钥解密所述信息请求。之后，信息提供方在利用公钥对所述信息请求对应的服务进行加密，并将加密后的所述服务发送给BIEM。
也就是说，信息提供方在接收到BIEM发送的信息请求后，先验证该信息请求的消息格式，以及BIEM的数字签名等信息。如果均正确后，才会将相应的服务发送给BIEM。
步骤305：所述BIEM接收所述信息提供方发送的所述信息请求对应的服务；
BIEM在接收到信息提供方发送的与所述信息请求对应的服务时，利用与所述公钥对应的私钥进行解密，得到对应的所述服务。
其中，本实施例中，对传输的数据进行加解密，对于本领域于是熟知技术，在此不再赘述。
步骤306：所述BIEM对所述服务进行加密，并将加密后的所述服务转发给所述信息请求方。
然后，BIEM将解密得到的服务，利用公钥进行加密，并将加密后的所述服务发送给信息请求方，以便于信息请求方利用与该公钥对应的私钥解密所述服务。
本发明实施例中，BIEM对接收到的请求和响应的数据进行校验，并分别利用对应的公钥加密后转发给对端，以便于对端利用对应的私钥进行解密。也就是说，BIEM只是负责数据校验和数据转发，从而保证了信息的安全性。
还请参阅图4，图4为本发明实施例提供的一种信息提供装置的结构示意图，所述装置包括：第一发送单元41，第一接收单元41，第二发送单元43，第二接收单元44，同步单元45，第三发送单元46和第四发送单元47，其中，
所述第一发送单元41，用于向黑盒子信息交换中间件BIEM发送信息提供请求；
所述第一接收单元42，用于接收所述BIEM发送的所述信息提供请求的授权信息，以及为所述信息提供方分配的账号；
所述第二发送单元43，用于向所述BIEM申请数字证书；
所述第二接收单元44，用于接收所述BIEM发送的数字证书；
所述同步单元45，用于通过LDPA接口同步第二信息提供装置的数字证书；
所述第三发送单元46，用于将能力应用程序接口API发布到所述BIEM，以便于信息请求方通过所述BIEM调用API；
所述第四发送单元47，用于将应用服务APPS发布到所述BIEM，以便于所述BIEM将所述APPS整合到总应用APP中成为一个服务。
可选的，所述信息提供装置可以集成在信息提供方的服务器中，也可以独立部署，本实施例不作限制。
还请参阅图5，图5为本发明实施例提供的一种数据传输装置的结构示意图，所述装置包括：第一接收单元51，授权单元52，第二接收单元53，分配单元54，第一发送单元55，第三接收单元56，第四接收单元57和整合单元58，其中，
所述第一接收单元51，用于接收信息提供方发送的信息提供请求；
所述授权单元52，用于对代理的所述信息提供请求进行授权，并为所述信息提供方创建账号；
所述第二接收单元53，用于接收所述信息提供方申请数字证书的请求；
所述分配单元54，用于为所述信息提供方分配数字证书；
所述第一发送单元55，用于将所述数字证书发送给所述为所述信息提供方；
所述第三接收单元56，用于接收所述信息提供方发送的能力应用程序接口API，并允许授权的信息请求方调用API；
所述第四接收单元57，用于接收所述信息提供方发送的应用服务APPS；
所述整合单元58，用于将所述APPS整合到总应用APP中成为一个服务。
可选的，在另一实施例中，为了便于后续的身份验证，所述装置还可以包括：添加单元，用于在所述授权单元为所述信息提供方创建账号后，将所述信息提供方的IP地址添加到白名单中。
可选的，在另一实施例中，该实施例在上述实施例的基础上，所述装置还可以包括：第五接收单元，验证单元，修改单元，加密单元，第二发送单元，第六接收单元和第三发送单元(图中未示)，其中，
所述第五接收单元，用于在所述整合单元将所述APPS整合到总应用APP中成为一个服务后，接收信息请求方发送的用于请求信息提供方的信息请求；所述信息请求包括：信息请求方的数字签名；
所述验证单元，用于根据所述信息请求对所述信息请求方的合法性进行验证；
所述修改单元，用于在所述验证单元验证所述信息请求方合法时，将所述信息请求中的数字签名修改为自己的数字签名；
