WO2023185514A1 - 传输消息的方法、装置、存储介质及电子设备 - Google Patents

传输消息的方法、装置、存储介质及电子设备 Download PDF

Info

Publication number
WO2023185514A1
WO2023185514A1 PCT/CN2023/082351 CN2023082351W WO2023185514A1 WO 2023185514 A1 WO2023185514 A1 WO 2023185514A1 CN 2023082351 W CN2023082351 W CN 2023082351W WO 2023185514 A1 WO2023185514 A1 WO 2023185514A1
Authority
WO
WIPO (PCT)
Prior art keywords
cloud service
request message
access request
service access
cloud
Prior art date
Application number
PCT/CN2023/082351
Other languages
English (en)
French (fr)
Inventor
孙益星
王剑
Original Assignee
北京有竹居网络技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京有竹居网络技术有限公司 filed Critical 北京有竹居网络技术有限公司
Publication of WO2023185514A1 publication Critical patent/WO2023185514A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures

Definitions

  • the present disclosure relates to the field of cloud service access, and specifically, to a method, device, storage medium and electronic device for transmitting messages.
  • Cloud service vendors provide a series of service capabilities. Developers can use and manage these capabilities through the Application Programming Interface (API) provided by the vendor. In the process of calling the API, they need to use the API access key provided by the vendor. The key is used to sign the business request issued. The signature algorithm is usually open. The user only needs to obtain the account key to sign the business request and implement the interface call of related functions.
  • API Application Programming Interface
  • the present disclosure provides a method for transmitting messages, which is applied to a preset server.
  • the preset server is a pre-deployed server that transmits messages between a terminal and a cloud server.
  • the method includes:
  • a method of transmitting messages is provided, applied to a terminal, and the method includes:
  • a preset server which is a pre-deployed server that transmits messages between the terminal and the cloud server;
  • Re-sign obtain a new cloud service access request message, and send the new cloud service access request message to the cloud server.
  • a device for transmitting messages which is applied to a preset server.
  • the preset server is a pre-deployed server that transmits messages between a terminal and a cloud server.
  • the device includes:
  • a first receiving module configured to receive a cloud service access request message sent by the terminal, where the cloud service access request message includes the domain name address information of the preset server;
  • a determination module configured to determine the cloud service interface address to be accessed according to the cloud service access request message
  • a verification module configured to perform signature verification on the cloud service access request message according to the cloud service interface address, and if the verification passes, re-sign the cloud service access request message to obtain a new cloud service access request message;
  • the first sending module is configured to send the new cloud service access request message to the cloud server according to the cloud service interface address.
  • a device for transmitting messages applied to a terminal, and the device includes:
  • An acquisition module configured to acquire the user identification information, service request data, and access key pre-allocated for the current user by a preset server, which is pre-deployed between the terminal and the cloud server.
  • Server that transmits messages
  • a request message generation module configured to generate a cloud service access request message based on the user identification information, the service request data and the access key, where the cloud service access request message includes the domain name address information of the preset server ;
  • the second sending module is used to send the cloud service access request message to the default server, so that the default server can verify the signature of the cloud service access request message and pass the verification.
  • the cloud service access request message is re-signed to obtain a new cloud service access request message, and the new cloud service access request message is sent to the cloud server.
  • a computer-readable storage medium on which a computer program is stored.
  • the program is executed by a processing device, the steps of the method described in the first or second aspect of the present disclosure are implemented.
  • a sixth aspect provides an electronic device, including: a storage device on which at least one computer program is stored; and at least one processing device for executing the at least one computer program in the storage device to implement the first aspect of the present disclosure. The steps of the method of one aspect or the second aspect.
  • a computer program product comprising computer instructions that, when executed by a processing device, implement the steps of the method described in the first or second aspect of the present disclosure.
  • An eighth aspect provides a computer program that implements the steps of the method described in the first or second aspect of the present disclosure when executed by a processing device.
  • Figure 1 is a schematic diagram of message transmission in an existing cloud service access mode
  • Figure 2 is a schematic diagram of account allocation under an existing cloud service access mode
  • Figure 3 is a flow chart of a method of transmitting messages according to an exemplary embodiment
  • Figure 4 is a schematic diagram of message transmission in an existing cloud service access mode
  • Figure 5 is a schematic diagram of a process of transmitting messages according to an exemplary embodiment
  • Figure 6 is a flow chart of a method of transmitting messages according to an exemplary embodiment
  • Figure 7 is a flow chart of a method of transmitting messages according to an exemplary embodiment
  • Figure 8 is a flow chart of a method of transmitting messages according to an exemplary embodiment
  • Figure 9 is a flow chart of a method of transmitting messages according to an exemplary embodiment
  • Figure 10 is a schematic diagram of a process of transmitting messages according to an exemplary embodiment
  • Figure 11 is a schematic diagram of message transmission based on customized SDK
  • Figure 12 is a block diagram of a device for transmitting messages according to an exemplary embodiment
  • Figure 13 is a block diagram of a device for transmitting messages according to an exemplary embodiment
  • Figure 14 is a block diagram of a device for transmitting messages according to an exemplary embodiment
  • FIG. 15 is a structural block diagram of an electronic device according to an exemplary embodiment.
  • the term “include” and its variations are open-ended, ie, “including but not limited to.”
  • the term “based on” means “based at least in part on.”
  • the term “one embodiment” means “at least one embodiment”; the term “another embodiment” means “at least one additional embodiment”; and the term “some embodiments” means “at least some embodiments”. Relevant definitions of other terms will be given in the description below.
  • a prompt message is sent to the user to clearly remind the user that the operation requested will require the acquisition and use of the user's personal information. Therefore, users can autonomously choose whether to provide personal information to software or hardware such as electronic devices, applications, servers or storage media that perform the operations of the technical solution of the present disclosure based on the prompt information.
  • the method of sending prompt information to the user may be, for example, a pop-up window, and the prompt information may be presented in the form of text in the pop-up window.
  • the pop-up window can also contain a selection control for the user to choose "agree” or "disagree” to provide personal information to the electronic device.
  • This disclosure is mainly used in scenarios where cloud service resources are accessed and used by calling APIs provided by cloud vendors.
  • the original request needs to be signed using the interface access key provided by the vendor. , and then directly send the signature request to the cloud server.
  • the signature algorithm is usually open. The user only needs to obtain the account key to sign the cloud service access request and implement the interface call of related functions.
  • the interface is the cloud service provider's interface, and the management department cannot audit and detect each user's cloud service access request, resulting in security risks in cloud service data access.
