WO2020102974A1

WO2020102974A1 - Data access method, data access apparatus, and mobile terminal

Info

Publication number: WO2020102974A1
Application number: PCT/CN2018/116434
Authority: WO
Inventors: 杨阳; 郑忠
Original assignee: 深圳市欢太科技有限公司; Oppo广东移动通信有限公司
Priority date: 2018-11-20
Filing date: 2018-11-20
Publication date: 2020-05-28
Also published as: CN112823503B; CN112823503A

Abstract

A data access method, a data access apparatus, a mobile terminal, and a computer-readable storage medium. The data access method comprises: receiving a data access request, the data access request comprising first metadata and an encrypted access token, the access token comprising second metadata (S11); decrypting said access token (S12); if said access token is successfully decrypted, obtaining the second metadata comprised in the access token (S13); and selecting, according to the second metadata and the first metadata, whether to respond to the data access request (S14). The method can ensure the security of private information of a client.

Description

Data access method, data access device and mobile terminal

Technical field

The present application belongs to the field of information processing technology, and particularly relates to a data access method, a data access device, a mobile terminal, and a computer-readable storage medium.

Background technique

The open authentication application program interface (OAuth, An open protocol to allow secure API authorization) in a simple and standard method from desktop applications and web application standards is a third-party application program interface (API) authentication authorization access protocol. Let the client expose the private information saved by the client to a third-party application without exposing the client key.

Summary of the invention

This application provides a data access method, a data access device, a mobile terminal, and a computer-readable storage medium, which can improve the security of private information transmission.

The first aspect of the present application provides a data access method, including:

Receiving a data access request, the data access request includes first metadata and an encrypted access token, and the access token includes second metadata;

Decrypt the encrypted access token;

If the encrypted access token is successfully decrypted, obtain the second metadata included in the access token;

Select whether to respond to the data access request according to the second metadata and the first metadata.

In a first possible implementation manner based on the first aspect, the data access request further includes a key used to encrypt the access token after being encrypted using a public key;

Correspondingly, the decrypting the encrypted access token includes:

Using a preset private key to decrypt the key used to encrypt the access token after being encrypted using the public key;

If the key used to encrypt the access token is decrypted, the encrypted access token is decrypted according to the decrypted key.

In a second possible implementation based on the first possible implementation of the first aspect, if the key used to encrypt the access token is not decrypted, the latest public key private key pair in the system is obtained And return the public key in the public key private key pair to the client.

In a third possible implementation manner based on the first aspect, the second metadata includes a second clear text check value, and then if the encrypted access token is successfully decrypted, the access order is obtained The second metadata included in the card is:

If the encrypted access token is successfully decrypted, obtain the second clear text check value included in the access token;

Correspondingly, the selection of whether to respond to the data access request according to the second metadata and the first metadata is specifically:

Comparing the second clear text check value with the first clear text check value corresponding to the first metadata, and if the second clear text check value is the same as the first clear text check value, responding to the data In the access request, if the second clear text check value is different from the first clear text check value, the data access request is identified as illegal access.

In a fourth possible implementation based on the third possible implementation of the first aspect, where the second metadata includes the terminal identification, if the encrypted access token is successfully decrypted, the The second metadata included in the access token is specifically:

If the encrypted access token is successfully decrypted, obtain the terminal identification included in the access token;

Correspondingly, the data access method further includes:

Judging whether the terminal identification is a legal terminal identification, and when the terminal identification is an illegal terminal identification, identifying the data access request as illegal access.

In a fifth possible implementation based on the fourth possible implementation of the first aspect, the selection of whether to respond to the data access request according to the second metadata and the first metadata is specifically: :

If the terminal identifier is a legal terminal identifier, compare the second plain text check value with the first plain text check value corresponding to the first metadata, and if the second plain text check value is equal to the first A clear text verification value is the same, and in response to the data access request, if the second clear text verification value is different from the first clear text verification value, the data access request is identified as illegal access.

In a sixth possible implementation manner based on the third possible implementation manner of the first aspect, the second metadata further includes a second ciphertext verification value, and the data access request includes the subject ciphertext, Then, if the encrypted access token is successfully decrypted, acquiring the second metadata included in the access token is specifically:

If the encrypted access token is successfully decrypted, obtain the second ciphertext verification value included in the access token;

Correspondingly, if the second clear text check value is the same as the first clear text check value, responding to the data access request is specifically:

If the second clear text check value is the same as the first clear text check value, compare the first cipher text check value corresponding to the subject cipher text with the second cipher text check value, The first ciphertext verification value is the same as the second ciphertext verification value, and responds to the data access request.

In a seventh possible implementation based on the third possible implementation of the first aspect, the second metadata further includes a second timestamp, then if the encrypted access order is successfully decrypted Card, and obtaining the second metadata included in the access token is specifically:

If the encrypted access token is successfully decrypted, obtain the second time stamp included in the access token;

If the second clear text check value is the same as the first clear text check value, obtain the first time stamp of the server itself, and if the difference between the second time stamp and the first time stamp is less than or equal to The preset time difference value responds to the data access request.