所述加密单元，用于对所述修改单元修改后的所述信息请求进行加密；
所述第二发送单元，用于将所述加密单元加密的信息请求转发给所述信息提供方；
所述第六接收单元，用于接收所述信息提供方发送的所述信息请求对应的服务；
所述第三发送单元，用于将所述服务转发给所述信息请求方。
可选的，所述第五接收单元接收的所述信息请求还包括：信息提供方的IP和所述信息提供方的账号；所述验证单元包括：第一验证单元，第二验证单元，第三验证单元和确认单元，其中，
所述第一验证单元，用于验证所述信息提供方的地址IP是否在授权范围内；
所述第二验证单元，用于验证所述账号信息是否正确；
所述第三验证单元，用于验证所述信息请求方的数字签名是否正确；
所述确认单元，用于在所述第一验证单元验证所述IP在授权范围内，所述第二验证单元验证所述账号正确，所述第三验证单元验证所述数字签名正确时，确认所述信息请求方合法。
所述装置中各个单元的公共和作用的实现过程，详见上述方法中对应步骤的实现过程，在此不再赘述。
还请参阅图6，图6为本发明实施例一种数据传输装置的另一结构示意图，所述装置集成在黑盒子信息交换中间件BIEM中，所述装置分别与信息提供方与信息请求方建立安全通道，其中，所述装置包括：第一接收单元61，验证单元62，修改单元63，加密单元64，第一发送单元65，第二接收单元66和第二发送单元67，其中，
所述第一接收单元61，用于接收到信息请求方发送的用于请求信息提供方的信息请求；所述信息请求包括：信息请求方的数字签名；
所述验证单元62，用于根据所述信息请求对所述信息请求方的合法性进行验证；
所述修改单元63，用于在所述验证单元验证所述信息请求方合法时，将所述信息请求中的数字签名修改为自己的数字签名；
所述加密单元64，用于对所述修改单元修改后的所述信息请求进行加密；
所述第一发送单元65，用于将所述加密单元加密的信息请求转发给所述信息提供方；
所述第二接收单元66，用于接收所述信息提供方发送的所述信息请求对应的服务；
所述第二发送单元67，用于将所述服务转发给所述信息请求方。
可选的，在另一实施例中，所述第一接收单元61接收的所述信息请求还包括：信息提供方的IP和所述信息提供方的账号；
所述验证单元62包括：第一验证单元，第二验证单元，第三验证单元和确认单元(图中未示)，其中，
所述第一验证单元，用于验证所述信息提供方的地址IP是否在授权范围内；
所述第二验证单元，用于验证所述账号信息是否正确；
所述第三验证单元，用于验证所述信息请求方的数字签名是否正确；
所述确认单元，用于在第一验证单元验证所述IP在授权范围内，所述第二验证单元验证所述账号正确，所述第三验证单元验证所述数字签名正确时，确认所述信息请求方合法。
为了便于本领域技术人员的理解，下面以具体的应用实例来说明。
请参阅图7，图7为本发明实施例提供的一种BIEM系统机构的结构示意图；所述BIEM7包括：能力中间件平台CMP组件71，密钥管理中心SKMC组件72、代理服务管理平台ASMP组件73、系统操作管理平台SOMP组件74和应用程序组件75，其中，所述CMP组件71和SKMC组件72是能力层组件，而ASMP组件73和SOMP组件74是管理层组件，应用程序组件75是应用层组件，与CMP组件71、SKMC组件72、ASMP 组件73和SOMP组件74分别连接，其中，
其中，所述CMP组件71，用于为多个接入的信息请求方(机构者或第三方应用)提供安全的中间件接口；
所述SKMC组件72，用于管理和同步为授权的信息发布方提供的数字证书，机构申请数字证书；
所述ASMP组件73，用于为信息提供方(即管理者)提供服务管理功能；
所述SOMP组件74，用于为系统管理员提供系统操作和管理功能；
所述应用程序组件75，用于为所述CMP组件71、SKMC组件72、ASMP组件73和SOMP组件74处理相应的应用服务。
本发明实施例中，BIEM与信息提供方建立安全通道，并为信息提供方分配账号和数字证书，方便信息提供方传输自己的API和APPS，并发布接收到API，以便于授权的信息请求方通过API调用APPS，提高了数据传输，降低了人力成本。