  • the present disclosure provides a method, device, storage medium and electronic device for transmitting messages.
  • a preset server for transmitting messages is pre-deployed between the terminal and the cloud server, and the cloud vendor interface is adjusted on the terminal side.
  • Access address that is, adding the default domain name suffix pre-configured for the default server to the original interface access address to obtain the domain name address information
  • the cloud service access request message sent by the terminal can be directed to the default server, and the default server will perform unified account verification on the users currently accessing the cloud server, and also allow the management department to access the cloud service through the default server.
  • the request messages are audited and tested, and the functions and frequency used by users are uniformly tested and managed, which realizes the controllability of cloud service access and reduces the security risks of cloud service data access.
  • the preset server pre-deployed between the terminal and the cloud server for transmitting messages can receive the cloud service access request message sent by the terminal, and the cloud service access request message includes the preset server's Domain name address information; determine the cloud service interface address to be accessed according to the cloud service access request message; perform signature verification on the cloud service access request message according to the cloud service interface address, and if the verification passes, The cloud service access request message is re-signed to obtain a new cloud service access request message; the new cloud service access request message is sent to the cloud server according to the cloud service interface address, so that the new cloud service access request message can be sent according to the domain name address
  • the information directs the cloud service access request message sent by the terminal to the default server, and the default server controls the user currently accessing the cloud server.
  • Unified account verification for users also allows the management department to audit and detect the cloud service access request message through the preset server, achieving controllability of cloud service access and reducing the security risk of cloud service data access.
  • the cloud service access request messages of each user are uniformly detected and managed based on the preset server.
  • the management department can Deleting the user's account through the preset server eliminates the need to log in to multiple cloud vendor platforms to perform deletion operations separately, thereby greatly reducing the maintenance and management costs of the account.
  • there is no need to configure separate accounts for each user in the cloud vendor. multiple users can share a real key, and only need to assign a pseudo signature key to each user to achieve the effect of account isolation. When a single user account is leaked, other users will not be affected.
  • Figure 3 is a flow chart of a method of transmitting messages according to an exemplary embodiment.
  • the method is applied to a preset server.
  • the preset server is a pre-deployed server that transmits messages between the terminal and the cloud server.
  • the default server can be understood as a preset intermediate proxy service between the terminal and the server.
  • the method includes the following steps:
  • step S301 a cloud service access request message sent by the terminal is received.
  • the cloud service access request message includes the domain name address information of the default server.
  • the cloud service access request message includes the user identification information of the current user who wants to access the cloud service (for example, a developer who needs to use cloud service resources), specific business request data, and the domain name address information of the default server, where,
  • the domain name address information includes the cloud service interface address of the cloud vendor corresponding to the cloud server that the current user wants to access and the default domain name suffix corresponding to the default server.
  • the cloud service access request message is directed to the default server, so that the users who currently want to access the cloud server can perform unified account verification through the default server, and the management department can also make the cloud service access request through the default server. Messages are audited and detected.
  • step S302 the cloud service interface address to be accessed is determined according to the cloud service access request message.
  • the preset domain name suffix corresponding to the preset server can be obtained; the domain name address information can be obtained from the cloud service access request message; in this way, the cloud service can be determined from the domain name address information based on the preset domain name suffix interface address.
  • a default domain name suffix (that is, the default domain name suffix) can be configured in advance for the default server, and then the cloud service interface address can be configured with a default domain name suffix. Add the preset domain name suffix to obtain the domain name address information. In this way, in the process of determining the cloud service interface address from the domain name address information based on the preset domain name suffix, the preset domain name suffix in the domain name address information can be After deletion, restore the original cloud service interface address.
  • Figure 4 is a schematic diagram of the access mode when accessing cloud services in the prior art.
  • users can directly use the cloud vendor's interface access address and key to access the interface service.
  • the client You can directly use vendor A's cloud service interface address api.a.com to access vendor A's interface.
  • api.c.com accesses the C vendor interface.
  • the preset server in order to direct the cloud service access request message to the preset server (ie, the intermediate agent in Figure 5), the preset server can be Assume that the server is configured with a pan-domain name *.fusion-api.com. In this way, the default domain name suffix .fusion-api.com can be added to the original cloud service interface address to complete the redirection of requests.
  • the default server receives After receiving the request message, you can delete the preset domain name suffix in the domain name address information in the request message and restore the original cloud service interface address.
  • the preset server receives the cloud service of accessing vendor A. access request
  • the domain name address information in the message is api.a.com.fusion-api.com. After restoring the request message, you can get the original cloud service interface address of vendor A as api.a.com.
  • the above example is just an example. , this disclosure does not limit this.
  • the default server can configure different accounts (i.e. Access Key Id, AK) for different users to access different interfaces in advance.
  • the user identification information of the current user includes the AK.
  • Account different user identification information corresponds to different cloud service interfaces. Therefore, in another possible implementation of this step, the cloud service interface address can also be determined based on the user identification information in the cloud service access request message, for example , the default server can store the corresponding relationship between the AK account and the cloud service interface in the database in advance.
  • the server can read the AK from the user identification information in the cloud service access request message. account, and then the cloud service interface to be accessed by the current user can be obtained by looking up the table, and then the address of the cloud service interface can be determined.
  • step S303 perform signature verification on the cloud service access request message based on the cloud service interface address, and if the verification passes, re-sign the cloud service access request message to obtain a new cloud service access request message.
  • the cloud service access request message includes the user identification information of the current user and the service request data.
  • the service request data includes the vendor identification information of the cloud vendor corresponding to the cloud server to be accessed by the current user.
  • Figure 6 is a flow chart of a method of transmitting messages according to an exemplary embodiment. As shown in Figure 6, the signature verification of the cloud service access request message can be performed according to the cloud service interface address by performing the following steps:
  • step S3031 the signature algorithm corresponding to the cloud server is determined based on the cloud service interface address.
  • each cloud vendor corresponds to different signature algorithms, and each cloud vendor discloses the signature algorithm.
  • the cloud vendor corresponding to the cloud server currently to be accessed can be determined based on the cloud service interface address.
  • the signature algorithm corresponding to the cloud vendor can be determined.
  • step S3032 the first key corresponding to the current user is obtained according to the user identification information and the manufacturer identification information.
  • the first key is pre-generated by the default server.
  • the first key can be understood as a pseudo secret key generated by the default server for the user.
  • the corresponding relationship between the user, the cloud vendor and the pseudo key can be pre-stored in the preset server.