In an eighth possible implementation manner based on the seventh possible implementation manner of the first aspect, the data access method further includes:

If the difference between the second time stamp and the first time stamp is greater than the preset time difference, a current limiting operation is performed on the data access request.

In a ninth possible implementation manner based on the third possible implementation manner of the first aspect, the second metadata further includes a second time stamp and a second ciphertext verification value, and the data access request Including the main body ciphertext, if the encrypted access token is successfully decrypted, acquiring the second metadata included in the access token is specifically:

If the encrypted access token is successfully decrypted, obtain the second time stamp and the second ciphertext verification value included in the access token;

If the second clear text check value is the same as the first clear text check value, obtain the first time stamp of the server itself, and if the difference between the second time stamp and the first time stamp is less than or equal to Preset a time difference, compare the first ciphertext check value corresponding to the subject ciphertext with the second ciphertext check value, if the first ciphertext check value and the second ciphertext The verification value is the same and responds to the data access request.

The second aspect of the present application provides a data access device, including:

A first data access request receiving unit, configured to receive a data access request, where the data access request includes first metadata and an encrypted access token, and the access token includes second metadata;

An access token decryption unit, used to decrypt the encrypted access token;

A second metadata acquisition unit for acquiring the second metadata included in the access token if the encrypted access token is successfully decrypted;

The data access request selection response unit is configured to select whether to respond to the data access request based on the second metadata and the first metadata.

A third aspect of the present application provides a mobile terminal, including a memory, a processor, and a computer program stored in the memory and executable on the processor. The processor implements the computer program as follows step:

Decrypt the encrypted access token;

In a first possible implementation manner based on the third aspect, the data access request further includes a key used to encrypt the access token after being encrypted using a public key, and correspondingly, the decrypting the encryption Later access tokens include:

In the second possible implementation based on the first possible implementation of the third aspect, if the key used to encrypt the access token is not decrypted, the latest public key private key pair in the system is obtained, And return the public key in the public key private key pair to the client.

In a third possible implementation manner based on the third aspect, the second metadata includes a second clear text check value, and if the encrypted access token is successfully decrypted, the access token is obtained The included second metadata is specifically:

In a fourth possible implementation based on the third possible implementation of the third aspect, the second metadata includes a terminal identification, and if the encrypted access token is successfully decrypted, the The second metadata included in the access token is specifically:

Correspondingly, the processor also implements the following steps when executing the computer program:

According to a fifth possible implementation manner based on the fourth possible implementation manner of the third aspect, the selection of whether to respond to the data access request according to the second metadata and the first metadata specifically includes:

In a sixth possible implementation manner based on the third possible implementation manner in the third aspect, the second metadata further includes a second ciphertext verification value, and the data access request includes the subject ciphertext, then If the encrypted access token is successfully decrypted, obtaining the second metadata included in the access token is specifically:

If the second clear text check value is the same as the first clear text check value, compare the first cipher text check value corresponding to the subject cipher text with the second cipher text check value, if the The first ciphertext verification value is the same as the second ciphertext verification value, and responds to the data access request.

According to a seventh possible implementation manner based on the third possible implementation manner of the third aspect, the second metadata further includes a second time stamp, and then if the encrypted access token is successfully decrypted , Obtaining the second metadata included in the access token is specifically:

A fourth aspect of the present application provides a computer-readable storage medium that stores a computer program, and when the computer program is executed by a processor, implements the steps of the data access method.

BRIEF DESCRIPTION

In order to more clearly explain the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings required in the embodiments or the description of the prior art. Obviously, the drawings in the following description are only for the application For some embodiments, those of ordinary skill in the art can obtain other drawings based on these drawings without paying any creative labor.

FIG. 1 is a schematic flowchart of a data access method according to Embodiment 1 of the present application;

2 is a schematic flowchart of another data access method according to Embodiment 2 of the present application;

3 is a schematic structural diagram of a data access device according to Embodiment 3 of the present application;

4 is a schematic structural diagram of another data access device according to Embodiment 4 of the present application;

5 is a schematic diagram of a mobile terminal provided in Embodiment 5 of the present application.

detailed description

In the following description, for the purpose of illustration rather than limitation, specific details such as specific system structure and technology are proposed to thoroughly understand the embodiments of the present application. However, those skilled in the art should understand that the present application can also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to avoid unnecessary details hindering the description of the present application.

In order to explain the above technical solutions of the present application, the following will be described by specific embodiments.

Example one:

The following describes a data access method provided by an embodiment of the present application. Referring to FIG. 1, the data access method in the embodiment of the present application includes:

Step S11: Receive a data access request, where the data access request includes first metadata and an encrypted access token, and the access token includes second metadata;

In this embodiment, if the client accesses a scenario that does not require a login account but needs to transmit private content, such as transmission through a digital envelope, a data access request is sent to the server, and the sent data access request includes the encrypted access Token, the client constructs the access token according to the second metadata. In some embodiments, the second metadata is constructed based on the first metadata. When there are multiple first metadata, the second metadata may be constructed based on part or all of the first metadata. In some embodiments, the first metadata may be metadata corresponding to plain text or metadata corresponding to cipher text, and the first metadata may be selected to be transmitted in plain text.