可选的，所述CMP组件71包括：开放接口管理(OIMM，Open Interfaces Management Modules)模块，开放接口生成器(OIG，Open Interfaces Generator)模块，消息处理队列(MPQ，Message Processing Queue)模块，身份验证中心(AC，Authentication Center)模块，客户端能力接口(CCI，Client Capabilities Interfaces)模块和消息通信组件(MCM，Message Communication Module)模块(图中未示)，其中，
OIMM模块，用于通过HTTP/HTTPS为Agency应用程序或者第三方应用提供开放接口能力，包括请求者的身份验证、消息的合法性验证等。
OIG模块，用于通过能力模板自动转换为开放能力接口。
MPQ模块，用于负责处理来自各机构的请求，验证签名，生成的统计数据，和将请求传输到最后接收机构。
AC模块，用于负责通过HTTP/HTTPS请求从Agency机构或者第三应用通过数字身份验证机制进行身份验证。
CCI模块，用于负责提供能力接口，用于连接机构的应用程序，如注册、登录/注销、订阅取消订阅代理服务等
MCM模块，用于负责处理订阅者和Agencies机构之间的通信请求。它将为订阅服务器之间的消息通信提供了统一的框架和机构，如即时通信，自动重播，广播等。
可选的，在另一实施例中，SKMC组件72包括：注册中心(RA，Register Authority)模块，认证授权中心(CA，Certificate Authority)模块，密钥管理中心(KMC，Key Management Center)模块和在线证书状态查询(OCSP，Online Certificate Status Query)模块(图中未示)，其中，
RA模块，用于负责处理有关证书请求服务，如应用程序证书控制处理、证书应用程序审核、申请人管理等。
CA模块，用于为后端应用程序的机构与第三方应用颁发和管理(如应用、下载、刷新、冻结、注销等)证书。
KMC模块，用于负责生成和管理CA模块的加密密钥。
OCSP模块，用于负责提供证书状态的在线查询功能。
可选的，在另一实施例中，所述ASMP组件73包括：代理服务管理(ASM，Agency Service Management)模块，代理能力发布管理(ACPM，Agency Capability Publish Management)模块和帐户管理(AM，Account Management)模块(图中未示)，其中，
ASM模块，用于允许机构发布他们的自定义的web应用程序，并将各种媒体内容推送至服务订阅者。
ACPM模块，用于允许各机构以开放API形式发布自己的能力，发布他们的能力和申请调用其他机构的API。
AM模块，用于负责管理机构的帐户信息和订阅服务。
可选的，在另一实施例中，所述SOMP组件74包括：操作维护中心(OMC，Operation Maintenance Center)模块，系统统计分析(SSA，System Statistic Analysis)模块，运营支撑平台(OSP，Operation Support Platform)模块，配置管理(CM，Configuration Management)模块，系统帐户管理(SAM，System Account Management)模块(图中未示)，其中，
OMC模块，用于负责硬件和服务状态的实时监测。
SSA模块，用于负责生成的每日、每月等相关维度的关于服务统计分析报告。
OSP模块，用于提供运营支撑能力，如移动应用程序的版本管理、发送服务系统广播、查询和显示订阅服务信息等
CM模块，用于配置管理负责系统必要的全局配置数据的管理，如地区代码、机构代码等
SAM模块，用于负责为系统管理员提供对于服务程序的授权管理。