  • a table lookup can be performed based on the user identification information and the vendor identification information. method to obtain the first key.
  • Table 1 is the correspondence between user information, manufacturer information and corresponding key information stored in the default server.
  • the default server can obtain the user identification information u1 and the vendor identification information A from the cloud service access request message. Then it can determine the user u1 and the cloud vendor A corresponding to the user u1 by looking up Table 1.
  • One key is FakeKey1.
  • the above example is only an illustration, and this disclosure does not limit it.
  • step S3033 the signature algorithm is used to generate a first signature based on the first key, the user identification information and the service request data.
  • the first signature may be recalculated based on the signature algorithm based on the user identification information, the service request data, and the first key.
  • the specific calculation method may refer to descriptions in relevant literature, and is not limited here.
  • step S3034 perform signature verification on the cloud service access request message according to the first signature.
  • the first signature can be compared with the signature information in the cloud service access request message. If the two are completely consistent, it is determined that the cloud service access request message has passed the verification. After that, the cloud service access request message can be verified.
  • the cloud service access request message performs key replacement, and sends the request message signed with the real key provided by the cloud server to the cloud server to implement the call to the cloud server interface.
  • step S3035 a second key corresponding to the cloud server is obtained based on the user identification information and the manufacturer identification information.
  • the second key is pre-generated by the cloud server.
  • the second key is the real key provided by the cloud server.
  • the default server may also find the corresponding second key based on the user identification information and the manufacturer identification information by looking up a table.
  • step S3036 the signature algorithm is used to generate a second signature based on the second key, the user identification information and the service request data.
  • the second signature may be recalculated based on the signature algorithm based on the second key, the user identification information and the service request data.
  • step S3037 the cloud service access request message is re-signed according to the second signature to obtain the new cloud service access request message.
  • the original signature in the cloud service access request message can be replaced with the second signature, so as to re-sign the cloud service access request message based on the second signature to obtain the new cloud service access request message.
  • Service access request message where the original signature is the signature generated by the terminal using the pseudo-secret key assigned by the preset server.
  • the default server can perform signature verification on the cloud service access request message signed by the pseudo key sent by the terminal, and if the verification passes, the real key provided by the cloud server can be used to verify the signature.
  • the cloud service access request message is re-signed. This not only enables unified management of cloud service access accounts, but also audits and detects each user's cloud service access request. For example, it is possible to know in time which resources the user has accessed and used. What cloud service interface functions are there, what is the quality of the cloud provider's ability to handle current user requests (such as response speed), what problems are encountered, etc., and then you can evaluate whether the resource data used by the user is safe, and you can also evaluate the service capabilities of the cloud provider. to evaluate.
  • step S304 the new cloud service access request message is sent to the cloud server according to the cloud service interface address.
  • the cloud service access request message sent by the terminal can be directed to the preset server based on the domain name address information.
  • the preset server will perform unified account verification on the users who currently want to access the cloud server, and also allow the management department to pass
  • the preset server audits and detects the cloud service access request message, thereby achieving controllability of cloud service access and reducing security risks of cloud service data access.
  • the cloud service access request messages of each user are uniformly detected and managed based on the preset server.
  • the management department can Deleting the user's account through the preset server eliminates the need to log in to multiple cloud vendor platforms to perform deletion operations separately, thereby greatly reducing the maintenance and management costs of the account.
  • there is no need to configure separate accounts for each user in the cloud vendor. multiple users can share a real key, and only need to assign a pseudo signature key to each user to achieve the effect of account isolation. When a single user account is leaked, other users will not be affected.
  • Figure 7 is a flow chart of a method of transmitting messages according to the embodiment shown in Figure 3. As shown in Figure 7, the method also includes:
  • step S305 receive the cloud service access response message sent by the cloud server according to the new cloud service access request message, and send the cloud service access response message to the terminal.
  • the cloud service access response message may include business response information
  • the default server may receive the cloud service access response message returned by the cloud server after sending the re-signed new cloud service access request message to the cloud server.
  • the cloud service access response message can then be sent to the terminal.
  • the method also includes the following steps:
  • step S306 an access log is generated according to the new cloud service access request message and the cloud service access response message.
  • the access log is used to record the current user's cloud service access matters.
  • the cloud service access matters include the target resources accessed by the current user, the target interface functions used by the current user, and the quality of the cloud vendor's processing service capabilities for the current user's request (such as Response speed), whether and what kind of problems are encountered during the current access, and assessment of whether the resource data used by the current user is safe, etc.
  • the access log can be generated based on the new cloud service access request message, cloud service access response message, request message sending time, response message receiving time, etc., to implement auditing of the current user's cloud service access request. and detection.
  • Figure 8 is a flow chart of a method of transmitting messages according to an exemplary embodiment. The method can be applied to a terminal. As shown in Figure 8, the method includes the following steps:
  • step S801 the current user's user identification information, service request data, and access key pre-allocated by the default server for the current user are obtained.
  • the service request data may include the vendor identification information of the cloud vendor corresponding to the cloud server to be accessed by the current user, actual business access parameters and other information.
  • the default server is pre-deployed and transmitted between the terminal and the cloud server.
  • the server of the message can be understood as the preset intermediate proxy service between the terminal and the server.
  • the cloud server distributes the real key to the user.
  • the access key It refers to the pseudo-secret key pre-assigned to the user by the default server.
  • a cloud service access request message is generated according to the user identification information, the service request data and the access key, and the cloud service access request message includes the domain name address information of the default server.
  • the cloud service interface address of the cloud server can be obtained based on the manufacturer identification information in the business request data; domain name address information can be generated based on the cloud service interface address and the preset domain name suffix corresponding to the preset server; based on the The access key, the user identification information and the business request data use the signature algorithm provided by the cloud server to generate a third signature; the cloud service is generated based on the third signature, the user identification information, the business request data and the domain name address information Access request message.
  • the cloud service access request message needs to be directed to the preset server.
  • the cloud service access request message can be directed to the preset server.
  • the terminal can adjust the cloud service interface address of each cloud vendor based on the pan-domain name.
  • the cloud service interface address of vendor A is api.a.com. You can change the address and add a
  • the domain name address information is generated after the preset domain name suffix .fusion-api.com. In this way, the terminal can send the cloud service access request message to the preset server based on the domain name address information, thereby realizing the redirection of the request message.
  • the corresponding relationship between the default domain name suffix and the IP address of the default server can be set in advance, so as to ensure that messages sent to the address corresponding to the default domain name suffix can be directed to the default server.