In some embodiments, the data access request includes a key used to encrypt the access token. In this embodiment, in order to improve the security of the transmitted access token, the access token needs to be encrypted before transmission, for example, using a symmetric encryption algorithm to encrypt,

Step S12, decrypt the encrypted access token;

In this embodiment, the server decrypts the access token included in the received data access request according to a protocol negotiated with the client in advance. In the preset protocol negotiated with the client, a decryption algorithm for decrypting the access token is set. In some embodiments, if the data access request includes a key for encrypting the access token, the server decrypts the encrypted access token according to the decryption algorithm in the protocol negotiated with the client and the key .

Step S13: If the encrypted access token is successfully decrypted, obtain the second metadata included in the access token;

In this embodiment, if the decryption algorithm matches the key, the encrypted access token can be successfully decrypted.

Step S14: Select whether to respond to the data access request according to the second metadata and the first metadata.

In this step, if the second metadata and the first metadata include information of the same attribute, for example, if both the second metadata and the first metadata include a check value, then select whether the check value is the same In response to the data access request, if the verification values are the same, it responds to the data access request, such as feeding back data corresponding to the data access request to the client. Otherwise, it does not respond to the data access request.

In the embodiment of the present application, after receiving the data access request including the first metadata and the encrypted access token, the encrypted access token is decrypted. If the encrypted access token is successfully decrypted, the The second metadata included in the access token selects whether to respond to the data access request according to the second metadata and the first metadata. Since the data access request includes the encrypted access token, the server only chooses whether to respond to the received data access request after decrypting the access token and comparing the second metadata with the first metadata, that is, because A selection process is added to ensure the security of the client ’s private information without requiring the client ’s key.

Example 2:

In order to enhance the transmission security of the key used to encrypt the access token, before transmitting the key used to encrypt the access token, the public key is used to encrypt the key used to encrypt the access token, as shown in Figure 2 As shown:

Step S21: Receive a data access request, where the data access request includes first metadata, an encrypted access token, and a public key to encrypt the key used to encrypt the access token. The access token includes Second metadata

Step S22, using a preset private key to decrypt the key used to encrypt the access token after being encrypted using the public key;

Specifically, in a preset protocol negotiated with the client, a decryption algorithm used to decrypt the access token and a private key used to decrypt the encrypted key used to encrypt the access token are set. The server decrypts the key used to encrypt the access token after being encrypted by the public key according to the private key. If the client's public key is correct, the server can decrypt the key used to encrypt the access token based on the preset private key.

In step S23, if the key used to encrypt the access token is decrypted, the encrypted access token is decrypted according to the decrypted key.

Step S24: If the encrypted access token is successfully decrypted, obtain the second metadata included in the access token;

Step S25: Select whether to respond to the data access request according to the second metadata and the first metadata.

Among them, step S24 and step S25 are the same as step S13 and step S14 of the first embodiment, and will not be repeated here.

In some embodiments, in order to improve the success rate of decrypting the key, if the key used to encrypt the access token is not decrypted, the latest public key private key pair in the system is obtained, and the public key The public key in the private key pair is returned to the client. It should be pointed out that the client here refers to a legitimate client recorded by the server, which is not necessarily the client that sends the current data access request, so as to avoid sending the public key to the illegal client.

In some embodiments, the second metadata includes a second clear text check value, then the step S13 (or step S24) is specifically:

Correspondingly, the step S14 (or step S25) is specifically:

The first clear text check value can be directly in the first metadata, that is, the first clear text check value can be sent by sending the first metadata; in addition, the first clear text check value can also be determined by subsequent calculations For example, when the first metadata includes only plaintext metadata, after receiving the plaintext metadata, the server calculates the first plaintext check value corresponding to the first metadata according to the plaintext metadata.

In some embodiments, the second metadata includes the second terminal identifier, then the step S13 (or step S24) is specifically:

Correspondingly, the data access method further includes:

Judging whether the terminal identification is a legal terminal identification, and when the terminal identification is an illegal terminal identification, identifying the data access request as illegal access. Specifically, the terminal identifier corresponding to the client that sends the data access request is obtained. If the terminal identifier corresponding to the obtained client is the same as the terminal identifier obtained from the access token, it is determined that the terminal identifier is a legal terminal identifier, otherwise, It is determined that the terminal identification is an illegal terminal identification. Or, the server pre-stores a legal terminal ID, if the terminal ID obtained from the access token is the same as any stored terminal ID, the terminal ID is determined to be a legal terminal ID, otherwise, the terminal ID is determined to be illegal Terminal identification.

If the terminal identifier is a legal terminal identifier, the second plaintext check value is further compared with the first plaintext check value corresponding to the first metadata, and if the second plain text check value is The first clear text verification value is the same, and in response to the data access request, if the second clear text verification value is different from the first clear text verification value, the data access request is identified as illegal access. Judging whether to respond to the data access request by the terminal identification and the clear text verification value can further improve the accuracy of the judgment result, and thus can ensure the security of the client's private data.