可选的，在另一实施例中，所述应用程序组件75包括：轻量目录访问协议LDAP服务模块，电子邮件接口模块，短信界面模块，文件存储模块和日志服务模块(图中未示)，其中，
LDAP服务模块，用于提供批量检索的其他机构申请证书的LDAP服务；
电子邮件接口模块，用于允许BIEM系统集成当前的邮件服务器，发送或接收机构管理员或最终用户相关的电子邮件。电子邮件接口将使用SMTP协议连接到电子邮件服务器；
短信界面模块，用于将连接SMS网关发送短信验证码登录；
文件存储模块，用于提供文件存储的临时或永久存储，如保存应用的音频剪辑/图像；
日志服务模块，用于提供的日常统计，系统定期的日志存储。
应用程序使用https协议来连接BIEM系统，完成登陆，登出等操作。
需要说明的是，上述实施例中，BIEM系统通过https协议和/或LDAP协议与外部系统进行信息交互，比如，
信息提供方(即代理机构，Agencies)和第三方后台应用将使用https协议通过BIEM完成数据信息交互。
信息提供方和第三方后台应用将使用LDAP协议连接BIEM完成证书同步操作。
BIEM还可以使用SMTP接口完成电子邮件的收发操作。
BIEM将还可以使用SMPP或者其他HTTP接口连接短信网关来完成收发短信的操作等。
还请参阅图8，图8为本发明实施例提供的一种信息提供方法的应用实例的流程，在该实施例中，以新的信息提供方或代理方加入向BIEM请求信息提供的过程，该实施例中，所述方法包括：
步骤801：代理机构(Agency)管理方(即信息提供方)通过代理机构应用(Agency Application)向ASMP组件申请应用服务；
步骤802：ASMP组件将代理管理方申请的应用服务发送给SOMP组件进行授权；
步骤803：SOMP组件对所述应用服务进行授权，并为该代理管理方分配账号，所述账号包括用户名和密码；
步骤804：SOMP组件将代理机构应用所在的服务器的IP地址添加到白名单中；
步骤805：SOMP组件将所述账号通过ASMP组件发送给代理机构应用，并由该代理机构应用显示给代理管理方；
步骤806：代理机构应用向RA/CA模块发送申请数字证书的请求；
步骤807：RA/CA模块向所述代理机构应用发送包括数字证书的响应；
步骤808：当数字证书申请成功后，代理机构应用通过LDAP服务器同步其他机构提供的数字证书。其中，同步其他机构的数字证书，就是获取其他机构的公钥，以便于在发送给对方业务请求时，利用获取对方的公钥进行加密，而接收方只有通过自己私钥才能解密。其加密方式可以采用RSA(Rivest-Shamir-Adleman public key algorithm)公用密钥算法，其加密原理对于本领域技术人员来说，已是熟知技术，在此不再赘述。
步骤809：LDAP服务器将其他应用服务的数字证书发送所述代理机构应用；
步骤810：代理机构应用将自己的能力API发送给ASMP组件；
步骤811：ASMP组件发布接收的所述能力API；
步骤812：ASMP组件通过CMP生成开放性接口，以便于其他信息请求方所在的应用服务调用；
步骤813：ASMP组件将自己的APPS发送给ASMP组件；
步骤814：ASMP组件发布所述APPS，并将所述APPS整合到总APP中的成为一个服务。
本发明实施例中，代理管理方(即信息提供方)通过代理机构应用向BIEM组件申请应用服务，并与其建立安全通道，然后从BIEM组件申请到数字证书，通过LDAP接口同步其他机构的数字证书。最后，将自己的API和APPS发布到BIEM组件上，以便于BIEM组件公布该API，方便授权的其他代理管理方(即信息请求方)通过API调用APPS，提高了信息提供方与BIEM之间数据传输效率，降低了人力成本。
还请参阅图9，图9为本发明实施例提供的一种数据传输方法的应用实例的流程，在该实施例中，信息提供方与信息请求方之间的数据交互过程，也可以称为不同的代理管理方(agencies)之间的数据传输。所述方法包括：
步骤901：代理机构应用(Agency Application)向代理机构后台服务器A(Agency A Backend server)发送具体服务操作请求；