  • the third signature can be calculated using the signature algorithm provided by the cloud server based on the access key, the user identification information and the business request data.
  • the cloud service access request message can be generated based on the third signature, the user identification information, the business request data, and the domain name address information.
  • step S803 the cloud service access request message is sent to the default server.
  • the default server can re-sign the cloud service access request message, obtain a new cloud service access request message, and pass the new cloud service access request message.
  • the request message is sent to the cloud server.
  • the terminal can adjust the cloud service interface address of the cloud vendor, add the default domain name suffix corresponding to the default server after the cloud service interface address, and then send the cloud service access request message sent by the terminal to the default server.
  • the preset server performs unified account verification for users currently accessing the cloud server, and also allows the management department to audit and detect the cloud service access request message through the preset server, achieving controllable access to the cloud service. It reduces the security risks of cloud service data access.
  • the cloud service access request messages of each user are uniformly detected and managed based on the preset server.
  • the management department can Deleting the user's account through the preset server eliminates the need to log in to multiple cloud vendor platforms to perform deletion operations separately, thereby greatly reducing the maintenance and management costs of the account.
  • there is no need to configure separate accounts for each user in the cloud vendor. multiple users can share a real key, and only need to assign a pseudo signature key to each user to achieve the effect of account isolation. When a single user account is leaked, other users will not be affected.
  • Figure 9 is a flow chart of a method of transmitting messages according to an exemplary embodiment. As shown in Figure 9, the method includes the following steps:
  • step S901 the terminal obtains the user identification information, service request data, and access key pre-allocated by the default server for the current user.
  • the current user generally refers to the developer who needs to use cloud service resources at the current moment.
  • the business request data may include the vendor identification information of the cloud vendor corresponding to the cloud server to be accessed by the current user, actual business access parameters and other information.
  • the default server is a pre-deployed server that transmits messages between the terminal and the cloud server.
  • the default server can be understood as a preset intermediate proxy service between the terminal and the server.
  • the cloud server assigns the real key to the user, and the access key refers to the pseudo-secret key pre-distributed to the user by the default server.
  • step S902 the terminal generates a cloud service access request message based on the user identification information, the service request data and the access key.
  • the cloud service access request message includes the domain name address information of the default server.
  • the service request data includes the vendor identification information of the cloud vendor corresponding to the cloud server to be accessed by the current user.
  • the terminal can obtain the cloud service interface address of the cloud server based on the vendor identification information; according to the The cloud service interface address and the preset domain name suffix corresponding to the preset server generate domain name address information; use the signature algorithm provided by the cloud server to generate a third signature based on the access key, the user identification information and the business request data; according to the The third signature, the user identification information, the business request data and the domain name address information generate the cloud service access request message.
  • the cloud service access request message needs to be directed to the preset server.
  • the cloud service interface address of vendor A is api.a.com, and you can change the address again.
  • the terminal can send the cloud service access request message to the preset server based on the domain name address information, thereby realizing the redirection of the request message.
  • the corresponding relationship between the default domain name suffix and the IP address of the default server can be set in advance, so as to ensure that messages sent to the address corresponding to the default domain name suffix can be directed to the default server.
  • step S903 the terminal sends the cloud service access request message to the default server.
  • step S904 the default server determines the cloud service interface address to be accessed according to the cloud service access request message.
  • the preset domain name suffix corresponding to the preset server can be obtained, the domain name address information can be obtained from the cloud service access request message, and the cloud service interface address can be determined from the domain name address information based on the preset domain name suffix.
  • the preset domain name suffix corresponding to the preset server
  • the domain name address information can be obtained from the cloud service access request message
  • the cloud service interface address can be determined from the domain name address information based on the preset domain name suffix.
  • different user identification information may correspond to different cloud service interfaces, so this step may also determine the cloud service interface address based on the user identification information in the cloud service access request message, for example, pre- Assume that the server can store the corresponding relationship between the AK account and the cloud service interface in the database in advance.
  • the server After receiving the cloud service access request message, the server can read the AK account number from the user identification information in the cloud service access request message. Afterwards, the cloud service interface to be accessed by the current user can be obtained by looking up the table, and then the address of the cloud service interface can be determined.
  • step S905 the default server performs signature verification on the cloud service access request message based on the cloud service interface address, and if the verification passes, re-signs the cloud service access request message to obtain a new cloud service access request. Request message.
  • the cloud service access request message includes the user identification information of the current user and the service request data.
  • the service request data includes the vendor identification information of the cloud vendor corresponding to the cloud server to be accessed by the current user.
  • the signature algorithm corresponding to the cloud server can be determined according to the cloud service interface address; the first key corresponding to the current user is obtained according to the user identification information and the manufacturer identification information, and the first key is the default Pre-generated by the server; using the signature algorithm to generate a first signature based on the first key, the user identification information and the business request data; performing signature verification on the cloud service access request message based on the first signature.
  • the second key corresponding to the cloud server can be obtained according to the user identification information and the manufacturer identification information.
  • the second key is pre-generated by the cloud server; according to the second key, the user identification information and the
  • the business request data uses the signature algorithm to generate a second signature; the cloud service access request message is re-signed based on the second signature to obtain the new cloud service access request message.
  • the first key can be understood as a pseudo secret key generated by the default server for the user, and the second key is the real key provided by the cloud server.
  • step S906 the default server sends the new cloud service access request message to the cloud server according to the cloud service interface address.
  • step S907 the default server receives the cloud service access response message sent by the cloud server according to the new cloud service access request message, and sends the cloud service access response message to the terminal.
  • the cloud service access response message may include business response information
  • the default server may receive the cloud service access response message returned by the cloud server after sending the re-signed new cloud service access request message to the cloud server.
  • the cloud service access response message can then be sent to the terminal.
  • step S908 the default server generates an access log based on the new cloud service access request message and the cloud service access response message.
  • the access log is used to record the current user's cloud service access matters.
  • the access log is used to record the current user's cloud service access matters.
  • the cloud service access matters include the target resources accessed by the current user, the target interface functions used by the current user, and the quality of the cloud vendor's processing service capabilities for the current user's request (such as Response speed), whether and what kind of problems are encountered during the current access, and assessment of whether the resource data used by the current user is safe, etc.
  • the access log can be generated based on the new cloud service access request message, cloud service access response message, request message sending time, response message receiving time, etc., to implement auditing of the current user's cloud service access request. and detection.
  • Figure 10 is a schematic diagram of a process of transmitting messages between a terminal, a preset server (i.e., the intermediate agent in Figure 10) and a cloud server according to an exemplary embodiment.