In order to further improve the security of private information, in some embodiments, after verifying that the terminal identification is a legal terminal identification, it is verified whether the frequency of client access corresponding to the terminal identification is legal. The corresponding access current limit, if legal, compares the second clear text check value with the first clear text check value corresponding to the first metadata, if the second clear text check value is equal to the first clear text The verification value is the same, and in response to the data access request, if the second plaintext verification value is different from the first plaintext verification value, the data access request is identified as illegal access.

In some embodiments, the second metadata further includes a second ciphertext verification value, and the data access request includes the subject ciphertext, then the step S13 (or step S24) is specifically:

In this step, after decrypting the access token, in addition to acquiring the second cipher text verification value, the second clear text verification value may also be acquired.

If the second clear text check value is different from the first clear text check value, the data access request is identified as illegal access.

Of course, if the second metadata includes a second clear text check value, a second cipher text check value, and a terminal identifier, then step S13 (or step S24) is specifically:

If the encrypted access token is successfully decrypted, obtain the second clear text verification value, the second cipher text verification value, and the terminal identification included in the access token;

After this step, the following steps are performed: judging whether the terminal identification is a legal terminal identification;

If the terminal identifier is a legal terminal identifier, compare the second plain text check value with the first plain text check value corresponding to the first metadata, and if the second plain text check value is equal to the first A plaintext check value is the same, compare the first ciphertext check value corresponding to the subject ciphertext with the second ciphertext check value, if the first ciphertext check value is equal to the second ciphertext The text verification value is the same and responds to the data access request.

In order to improve the robustness against replay attacks, the validity time of the access token can be set, and the validity time is reflected by the second time stamp. At this time, the second metadata includes a second time stamp, and the step S13 (or step S24) is specifically:

In some embodiments, the data access method further includes:

In some embodiments, the second metadata further includes a second timestamp and a second ciphertext verification value, and the data access request includes the subject ciphertext, then the step S13 (or step S24) is specifically:

In some embodiments, if the second metadata includes: a terminal identifier, a second time stamp, a second clear text check value, and a second cipher text check value, and the data access request includes the subject cipher text, then The step S13 (or step S24) is specifically as follows:

If the encrypted access token is successfully decrypted, obtain the terminal identifier, second time stamp, second clear text check value, and second cipher text check value included in the access token;

If the terminal identification is a legal terminal identification, obtain the first time stamp of the service party itself, and if the difference between the second time stamp and the first time stamp is less than or equal to a preset time difference, the The second clear text check value is compared with the first clear text check value corresponding to the first metadata, and if the second clear text check value is the same as the first clear text check value, the subject cipher text is mapped Compares the first ciphertext verification value with the second ciphertext verification value, and responds to the data access request if the first ciphertext verification value is the same as the second ciphertext verification value.

If the terminal ID is a legal terminal ID, verify whether the client's access frequency corresponding to the terminal ID is legal, and if the client's access frequency corresponding to the terminal ID is legal, obtain the first time stamp of the server itself. The difference between the second time stamp and the first time stamp is less than or equal to a preset time difference, and the second clear text check value is compared with the first clear text check value corresponding to the first metadata, If the second clear text check value is the same as the first clear text check value, compare the first cipher text check value corresponding to the subject cipher text with the second cipher text check value, if the The first ciphertext verification value is the same as the second ciphertext verification value, and responds to the data access request.

It should be understood that the size of the sequence numbers of the steps in the above embodiments does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

Example Three

Corresponding to the first embodiment, the third embodiment of the present application provides a data access device. The above data access device may be integrated into a mobile terminal. As shown in FIG. 3, the data access device 3 in the embodiment of the present application includes:

The data access request receiving unit 31 is configured to receive a data access request, where the data access request includes first metadata and an encrypted access token, and the access token includes second metadata;

In some embodiments, the second metadata is constructed based on the first metadata. When there are multiple first metadata, the second metadata may be constructed based on part or all of the first metadata. In some embodiments, the first metadata may be metadata corresponding to plain text or metadata corresponding to cipher text, and the first metadata may optionally be transmitted in plain text.

In some embodiments, the data access request includes a key used to encrypt the access token.

The access token decryption unit 32 is used to decrypt the encrypted access token;

The second metadata obtaining unit 33 is configured to obtain the second metadata included in the access token if the encrypted access token is successfully decrypted;

The data access request selection response unit 34 is configured to select whether to respond to the data access request based on the second metadata and the first metadata.

In the embodiment of the present application, since the data access request includes the encrypted access token, the server will only choose whether to respond to the received after decrypting the access token and comparing the second metadata with the first metadata The data access request, that is, due to the addition of a selection process, can ensure the security of the client's private information without requiring the client's key.

Example 4

Corresponding to the second embodiment, the fourth embodiment of the present application provides another data access device. The above data access device may be integrated into a mobile terminal. As shown in FIG. 4, the data access device 4 in the embodiment of the present application includes:

The data access request receiving unit 41 is configured to receive a data access request including first metadata, an encrypted access token, and a public key to encrypt the key used to encrypt the access token, The access token includes second metadata;

The key decryption unit 42 is used to decrypt the key used to encrypt the access token after being encrypted using the public key by using a preset private key;

The access token decrypting unit 43 is configured to decrypt the encrypted access token according to the decrypted key if the key used to encrypt the access token is decrypted.