步骤902：代理机构后台服务器A通过HTTPS接口连接BIEM；
步骤903：代理机构后台服务器A将具体服务操作请求发送给OIMM模块，以请求代理机构后台服务器B中的数据；
步骤904：OIMM模块通过AC模块先验证请求IP地址是否在授权范围内，如果在授权范围内，检查请求的消息格式；
步骤905：OIMM模块通过MPQ模块使用HTTP数字证书来验证代理机构应用(agency)的账号信息；
步骤906：OIMM模块通过OCSP模块继续检查代理机构后台服务器A的数字签名是否正确；
该步骤中，在MPQ模块验证该账号信息正确时，通过OCSP模块继续检查代理机构后台服务器A的数字签名是否正确，如果正确，则确MPQ认代理机构后台服务器A的身份合法。否则，MPQ确认代理机构后台服务器A的身份不合法。
步骤907：当验证通过后，BIEM组件中的MPQ模块将会生成一条原始记录，以便以后进行统计。
步骤908：BIEM中OIMM模块将具体服务操作请求中的数字签名替换为自己的数字签名；
步骤909：OIMM模块把修改后的具体服务操作请求转发到代理机构后台服务器B(Agency B Backengd server)；
步骤910：代理机构后台服务器B收到该具体服务操作请求后，验证该具体服务操作请求的消息格式，BIEM的数字签名等信息；
步骤911：代理机构后台服务器B根据具体服务操作请求生成返回结构信息；
步骤912：代理机构后台服务器B将包括生成的结构信息的响应发送给OIMM；
步骤913：OIMM将包括所述结构信息的响应通过HTTPS接口发送给代理机构后台服务器A；
步骤914：代理机构后台服务器A验证所述响应中BIEM的数字签名，如果正确，能得到所述结构信息；
步骤915：代理机构后台服务器A将所述结构信息发送给所述代理管理方。
需要说明的是，在该实施例中，请求和响应的数据都会在传输过程中进行加密，消息内容只能被接收方通过自己的私钥进行解密，BIEM只是负责数据校验和数据流转，并生成统计数据，对于消息内容BIEM没有能力进行解密，从而保证了信息传输的安全性。
本实施例中，信息提供方对请求数据加密、响应数据加密，以及解密过程，对于本领域技术人员来说，已是熟知技术，在此不再赘述。
BIEM侧对传输数据加解和解密过程，对于本领域技术人员来说，已是熟知技术，在此不再赘述。
本发明实施例还提供一种服务器，所述服务器包括：
收发器，用于接收信息提供方发送的信息提供请求；
处理器，用于对所述信息提供请求进行授权，并为所述信息提供方创建账号；
所述收发器，还用于接收所述信息提供方发送的申请数字证书的请求；
所述处理器，还用于为所述信息提供方分配数字证书；
所述收发器，还用于接收所述信息提供方发送的能力应用程序接口API，并允许授权的信息请求方调用API；
所述收发器，还用于接收所述信息提供方发送的应用服务APPS；
所述处理器，还用于将所述APPS整合到总应用APP中成为一个服务。
可选的，所述处理器，还用于在为所述信息提供方创建账号后，将所述信息提供方的地址添加到白名单中。
可选的，所述收发器，还用于接收信息请求方发送的用于请求信息提供方的信息请求；所述信息请求包括：信息请求方的数字签名；
所述处理器，还用于根据所述信息请求对所述信息请求方的合法性进行验证； 并在验证所述信息请求方合法时，将所述信息请求中的数字签名修改为自己的数字签名；以及对修改的所述信息请求进行加密；
所述收发器，还用于将加密后的所述信息请求转发给所述信息提供方；以及接收所述信息提供方发送的所述信息请求对应的服务；
所述处理器，还用于对所述服务进行加密；
所述收发器，还用于将加密后的所述服务转发给所述信息请求方。
可选的，所述收发器接收到的所述信息请求还包括：信息提供方的IP和所述信息提供方的账号；
所述处理器对所述信息请求方的合法性进行验证，包括：验证所述信息提供方的地址IP是否在授权范围内；以及验证所述账号信息是否正确；验证所述信息请求方的数字签名是否正确；如果所述IP在授权范围内，所述账号正确，所述数字签名正确，则确认所述信息请求方合法。