  • the terminal side first uses the preset server to allocate The original cloud service access request message is signed with the pseudo-secret key (i.e. the first key).
  • the pseudo-secret key i.e. the first key
  • user u1 wants to access the cloud service provided by vendor A.
  • the pseudo-secret key assigned by the preset server is used.
  • the terminal sends the cloud service access request message to the default server.
  • the default server then sends the new cloud service access request message to the cloud server corresponding to vendor A to achieve resource access to the cloud service provided by vendor A.
  • the cloud service access request message sent by the terminal can be directed to the preset server according to the domain name address information in the cloud service access request message, and the preset server performs unified account verification on the user who currently wants to access the cloud server. It also enables the management department to audit and detect the cloud service access request message through the preset server, achieving controllability of cloud service access and reducing the security risk of cloud service data access.
  • the cloud service access request messages of each user are uniformly detected and managed.
  • the management department can use the The default server deletes the user's account, eliminating the need to log in to multiple cloud vendor platforms to perform deletion operations separately, thus greatly reducing This reduces the cost of account maintenance and management.
  • the present disclosure can also develop a unified gateway to connect all users' cloud service access requests to the gateway service in a unified manner.
  • the terminal can send a first request message to the gateway.
  • the first request message is used to request to obtain cloud service resource information from the gateway, where the terminal can use the key provided by the gateway and the signature provided by the gateway.
  • the algorithm signs the first request message.
  • the gateway After receiving the first request message, the gateway performs signature verification on the first request message. If the verification passes, it can use the key and signature algorithm provided by the cloud vendor.
  • the first request message is re-signed to obtain a second request message, and then the second request message is sent to the cloud server.
  • Adopting a unified method of docking gateway services management departments can also use the gateway service to audit and detect users' cloud service access requests, achieving controllability of cloud service access and reducing the security risks of cloud service data access.
  • the management department can also delete the user's account through the gateway service, without the need to log in to multiple cloud vendor platforms separately. Delete operation, thus reducing the cost of account maintenance and management.
  • the gateway service calls the cloud vendor's interface.
  • each cloud vendor has There are multiple products, and each product corresponds to dozens of open interfaces, which means that each manufacturer may generally have thousands of interfaces.
  • the unified gateway needs to encapsulate all the thousands of interfaces corresponding to the manufacturer, and the development cost is high. For different cloud vendors, the corresponding interface specifications are different. If one interface is used on the gateway side to hide the interface functions corresponding to all cloud vendors, it will also increase development costs. And with this unified gateway, the SDK and documentation of the cloud vendors will not be the same. Re-usability requires additional learning costs for users.
  • the present disclosure can also access cloud service resources through customized SDKs. Specifically, unified audit codes can be added to the SDKs of different cloud vendors on the terminal side to Implement account acquisition and auditing of access requests.
  • FIG 11 is a schematic diagram of a message transmission process for cloud service access based on a customized SDK according to an exemplary embodiment.
  • the terminal can send a third request message to the audit server (that is, as shown in Figure 11 Step 1), the third request message is used to request to obtain the manufacturer account corresponding to the cloud server to be accessed, and to request to audit the cloud service access request.
  • the audit service can perform the audit on the cloud service.
  • the access request is audited, and the signature of the third request message can also be verified.
  • the cloud server that the current user wants to access can be The corresponding manufacturer account is sent to the terminal, and then the terminal can use the manufacturer account and key information sent by the audit service to sign the access request message and send it to the cloud server (ie, step 2 shown in Figure 11).
  • the management department can also use this audit service to audit and detect users' cloud service access requests, achieving controllability of cloud service access and reducing the security risks of cloud service data access.
  • the management department can also delete the user's account through the audit service, without having to log in to multiple cloud vendor platforms separately. Perform deletion operations, thereby reducing account maintenance and management costs.
  • Figure 12 is a block diagram of a device for transmitting messages according to an exemplary embodiment, applied to a preset server, which is a pre-deployed server that transmits messages between a terminal and a cloud server, as shown in Figure 12 As shown, the device includes:
  • the first receiving module 1201 is configured to receive a cloud service access request message sent by the terminal, where the cloud service access request message includes the domain name address information of the preset server;
  • Determining module 1202 configured to determine the cloud service interface address to be accessed according to the cloud service access request message
  • Verification module 1203 configured to perform signature verification on the cloud service access request message according to the cloud service interface address, and if the verification passes, re-sign the cloud service access request message to obtain a new cloud service access request message;
  • the first sending module 1204 is configured to send the new cloud service access request message to the cloud server according to the cloud service interface address.
  • the determining module 1202 is configured to obtain the preset domain name suffix corresponding to the preset server; obtain the domain name address information from the cloud service access request message; and obtain the preset domain name suffix from the preset domain name suffix. Determine the cloud service interface address from the domain name address information.
  • the cloud service access request message includes the user identification information of the current user and service request data
  • the service request data includes the vendor identification information of the cloud vendor corresponding to the cloud server to be accessed by the current user.
  • the verification module 1203 is used to determine the signature algorithm corresponding to the cloud server according to the cloud service interface address; to obtain the first key corresponding to the current user according to the user identification information and the manufacturer identification information.
  • the key is pre-generated by the preset server; the signature algorithm is used to generate a first signature according to the first key, the user identification information and the service request data; and the cloud is generated based on the first signature.
  • Service access request messages undergo signature verification.
  • the verification module 1203 is configured to obtain the second key corresponding to the cloud server according to the user identification information and the manufacturer identification information.
  • the second key is pre-generated by the cloud server. ; Use the signature algorithm to generate a second signature according to the second key, the user identification information and the service request data; Re-sign the cloud service access request message according to the second signature to obtain the Describe the new cloud service access request message.
  • Figure 13 is a block diagram of a device for transmitting messages according to the embodiment shown in Figure 12. As shown in Figure 13, the device also includes:
  • the second receiving module 1205 is configured to receive a cloud service access response message sent by the cloud server according to the new cloud service access request message, and send the cloud service access response message to the terminal.
  • the device also includes:
  • the log generation module 1206 is configured to generate an access log according to the new cloud service access request message and the cloud service access response message, where the access log is used to record the current user's cloud service access matters.
  • the cloud service access request message sent by the terminal can be directed to the default server, and the default server can perform unified account verification on the users who currently want to access the cloud server, and also enable the management department to use the default server to verify the user's account.