The second metadata obtaining unit 44 is configured to obtain second metadata included in the access token if the encrypted access token is successfully decrypted;

The data access request selection response unit 45 is configured to select whether to respond to the data access request based on the second metadata and the first metadata.

In some embodiments, in order to increase the success rate of decrypting the key, the data access device 4 further includes:

The public key sending unit is used to obtain the latest public key private key pair in the system if the key used to encrypt the access token is not decrypted, and return the public key in the public key private key pair to the customer end.

It should be pointed out that the client here refers to a legitimate client recorded by the server, which is not necessarily the client that sends the current data access request, so as to avoid sending the public key to the illegal client.

In some embodiments, the second metadata includes a second clear text check value, then the second metadata acquisition unit 44 is specifically configured to:

Correspondingly, the data access request selection response unit 45 is specifically used for:

In some embodiments, the second metadata includes the second terminal identification, and the second metadata acquisition unit 44 is specifically configured to:

Correspondingly, the data access device 4 further includes:

The terminal identifier is a legal judgment unit, which is used to judge whether the terminal identifier is a legal terminal identifier, and mark the data access request as illegal access when the terminal identifier is an illegal terminal identifier.

If the terminal identifier is a legal terminal identifier, the data access request selection response unit 45 is executed, and the data access request selection response unit 45 is specifically used to:

In order to further improve the security of private information, in some embodiments, the data access device 4 further includes: an access frequency legality judgment unit, configured to verify that the terminal ID corresponds to the terminal ID after verifying that the terminal ID is a legal terminal ID Whether the access frequency of the client is legal, and if not, the access limit corresponding to this data access request is limited. If it is legal, the data access request selection response unit 45 is executed, and the data access request selection response unit 45 is specifically used to:

In some embodiments, the second metadata further includes a second ciphertext verification value, and the data access request includes the subject ciphertext, and the second metadata acquisition unit 44 is specifically configured to:

Comparing the second clear text check value with the first clear text check value corresponding to the first metadata, and if the second clear text check value is the same as the first clear text check value, the subject The first ciphertext check value corresponding to the ciphertext is compared with the second ciphertext check value, and if the first ciphertext check value is the same as the second ciphertext check value, respond to the data access request.

Of course, if the second metadata includes a second clear text check value, a second cipher text check value, and a terminal identifier, the second metadata obtaining unit 44 is specifically configured to:

At this time, the data access device 4 further includes:

Whether the terminal identification is legal judgment unit is used to determine whether the terminal identification is a legal terminal identification, and when the terminal identification is an illegal terminal identification, identify the data access request as illegal access;

Correspondingly, the data access request selection response unit 45 is specifically configured to: if the terminal identification is a legal terminal identification, verify the second clear text check value and the first clear text check corresponding to the first metadata Value comparison, if the second clear text check value is the same as the first clear text check value, compare the first cipher text check value corresponding to the subject cipher text with the second cipher text check value, If the first ciphertext verification value is the same as the second ciphertext verification value, respond to the data access request.

In order to improve the robustness against replay attacks, the validity time of the access token can be set, and the validity time is reflected by the second time stamp. At this time, the second metadata includes a second timestamp, and the second metadata acquisition unit 44 is specifically configured to:

Comparing the second clear text check value with the first clear text check value corresponding to the first metadata, and if the second clear text check value is the same as the first clear text check value, the server itself is obtained The first timestamp, if the difference between the second timestamp and the first timestamp is less than or equal to a preset time difference, respond to the data access request.

In some embodiments, the data access device 4 further includes:

The current limiting operation execution unit is configured to perform a current limiting operation on the data access request if the difference between the second time stamp and the first time stamp is greater than the preset time difference.

In some embodiments, the second metadata further includes a second timestamp and a second ciphertext verification value, and the data access request includes the subject ciphertext, then the second metadata acquisition unit 44 is specifically configured to :

Comparing the second clear text check value with the first clear text check value corresponding to the first metadata, and if the second clear text check value is the same as the first clear text check value, the server itself is obtained The first timestamp, if the difference between the second timestamp and the first timestamp is less than or equal to a preset time difference, the first ciphertext check value corresponding to the subject ciphertext is The second ciphertext verification value is compared, and if the first ciphertext verification value is the same as the second ciphertext verification value, respond to the data access request.

In some embodiments, if the second metadata includes: a terminal identifier, a second time stamp, a second clear text check value, and a second cipher text check value, and the data access request includes the subject cipher text, then The second metadata acquisition unit 44 is specifically used to:

At this time, the data access device 4 further includes:

The data access request selection response unit 45 is specifically configured to: if the terminal identification is a legal terminal identification, acquire the first time stamp of the service party itself, and if the difference between the second time stamp and the first time stamp is If the value is less than or equal to the preset time difference, compare the second clear text check value with the first clear text check value corresponding to the first metadata, if the second clear text check value is equal to the first The plain text check value is the same, and the first cipher text check value corresponding to the subject cipher text is compared with the second cipher text check value, if the first cipher text check value is the second cipher text The verification value is the same and responds to the data access request.