可选的，本发明实施例还提供一种服务器，所述服务器包括：
收发器，用于向黑盒子信息交换中间件BIEM发送信息提供请求；并接收所述BIEM发送的所述信息提供请求的授权信息
处理器，用于为所述信息提供方分配账号；
所述收发器，还用于向所述BIEM申请数字证书的请求；以及接收所述BIEM发送包括数字证书的响应；
所述收发器，还用于通过轻量目录访问协议LDPA接口同步第二信息提供方的数字证书；以及方将能力应用程序接口API发布到所述BIEM，以便于信息请求方通过所述BIEM调用所述API；以及将应用服务APPS发布到所述BIEM；以便于所述APPS整合到总应用APP中成为一个服务。
图10所示，本发明还提供了一种基于计算机系统实现的数据处理装置，具体实现中，该数据处理装置可以包括：处理器1701、存储器1702和总线1703；处理器1701与存储器1702通过总线1703相互连接；其中，存储器1702，用于存储计算机执行指令；处理器1701，用于执行所述存储器1702存储的所述计算机执行指令，向黑盒子信息交换中间件BIEM发送信息提供请求；接收所述BIEM发送的所述信息提供请求的授权信息，以及为所述信息提供方分配账号；向所述BIEM申请数字证书的请求；接收所述BIEM发送包括数字证书的响应；通过LDPA接口同步所述数字证书；将能力应用程序接口API发布到所述BIEM，以便于信息请求方通过所述BIEM调用API；将应用服务APPS发布到所述BIEM，以便于所述BIEM将所述APPS整合到总应用APP中成为一个服务。或者
所述处理器1701，用于接收授权的信息请求方发送的用于请求授权的信息提供 方的信息请求；所述信息请求包括：信息请求方的数字签名；根据所述信息请求对所述信息请求方的合法性进行验证；在验证所述信息请求方合法时，将所述信息请求中的数字签名修改为自己的数字签名；对修改的所述信息请求进行加密，并将加密后的所述信息请求转发给所述信息提供方；接收所述信息提供方发送的所述信息请求对应的服务；对所述服务进行加密，并将加密后的所述服务转发给所述信息请求方。
具体实现中，上述处理器可以是中央处理器(CPU,central processing unit)、专用集成电路(ASIC，applicatI/On-specific integrated circuit,)等。计算机存储介质可存储有程序，该程序执行时可包括本发明实施例提供的数据传输的方法的各实施例中的部分或全部步骤。所述的存储介质可为磁碟、光盘、只读存储记忆体(ROM，Read-Only Memory)或随机存储记忆体(RAM，Random Access Memory)等。
需要说明的是，在本文中，诸如第一和第二等之类的关系术语仅仅用来将一个实体或者操作与另一个实体或操作区分开来，而不一定要求或者暗示这些实体或操作之间存在任何这种实际的关系或者顺序。而且，术语“包括”、“包含”或者其任何其他变体意在涵盖非排他性的包含，从而使得包括一系列要素的过程、方法、物品或者设备不仅包括那些要素，而且还包括没有明确列出的其他要素，或者是还包括为这种过程、方法、物品或者设备所固有的要素。在没有更多限制的情况下，由语句“包括一个……”限定的要素，并不排除在包括所述要素的过程、方法、物品或者设备中还存在另外的相同要素。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到本发明可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品可以存储在存储介质中，如ROM/RAM、磁碟、光盘等，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例或者实施例的某些部分所述的方法。
以上所述仅是本发明的优选实施方式，应当指出，对于本技术领域的普通技术人员来说，在不脱离本发明原理的前提下，还可以作出若干改进和润饰，这些改进和润饰也应视为本发明的保护范围。