  • the cloud service access request message is audited and detected, which realizes the controllability of cloud service access and reduces the security risk of cloud service data access.
  • the cloud service access request messages of each user are uniformly detected and managed based on the preset server.
  • the management department can Deleting the user's account through the preset server eliminates the need to log in to multiple cloud vendor platforms to perform deletion operations separately, thereby greatly reducing the maintenance and management costs of the account.
  • there is no need to configure separate accounts for each user in the cloud vendor. multiple users can share a real key, and only need to assign a pseudo signature key to each user to achieve the effect of account isolation. When a single user account is leaked, other users will not be affected.
  • Figure 14 is a block diagram of a device for transmitting messages according to an exemplary embodiment, applied to a terminal. As shown in Figure 14, the device includes:
  • the acquisition module 1401 is used to obtain the user identification information, service request data and the access key pre-allocated for the current user by the default server.
  • the default server is pre-deployed between the terminal and the cloud server.
  • Request message generation module 1402 configured to generate a cloud service access request message based on the user identification information, the service request data and the access key, where the cloud service access request message includes the domain name address of the preset server information;
  • the second sending module 1403 is configured to send the cloud service access request message to the default server, so that the default server can verify the signature of the cloud service access request message if it passes.
  • the cloud service access request message is re-signed to obtain a new cloud service access request message, and the new cloud service access request message is sent to the cloud server.
  • the service request data includes vendor identification information of the cloud vendor corresponding to the cloud server to be accessed by the current user
  • the request message generation module 1402 is configured to obtain the cloud vendor according to the vendor identification information.
  • the cloud service interface address of the cloud server; generating domain name address information based on the cloud service interface address and the preset domain name suffix corresponding to the preset server; based on the access key, the user identification information and the business request data Generate a third signature using the signature algorithm provided by the cloud server; generate the cloud service access request message based on the third signature, the user identification information, the service request data, and the domain name address information.
  • the terminal can send the cloud service access request message sent by the terminal to the default server by adjusting the cloud service interface address of the cloud vendor, adding the default domain name suffix corresponding to the default server after the cloud service interface address.
  • the preset server performs unified account verification for users currently accessing the cloud server, and also allows the management department to audit and detect the cloud service access request message through the preset server, achieving controllable access to the cloud service. It reduces the security risks of cloud service data access.
  • the cloud service access request messages of each user are uniformly detected and managed based on the preset server.
  • the management department can Deleting the user's account through the preset server eliminates the need to log in to multiple cloud vendor platforms to perform deletion operations separately, thereby greatly reducing the maintenance and management costs of the account.
  • there is no need to configure separate accounts for each user in the cloud vendor. many Users can share a real key, and only need to assign a pseudo signature key to each user to achieve account isolation. When a single user account is leaked, other users will not be affected.
  • Terminal devices in the embodiments of the present disclosure may include, but are not limited to, mobile phones, notebook computers, digital broadcast receivers, personal digital assistants (Personal Digital Assistant, PDA), tablet computers (Portable Android Device, PAD), portable multimedia players Mobile terminals such as (Portable Media Player, PMP), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), and fixed terminals such as digital TV (Television), desktop computers, etc.
  • PDA Personal Digital Assistant
  • PAD Portable multimedia players Mobile terminals
  • PMP Portable Media Player
  • vehicle-mounted terminals such as vehicle-mounted navigation terminals
  • fixed terminals such as digital TV (Television), desktop computers, etc.
  • the electronic device shown in FIG. 15 is only an example, and should not bring any limitations to the functions and scope of use of the embodiments of the present disclosure.
  • the electronic device 1500 may include a processing device (such as a central processing unit, a graphics processor, etc.) 1501, which may process data according to a program stored in a read-only memory (Read Only Memory, ROM) 1502 or from a storage device 1508
  • the program loaded into the random access memory (Random Access Memory, RAM) 1503 performs various appropriate actions and processing.
  • RAM 1503 various programs and data required for the operation of the electronic device 1500 are also stored.
  • the processing device 1501, ROM 1502 and RAM 1503 are connected to each other via a bus 1504.
  • An input/output (I/O) interface 1505 is also connected to bus 1504.
  • the following devices can be connected to the I/O interface 1505: input devices 1506 including, for example, a touch screen, touch pad, keyboard, mouse, camera, microphone, accelerometer, gyroscope, etc.; including, for example, a Liquid Crystal Display (LCD) , an output device 1507 such as a speaker, a vibrator, etc.; a storage device 1508 including a magnetic tape, a hard disk, etc.; and a communication device 1509. Communication device 1509 may allow electronic device 1500 to communicate wirelessly or wiredly with other devices to exchange data.
  • FIG. 15 illustrates electronic device 1500 with various means, it should be understood that implementation or availability of all illustrated means is not required. More or fewer means may alternatively be implemented or provided.
  • embodiments of the present disclosure include a computer program product including a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the method illustrated in the flowchart.
  • the computer program may be downloaded and installed from the network via communication device 1509, or from storage device 1508, or from ROM 1502.
  • the processing device 1501 When the computer program is executed by the processing device 1501, the above-mentioned functions defined in the method of the embodiment of the present disclosure are performed.
  • Embodiments of the present disclosure also provide a computer program.
  • the computer program is stored in a readable storage medium.
  • One or more processors of an electronic device can read the computer program from the readable storage medium.
  • One or more processors execute the computer program, so that the electronic device executes the solution provided by any of the above embodiments.
  • the computer-readable medium mentioned above in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium, or any combination of the above two.
  • the computer-readable storage medium may be, for example, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or any combination thereof.
  • Computer readable storage media may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard drive, random access memory (RAM), read only memory (ROM), removable Programmable Read-Only Memory (Erasable Programmable Read-Only Memory, EPROM or flash memory), optical fiber, Portable Compact Disk Read-Only Memory (CD-ROM), optical storage device, magnetic storage device, or the above Any suitable combination.
  • a computer-readable storage medium may be any tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device.
  • a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, wherein Contains computer-readable program code. Such propagated data signals may take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above.
  • a computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device .
  • Program code contained on a computer-readable medium can be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency, Radio Frequency), etc., or any suitable combination of the above.
  • the client and server can communicate using any currently known or future developed network protocol, such as HyperText Transfer Protocol (HTTP), and can communicate with digital data in any form or medium.
  • HTTP HyperText Transfer Protocol
  • Communications e.g., communications network
  • Examples of communication networks include local area networks (LANs), wide area networks (WANs), the Internet (e.g., the Internet), and end-to-end networks (e.g., ad hoc end-to-end networks), as well as any current network for knowledge or future research and development.