At this time, the data access device 4 further includes:

Example 5

An embodiment of the present application provides a mobile terminal, please refer to FIG. 5, the mobile terminal in the embodiment of the present application includes: a memory 501, one or more processors 502 (only one is shown in FIG. 5) and stored in the memory 501 A computer program that can be run on a processor. The memory 501 is used to store software programs and modules. The processor 502 executes various functional applications and data processing by running the software programs and units stored in the memory 501 to obtain resources corresponding to the preset events. Specifically, the processor 502 implements the following steps by running the above computer program stored in the memory 501:

Decrypt the encrypted access token;

Assuming that the above is the first possible implementation manner, in the second possible implementation manner provided on the basis of the first possible implementation manner, the data access request further includes a public key for encryption The key of the access token;

Correspondingly, the decrypting the encrypted access token includes:

In a third possible implementation manner provided as the basis of the above-mentioned second possible implementation manner, the processor 502 further implements the following steps when running the above-mentioned computer program stored in the memory 501:

If the key used to encrypt the access token is not decrypted, the latest public key private key pair in the system is obtained, and the public key in the public key private key pair is returned to the client.

In a fourth possible implementation manner provided as the basis of the first possible implementation manner described above, the second metadata includes a second clear text check value, then if the encrypted access order is successfully decrypted Card, and obtaining the second metadata included in the access token is specifically:

In a fifth possible implementation manner provided as the basis of the above fourth possible implementation manner, the second metadata includes a terminal identification, then if the encrypted access token is successfully decrypted, the The second metadata included in the access token is specifically:

Correspondingly, the data access method further includes:

In a sixth possible implementation manner provided as the basis of the above fifth possible implementation manner, the selection of whether to respond to the data access request according to the second metadata and the first metadata is specifically:

In a seventh possible implementation manner provided as the basis of the above fourth possible implementation manner, the second metadata also includes a second ciphertext verification value, and the data access request includes the subject ciphertext, then If the encrypted access token is successfully decrypted, obtaining the second metadata included in the access token is specifically:

In an eighth possible embodiment provided as the basis of the fourth possible embodiment above, the second metadata further includes a second timestamp, if the encrypted access token is successfully decrypted , Obtaining the second metadata included in the access token is specifically:

In the ninth possible implementation manner provided as the basis of the eighth possible implementation manner described above, the processor 502 further implements the following steps when running the above computer program stored in the memory 501:

In the tenth possible implementation manner provided as the basis of the above fourth possible implementation manner, the second metadata further includes a second time stamp and a second ciphertext verification value, and the data access request includes Subject ciphertext, if the encrypted access token is successfully decrypted, obtaining the second metadata included in the access token is specifically:

Further, as shown in FIG. 5, the above mobile terminal may further include: one or more input devices 503 (only one is shown in FIG. 5) and one or more output devices 504 (only one is shown in FIG. 5). The memory 501, the processor 502, the input device 503, and the output device 504 are connected through a bus 505.

It should be understood that in the embodiment of the present application, the so-called processor 502 may be a central processing unit (Central Processing Unit, CPU), and the processor may also be other general-purpose processors, digital signal processors (Digital Signal Processor, DSP) , Application Specific Integrated Circuit (Application Specific Integrated Circuit, ASIC), ready-made programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

The input device 503 may include a keyboard, a touchpad, a fingerprint sensor (for collecting user's fingerprint information and fingerprint direction information), a microphone, etc., and the output device 504 may include a display, a speaker, and the like.

The memory 501 may include a read-only memory and a random access memory, and provide instructions and data to the processor 502. Part or all of the memory 501 may also include non-volatile random access memory. For example, the memory 501 may also store device type information.

Those skilled in the art can clearly understand that, for convenience and conciseness of description, only the above-mentioned division of each functional unit and module is used as an example for illustration. In practical applications, the above-mentioned functions may be allocated by different functional units, Module completion means that the internal structure of the above device is divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit. The above integrated unit may use hardware It can also be implemented in the form of software functional units. In addition, the specific names of each functional unit and module are only for the purpose of distinguishing each other, and are not used to limit the protection scope of the present application. For the specific working processes of the units and modules in the above system, reference may be made to the corresponding processes in the foregoing method embodiments, which will not be repeated here.

In the above embodiments, the description of each embodiment has its own emphasis. For a part that is not detailed or recorded in an embodiment, you can refer to the related descriptions of other embodiments.