Claims (10)

  1. 一种数据传输方法，其特征在于，包括：
    黑盒子信息交换中间件BIEM接收信息提供方发送的信息提供请求；
    所述BIEM对所述信息提供请求进行授权，并为所述信息提供方创建账号；
    所述BIEM在接收所述信息提供方发送的申请数字证书的请求时，为所述信息提供方分配数字证书；
    所述BIEM接收所述信息提供方发送的能力应用程序接口API，并允许授权的信息请求方调用API；
    所述BIEM接收所述信息提供方发送的应用服务APPS，并将所述APPS整合到总应用APP中成为一个服务。
  2. 根据权利要求1所述的方法，其特征在于，还包括：
    在为所述信息提供方创建账号后，将所述信息提供方的地址添加到白名单中。
  3. 根据权利要求1或2所述的方法，其特征在于，还包括：
    BIEM接收信息请求方发送的用于请求信息提供方的信息请求；所述信息请求包括：信息请求方的数字签名；
    所述BIEM根据所述信息请求对所述信息请求方的合法性进行验证；
    所述BIEM在验证所述信息请求方合法时，将所述信息请求中的数字签名修改为自己的数字签名；
    所述BIEM对修改的所述信息请求进行加密，并将加密后的所述信息请求转发给所述信息提供方；
    所述BIEM接收所述信息提供方发送的所述信息请求对应的服务；
    所述BIEM对所述服务进行加密，并将加密后的所述服务转发给所述信息请求方。
  4. 根据权利要求3所述的方法，其特征在于，所述信息请求还包括：信息提供方的IP和所述信息提供方的账号；
    所述BIEM根据所述信息请求对所述信息请求方的合法性进行验证，包括：
    验证所述信息提供方的地址IP是否在授权范围内；以及验证所述账号信息是否正确；验证所述信息请求方的数字签名是否正确；
    如果所述IP在授权范围内，所述账号正确，所述数字签名正确，则确认所述信息请求方合法。
  5. 一种信息提供方法，其特征在于，包括：
    信息提供方向黑盒子信息交换中间件BIEM发送信息提供请求；
    所述信息提供方接收所述BIEM发送的所述信息提供请求的授权信息，以及为所述信息提供方分配账号；
    所述信息提供方向所述BIEM申请数字证书的请求；
    所述信息提供方接收所述BIEM发送包括数字证书的响应；
    所述信息提供方通过轻量目录访问协议LDPA接口同步第二信息提供方的数字证书；
    所述信息提供方将能力应用程序接口API发布到所述BIEM，以便于信息请求方通过所述BIEM调用所述API；
    所述信息提供方将应用服务APPS发布到所述BIEM，以便于所述BIEM将所述APPS整合到总应用APP中成为一个服务。
  6. 一种数据传输装置，其特征在于，包括：
    第一接收单元，用于接收信息提供方发送的信息提供请求；
    授权单元，用于对代理的所述信息提供请求进行授权，并为所述信息提供方创建账号；
    第二接收单元，用于接收所述信息提供方发送的申请数字证书的请求；
    分配单元，用于为所述信息提供方分配数字证书；
    第一发送单元，用于将所述数字证书发送给所述为所述信息提供方；
    第三接收单元，用于接收所述信息提供方发送的能力应用程序接口API，并允许授权的信息请求方调用API；
    第四接收单元，用于接收所述信息提供方发送的应用服务APPS；
    整合单元，用于将所述APPS整合到总应用APP中成为一个服务。
  7. 根据权利要求6所述的装置，其特征在于，还包括：
    添加单元，用于在所述授权单元为所述信息提供方创建账号后，将所述信息提供方的地址添加到白名单中。
  8. 根据权利要求6或7所述的装置，其特征在于，还包括：
    第五接收单元，用于接收信息请求方发送的用于请求信息提供方的信息请求；所述信息请求包括：信息请求方的数字签名；
    验证单元，用于根据所述信息请求对所述信息请求方的合法性进行验证；
    修改单元，用于在所述验证单元验证所述信息请求方合法时，将所述信息请 求中的数字签名修改为自己的数字签名；
    加密单元，用于对所述修改单元修改后的所述信息请求进行加密；
    第二发送单元，用于将所述加密单元加密的信息请求转发给所述信息提供方；
    第六接收单元，用于接收所述信息提供方发送的所述信息请求对应的服务；
    第三发送单元，用于将所述服务转发给所述信息请求方。
  9. 根据权利要求8所述的装置，其特征在于，所述第五接收单元接收的所述信息请求还包括：信息提供方的IP和所述信息提供方的账号；
    所述验证单元包括：
    第一验证单元，用于验证所述信息提供方的地址IP是否在授权范围内；
    第二验证单元，用于验证所述账号信息是否正确；
    第三验证单元，用于验证所述信息请求方的数字签名是否正确；
    确认单元，用于在所述第一验证单元验证所述IP在授权范围内，所述第二验证单元验证所述账号正确，所述第三验证单元验证所述数字签名正确时，确认所述信息请求方合法。
  10. 一种信息提供装置，其特征在于，包括：
    第一发送单元，用于向黑盒子信息交换中间件BIEM发送信息提供请求；
    第一接收单元，用于接收所述BIEM发送的所述信息提供请求的授权信息，以及为所述信息提供方分配的账号；
    第二发送单元，用于向所述BIEM申请数字证书；
    第二接收单元，用于接收所述BIEM发送的数字证书；
    同步单元，用于通过轻量目录访问协议LDPA接口同步第二信息提供装置的数字证书；
    第三发送单元，用于将能力应用程序接口API发布到所述BIEM，以便于信息请求方通过所述BIEM调用所述API；
    第四发送单元，用于将应用服务APPS发布到所述BIEM，以便于所述BIEM将所述APPS整合到总应用APP中成为一个服务。
PCT/CN2014/091580 2014-11-19 2014-11-19 一种信息提供方法、数据传输方法及装置 WO2016078024A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/CN2014/091580 WO2016078024A1 (zh) 2014-11-19 2014-11-19 一种信息提供方法、数据传输方法及装置