  • LANs local area networks
  • WANs wide area networks
  • the Internet e.g., the Internet
  • end-to-end networks e.g., ad hoc end-to-end networks
  • the above-mentioned computer-readable medium may be included in the above-mentioned electronic device; it may also exist independently without being assembled into the electronic device.
  • the computer-readable medium carries one or more programs.
  • the electronic device When the one or more programs are executed by the electronic device, the electronic device: receives the cloud service access request message sent by the terminal; and accesses the cloud service according to the The request message determines the cloud service interface address to be accessed; performs signature verification on the cloud service access request message according to the cloud service interface address, and if the verification passes, re-signs the cloud service access request message, Obtain a new cloud service access request message; send the new cloud service access request message to the cloud server according to the cloud service interface address.
  • the computer-readable medium carries one or more programs.
  • the electronic device obtains the user identification information of the current user, service request data, and the default server.
  • the access key pre-assigned by the current user, the preset server is a pre-deployed server that transmits messages between the terminal and the cloud server; according to the user identification information, the service request data and the access The key generates a cloud service access request message; and sends the cloud service access request message to the preset server, so that the preset server can verify the signature of the cloud service access request message if it passes.
  • the cloud service access request message is re-signed to obtain a new cloud service access request message, and the new cloud service access request message is sent to the cloud server.
  • Computer program code for performing the operations of the present disclosure may be written in one or more programming languages, including but not limited to object-oriented programming languages—such as Java, Smalltalk, C++, and Includes conventional procedural programming languages - such as "C" or similar programming languages.
  • the program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server.
  • the remote computer can be connected to the user's computer through any kind of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (such as an Internet service provider). connected via the Internet).
  • LAN local area network
  • WAN wide area network
  • Internet service provider such as an Internet service provider
  • each block in the flowchart or block diagram may represent a module, segment, or portion of code that contains one or more logic functions that implement the specified executable instructions.
  • the boxes marked The functions may occur out of the order noted in the figures. For example, two blocks shown one after another may actually execute substantially in parallel, or they may sometimes execute in the reverse order, depending on the functionality involved.
  • each block of the block diagram and/or flowchart illustration, and combinations of blocks in the block diagram and/or flowchart illustration can be implemented by special purpose hardware-based systems that perform the specified functions or operations. , or can be implemented using a combination of specialized hardware and computer instructions.
  • the modules involved in the embodiments of the present disclosure can be implemented in software or hardware.
  • the name of a module does not constitute a limitation on the module itself under certain circumstances.
  • the first receiving module can also be described as a "module that receives request messages.”
  • exemplary types of hardware logic components include: Field-Programmable Gate Array (FPGA), Application Specific Integrated Circuit (Application Specific Integrated Circuit, ASIC), Application Specification Standard Product (Application Specification) Specific Standard Product (ASSP), System-on-a-chip (SOC), Complex Programmable Logic Device (CPLD), etc.
  • FPGA Field-Programmable Gate Array
  • ASIC Application Specific Integrated Circuit
  • ASSP Application Specification Standard Product
  • SOC System-on-a-chip
  • CPLD Complex Programmable Logic Device
  • a machine-readable medium may be a tangible medium that may contain or store a program for use by or in connection with an instruction execution system, apparatus, or device.
  • the machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium.
  • Machine-readable media may include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or devices, or any suitable combination of the foregoing.
  • machine-readable storage media would include one or more wire-based electrical connections, laptop disks, hard drives, random access memory (RAM), read only memory (ROM), erasable programmable read only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above.
  • RAM random access memory
  • ROM read only memory
  • EPROM or flash memory erasable programmable read only memory
  • CD-ROM portable compact disk read-only memory
  • magnetic storage device or any suitable combination of the above.
  • Example 1 provides a method of transmitting messages, which is applied to a preset server.
  • the preset server is a pre-deployed server that transmits messages between a terminal and a cloud server.
  • the method includes: receiving a cloud service access request message sent by the terminal, the cloud service access request message including the domain name address information of the preset server; and determining the cloud service interface to be accessed according to the cloud service access request message. Address; perform signature verification on the cloud service access request message according to the cloud service interface address, and if the verification passes, re-sign the cloud service access request message to obtain a new cloud service access request message; Send the new cloud service access request message to the cloud server according to the cloud service interface address.
  • Example 2 provides the method of Example 1. Determining the cloud service interface address to be accessed based on the domain name address information includes: obtaining a preset domain name suffix corresponding to the preset server. ; Obtain the domain name address information from the cloud service access request message; determine the cloud service interface address from the domain name address information according to the preset domain name suffix.
  • Example 3 provides the method of Example 1, the cloud service access request message includes the user identification information of the current user and business request data, and the service request data includes the current user's pending request. Vendor identification information of the cloud vendor corresponding to the accessed cloud server.
  • the signature verification of the cloud service access request message based on the cloud service interface address includes: determining the cloud server corresponding to the cloud service interface address based on the cloud service interface address.
  • Signature algorithm Obtain the first key corresponding to the current user according to the user identification information and the manufacturer identification information, and the first key is pre-generated by the default server; According to the first key, the The user identification information and the service request data use the signature algorithm to generate a first signature; and the cloud service access request message is signature verified based on the first signature.
  • Example 4 provides the method of Example 3, wherein re-signing the cloud service access request message to obtain a new cloud service access request message includes: according to the user identification information and the manufacturer identification information to obtain the second key corresponding to the cloud server.
  • the second key is pre-generated by the cloud server; according to the second key, the user identification information and the business
  • the request data uses the signature algorithm to generate a second signature; the cloud service access request message is re-signed according to the second signature to obtain the new cloud service access request message.
  • Example 5 provides the method of any one of Examples 1-4, the method further includes: receiving a cloud service sent by the cloud server according to the new cloud service access request message. access response message, and send the cloud service access response message to the terminal.
  • Example 6 provides the method of Example 5. After receiving the cloud service access response message sent by the cloud server according to the new cloud service access request message, the method It also includes: generating an access log according to the new cloud service access request message and the cloud service access response message, where the access log is used to record the current user's cloud service access matters.
  • Example 7 provides a method for transmitting messages, applied to a terminal.
  • the method includes: obtaining the user identification information and service request data of the current user, and presetting the server for the current user.