Those of ordinary skill in the art may realize that the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, or a combination of external device software and electronic hardware. Whether these functions are executed in hardware or software depends on the specific application of the technical solution and design constraints. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

In the embodiments provided in this application, it should be understood that the disclosed device and method may be implemented in other ways. For example, the system embodiments described above are only schematic. For example, the division of the above-mentioned modules or units is only a division of logical functions. In actual implementation, there may be other divisions, for example, multiple units or components may be combined Or it can be integrated into another system, or some features can be ignored or not implemented. In addition, the displayed or discussed mutual coupling or direct coupling or communication connection may be indirect coupling or communication connection through some interfaces, devices or units, and may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

If the above integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it may be stored in a computer-readable storage medium. Based on this understanding, the present application can implement all or part of the processes in the methods of the above embodiments, and can also be completed by instructing relevant hardware through a computer program. The above computer program can be stored in a computer-readable storage medium, and the computer program When executed by the processor, the steps of the foregoing method embodiments may be implemented. Wherein, the above-mentioned computer program includes computer program code, and the above-mentioned computer program code may be in the form of source code, object code, executable file or some intermediate form. The above-mentioned computer-readable storage medium may include: any entity or device capable of carrying the above-mentioned computer program code, recording medium, U disk, removable hard disk, magnetic disk, optical disk, computer-readable memory, read-only memory (ROM, Read-Only Memory) ), Random Access Memory (RAM, Random Access Memory), electrical carrier signals, telecommunications signals and software distribution media, etc. It should be noted that the content contained in the above computer-readable storage medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in jurisdictions. For example, in some jurisdictions, according to legislation and patent practice, computer-readable storage The medium does not include electrical carrier signals and telecommunication signals.

The above-mentioned embodiments are only used to illustrate the technical solutions of the present application, not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, persons of ordinary skill in the art should understand that they can still perform the foregoing embodiments The recorded technical solutions are modified, or some of the technical features are equivalently replaced; and these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of this application, and should be included in this Within the scope of protection applied for.

Claims

A data access method, characterized in that it includes:

Receiving a data access request, the data access request includes first metadata and an encrypted access token, and the access token includes second metadata;

Decrypt the encrypted access token;

If the encrypted access token is successfully decrypted, obtain the second metadata included in the access token;

Select whether to respond to the data access request according to the second metadata and the first metadata.
The data access method according to claim 1, wherein the data access request further includes a key used to encrypt the access token after being encrypted using a public key;

Correspondingly, the decrypting the encrypted access token includes:

Using a preset private key to decrypt the key used to encrypt the access token after being encrypted using the public key;

If the key used to encrypt the access token is decrypted, the encrypted access token is decrypted according to the decrypted key.
The data access method according to claim 2, wherein if the key used to encrypt the access token is not decrypted, the latest public key private key pair in the system is obtained, and the public key private key is The public key in the pair is returned to the client.
The data access method according to claim 1, wherein the second metadata includes a second clear text check value, and then if the encrypted access token is successfully decrypted, the access token is obtained The included second metadata is specifically:

If the encrypted access token is successfully decrypted, obtain the second clear text check value included in the access token;

Correspondingly, the selection of whether to respond to the data access request according to the second metadata and the first metadata is specifically:

Comparing the second clear text check value with the first clear text check value corresponding to the first metadata, and if the second clear text check value is the same as the first clear text check value, responding to the data In the access request, if the second clear text check value is different from the first clear text check value, the data access request is identified as illegal access.
The data access method according to claim 4, wherein the second metadata includes a terminal identification, and then if the encrypted access token is successfully decrypted, the second included in the access token is acquired The metadata is specifically:

If the encrypted access token is successfully decrypted, obtain the terminal identification included in the access token;

Correspondingly, the data access method further includes:

Judging whether the terminal identification is a legal terminal identification, and when the terminal identification is an illegal terminal identification, identifying the data access request as illegal access.
The data access method according to claim 5, wherein the selection of whether to respond to the data access request according to the second metadata and the first metadata is specifically:

If the terminal identifier is a legal terminal identifier, compare the second plain text check value with the first plain text check value corresponding to the first metadata, and if the second plain text check value is equal to the first A clear text verification value is the same, and in response to the data access request, if the second clear text verification value is different from the first clear text verification value, the data access request is identified as illegal access.
The data access method according to claim 4, wherein the second metadata further includes a second ciphertext verification value, and the data access request includes a main body ciphertext, then the encryption is decrypted if successful After obtaining the access token, obtaining the second metadata included in the access token is specifically:

If the encrypted access token is successfully decrypted, obtain the second ciphertext verification value included in the access token;

Correspondingly, if the second clear text check value is the same as the first clear text check value, responding to the data access request is specifically:

If the second clear text check value is the same as the first clear text check value, compare the first cipher text check value corresponding to the subject cipher text with the second cipher text check value, if the The first ciphertext verification value is the same as the second ciphertext verification value, and responds to the data access request.
The data access method according to claim 4, wherein the second metadata further includes a second timestamp, and then if the encrypted access token is successfully decrypted, acquiring the access token includes The second metadata is:

If the encrypted access token is successfully decrypted, obtain the second time stamp included in the access token;

Correspondingly, if the second clear text check value is the same as the first clear text check value, responding to the data access request is specifically:

If the second clear text check value is the same as the first clear text check value, obtain the first time stamp of the server itself, and if the difference between the second time stamp and the first time stamp is less than or equal to The preset time difference value responds to the data access request.
The data access method according to claim 8, wherein the data access method further comprises:

If the difference between the second time stamp and the first time stamp is greater than the preset time difference, a current limiting operation is performed on the data access request.
The data access method according to claim 4, wherein the second metadata further includes a second time stamp and a second ciphertext verification value, and the data access request includes the subject ciphertext, then the Successfully decrypt the encrypted access token, and obtain the second metadata included in the access token specifically:

If the encrypted access token is successfully decrypted, obtain the second time stamp and the second ciphertext verification value included in the access token;

Correspondingly, if the second clear text check value is the same as the first clear text check value, responding to the data access request is specifically:

If the second clear text check value is the same as the first clear text check value, obtain the first time stamp of the server itself, and if the difference between the second time stamp and the first time stamp is less than or equal to Preset a time difference, compare the first ciphertext check value corresponding to the subject ciphertext with the second ciphertext check value, if the first ciphertext check value and the second ciphertext The verification value is the same and responds to the data access request.
A data access device is characterized by comprising:

A first data access request receiving unit, configured to receive a data access request, where the data access request includes first metadata and an encrypted access token, and the access token includes second metadata;

An access token decryption unit, used to decrypt the encrypted access token;

A second metadata acquisition unit for acquiring the second metadata included in the access token if the encrypted access token is successfully decrypted;

The data access request selection response unit is configured to select whether to respond to the data access request based on the second metadata and the first metadata.
A mobile terminal includes a memory, a processor, and a computer program stored in the memory and capable of running on the processor, characterized in that, when the processor executes the computer program, the following steps are implemented:

Receiving a data access request, the data access request includes first metadata and an encrypted access token, and the access token includes second metadata;

Decrypt the encrypted access token;

If the encrypted access token is successfully decrypted, obtain the second metadata included in the access token;

Select whether to respond to the data access request according to the second metadata and the first metadata.
The mobile terminal according to claim 12, wherein the data access request further includes a key for encrypting the access token encrypted using a public key, and correspondingly, the decrypting the encrypted Access tokens include:

Using a preset private key to decrypt the key used to encrypt the access token after being encrypted using the public key;

If the key used to encrypt the access token is decrypted, the encrypted access token is decrypted according to the decrypted key.
The mobile terminal according to claim 13, wherein if the key used to encrypt the access token is not decrypted, the latest public key private key pair in the system is obtained, and the public key private key pair The public key in is returned to the client.
The mobile terminal according to claim 12, wherein the second metadata includes a second clear text check value, and then if the encrypted access token is successfully decrypted, acquiring the access token includes The second metadata is:

If the encrypted access token is successfully decrypted, obtain the second clear text check value included in the access token;

Correspondingly, the selection of whether to respond to the data access request according to the second metadata and the first metadata is specifically:

Comparing the second clear text check value with the first clear text check value corresponding to the first metadata, and if the second clear text check value is the same as the first clear text check value, responding to the data In the access request, if the second clear text check value is different from the first clear text check value, the data access request is identified as illegal access.
The mobile terminal according to claim 15, wherein the second metadata includes a terminal identification, and then if the encrypted access token is successfully decrypted, the second element included in the access token is acquired The data is specifically:

If the encrypted access token is successfully decrypted, obtain the terminal identification included in the access token;

Correspondingly, the processor also implements the following steps when executing the computer program:

Judging whether the terminal identification is a legal terminal identification, and when the terminal identification is an illegal terminal identification, identifying the data access request as illegal access.
The mobile terminal according to claim 16, wherein the selection of whether to respond to the data access request based on the second metadata and the first metadata specifically includes:

If the terminal identifier is a legal terminal identifier, compare the second plain text check value with the first plain text check value corresponding to the first metadata, and if the second plain text check value is equal to the first A clear text verification value is the same, and in response to the data access request, if the second clear text verification value is different from the first clear text verification value, the data access request is identified as illegal access.
The mobile terminal according to claim 15, characterized in that the second metadata further includes a second ciphertext verification value, and the data access request includes a main body ciphertext, and then if the encryption is successfully decrypted To obtain the second metadata included in the access token is:

If the encrypted access token is successfully decrypted, obtain the second ciphertext verification value included in the access token;

Correspondingly, if the second clear text check value is the same as the first clear text check value, responding to the data access request is specifically:

If the second clear text check value is the same as the first clear text check value, compare the first cipher text check value corresponding to the subject cipher text with the second cipher text check value, if the The first ciphertext verification value is the same as the second ciphertext verification value, and responds to the data access request.
The mobile terminal according to claim 15, wherein the second metadata further includes a second time stamp, and then if the encrypted access token is successfully decrypted, acquiring the access token includes The second metadata is:

If the encrypted access token is successfully decrypted, obtain the second time stamp included in the access token;

Correspondingly, if the second clear text check value is the same as the first clear text check value, responding to the data access request is specifically:

If the second clear text check value is the same as the first clear text check value, obtain the first time stamp of the server itself, and if the difference between the second time stamp and the first time stamp is less than or equal to The preset time difference value responds to the data access request.
A computer-readable storage medium storing a computer program, characterized in that, when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.