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2014/091580 WO2016078024A1 (zh) 2014-11-19 2014-11-19 一种信息提供方法、数据传输方法及装置

Publications (1)

Publication Number Publication Date
WO2016078024A1 true WO2016078024A1 (zh) 2016-05-26

Family

ID=56013063

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/091580 WO2016078024A1 (zh) 2014-11-19 2014-11-19 一种信息提供方法、数据传输方法及装置

Country Status (1)

Country Link
WO (1) WO2016078024A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101841569A (zh) * 2010-05-17 2010-09-22 成都中联信通科技有限公司 一种基于web技术实现跨平台的手机支付方法
CN101969475A (zh) * 2010-11-15 2011-02-09 张军 基于云计算的商业数据可控分发与融合应用系统
CN103152336A (zh) * 2013-02-22 2013-06-12 浪潮电子信息产业股份有限公司 一种云计算环境下的分布式授权认证方法
CN103197928A (zh) * 2013-03-08 2013-07-10 南京航空航天大学 面向离散制造车间的rfid中间件的实现方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101841569A (zh) * 2010-05-17 2010-09-22 成都中联信通科技有限公司 一种基于web技术实现跨平台的手机支付方法
CN101969475A (zh) * 2010-11-15 2011-02-09 张军 基于云计算的商业数据可控分发与融合应用系统
CN103152336A (zh) * 2013-02-22 2013-06-12 浪潮电子信息产业股份有限公司 一种云计算环境下的分布式授权认证方法
CN103197928A (zh) * 2013-03-08 2013-07-10 南京航空航天大学 面向离散制造车间的rfid中间件的实现方法

Similar Documents

Publication Publication Date Title
US9716696B2 (en) Encryption in the cloud using enterprise managed keys
US11716207B1 (en) System and method for a dynamic-PKI for a social certificate authority
US7716467B1 (en) Encryption gateway service
US10523646B2 (en) Methods and systems for distributing encrypted cryptographic data
US9137017B2 (en) Key recovery mechanism
US9930028B2 (en) Method to enroll a certificate to a device using SCEP and respective management application
WO2017133558A1 (zh) 一种消息加密、解密方法和装置
CN101299753B (zh) 具有web服务安全控制机制的代理服务器
AU2016369606A1 (en) Systems and methods for secure multi-party communications using a proxy
JP2022522788A (ja) ブロックチェーンベースのセキュアな電子メールシステム
US8117438B1 (en) Method and apparatus for providing secure messaging service certificate registration
US20050144439A1 (en) System and method of managing encryption key management system for mobile terminals
GB2568966A (en) An encryption process
KR20060100920A (ko) 웹 서비스를 위한 신뢰되는 제3자 인증
US20180145837A1 (en) Establishing a secure connection across secured environments
WO2019178942A1 (zh) 一种进行ssl握手的方法和系统
CN104348870A (zh) 基于可信时间戳的云存储系统的数据管理方法和系统
US10015144B2 (en) Method and system for protecting data using data passports
WO2010025638A1 (zh) 点对点直播流传递的方法、装置及系统
US10158610B2 (en) Secure application communication system
US11611541B2 (en) Secure method to replicate on-premise secrets in a cloud environment
CN106713338A (zh) 一种基于服务器硬件信息的长连接隧道建立方法
US20130291078A1 (en) Secure Distribution of Non-Privileged Authentication Credentials
CN115118426A (zh) 区块链系统的数据处理方法、装置、设备及存储介质
WO2016078024A1 (zh) 一种信息提供方法、数据传输方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14906485

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 14906485

Country of ref document: EP

Kind code of ref document: A1