  • An access key pre-assigned by the user, and the preset server is a pre-deployed server that transmits messages between the terminal and the cloud server; generated based on the user identification information, the service request data and the access key Cloud service access request message, the cloud service access request message includes the domain name address information of the default server; send the cloud service access request message to the default server, so that the default server can If the signature verification of the cloud service access request message passes, the cloud service access request message is re-signed to obtain a new cloud service access request message, and the new cloud service access request message is sent to the cloud service access request message.
  • Cloud Server
  • Example 8 provides the method of Example 7, the service request data includes the vendor identification information of the corresponding cloud vendor of the cloud server to be accessed by the current user, and according to Generating a cloud service access request message from the user identification information, the service request data and the access key includes: obtaining the cloud service interface address of the cloud server according to the manufacturer identification information; and obtaining the cloud service interface address according to the cloud service interface address and the access key.
  • Example 9 provides a device for transmitting messages, which is applied to a preset server.
  • the preset server is a pre-deployed server that transmits messages between a terminal and a cloud server.
  • the device includes: a first receiving module for receiving a cloud service access request message sent by the terminal, where the cloud service access request message includes the domain name address information of the preset server; a determining module for receiving the cloud service access request message according to the The cloud service access request message determines the cloud service interface address to be accessed; the verification module is used to perform signature verification on the cloud service access request message according to the cloud service interface address, and if the verification passes, verify the cloud service interface address.
  • the service access request message is re-signed to obtain a new cloud service access request message; the first sending module is configured to send the new cloud service access request message to the cloud server according to the cloud service interface address.
  • Example 10 provides the device of Example 9.
  • the determination module is configured to obtain the preset domain name suffix corresponding to the preset server; obtain it from the cloud service access request message.
  • the domain name address information determining the cloud service interface address from the domain name address information according to the preset domain name suffix.
  • Example 11 provides the apparatus of Example 9, the cloud service access request message includes user identification information of the current user and service request data, and the service request data includes the current user to-be-requested message.
  • Example 12 provides the device of Example 11, the verification module is used to obtain the second key corresponding to the cloud server according to the user identification information and the manufacturer identification information.
  • the second key is pre-generated by the cloud server; the second signature is generated using the signature algorithm according to the second key, the user identification information and the service request data; according to the second The signature re-signs the cloud service access request message to obtain the new cloud service access request message.
  • Example 13 provides the device of any one of Examples 9-12, the device further comprising:
  • the second receiving module is configured to receive a cloud service access response message sent by the cloud server according to the new cloud service access request message, and send the cloud service access response message to the terminal.
  • Example 14 provides the device of Example 13, the device further comprising: a log generation module, configured to generate a log according to the new cloud service access request message and the cloud service access response message. Generate access logs, which are used to record the current user's cloud service access matters.
  • Example 15 provides a device for transmitting messages, applied to a terminal, and the device includes:
  • An acquisition module configured to acquire the user identification information, service request data, and access key pre-allocated for the current user by a preset server, which is pre-deployed between the terminal and the cloud server.
  • Server that transmits messages
  • a request message generation module configured to generate a cloud service access request message based on the user identification information, the service request data and the access key, where the cloud service access request message includes the domain name address information of the preset server ;
  • the second sending module is configured to send the cloud service access request message to the default server, so that the default server can verify the cloud service access request message if the signature verification is passed.
  • the service access request message is re-signed to obtain a new cloud service access request message, and the new cloud service access request message is sent to the cloud server.
  • Example 16 provides the apparatus of Example 15, the service request data includes vendor identification information of the corresponding cloud vendor of the cloud server to be accessed by the current user, and the request A message generation module, configured to obtain the cloud service interface address of the cloud server according to the manufacturer identification information; generate domain name address information according to the cloud service interface address and the preset domain name suffix corresponding to the preset server; according to the The access key, the user identification information and the service request data use the signature algorithm provided by the cloud server to generate a third signature; according to the third signature, the user identification information, the service request data and the The domain name address information generates the cloud service access request message.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Information Transfer Between Computers (AREA)
  • Computer And Data Communications (AREA)

Abstract

本公开涉及一种传输消息的方法、装置、存储介质和电子设备，可以通过预先部署在终端和云服务器之间的预设服务器接收所述终端发送的云服务访问请求消息；所述云服务访问请求消息中包括所述预设服务器的域名地址信息；预设服务器根据所述云服务访问请求消息确定待访问的云服务接口地址，并根据所述云服务接口地址对所述云服务访问请求消息进行签名验证，并在验证通过的情况下，对所述云服务访问请求消息进行重新签名，得到新的云服务访问请求消息，之后可以根据所述云服务接口地址将所述新的云服务访问请求消息发送至所述云服务器。

Description

传输消息的方法、装置、存储介质及电子设备
本公开要求于2022年03月29日提交中国专利局、申请号为202210324115.0、申请名称为“传输消息的方法、装置、存储介质及电子设备”的中国专利申请的优先权，其全部内容通过引用结合在本公开中。
技术领域
本公开涉及云服务访问的领域，具体地，涉及一种传输消息的方法、装置、存储介质及电子设备。
背景技术
云服务厂商提供了一系列的服务能力，开发者可以通过厂商提供的应用程序接口(Application Programming Interface，API)来使用和管理这些能力，在调用API的过程中，需要使用厂商提供的接口访问密钥对发出的业务请求进行签名，签名的算法通常是开放的，用户只需要获取到账号的密钥就可以对该业务请求进行签名，实现相关功能的接口调用。
实际应用场景中，当有多个用户使用同一个云服务时，为了对资源的权限进行控制，一般会独立配置多个不同权限的账号，每个账号访问自己所需要的资源，但由于用户直接访问的是云服务厂商的接口，管理部门无法对各个用户的云服务访问请求进行审计和检测，导致云服务数据访问存在安全风险的问题。
发明内容
提供该部分内容以便以简要的形式介绍构思，这些构思将在后面的具体实施方式部分被详细描述。该部分内容并不旨在标识要求保护的技术方案的关键特征或必要特征，也不旨在用于限制所要求的保护的技术方案的范围。
第一方面，本公开提供一种传输消息的方法，应用于预设服务器，所述预设服务器为预先部署的在终端和云服务器之间传输消息的服务器，所述方法包括：
接收所述终端发送的云服务访问请求消息，所述云服务访问请求消息中包括所述预设服务器的域名地址信息；
根据所述云服务访问请求消息确定待访问的云服务接口地址；
根据所述云服务接口地址对所述云服务访问请求消息进行签名验证，并在验证通过的情况下，对所述云服务访问请求消息进行重新签名，得到新的云服务访问请求消息；
根据所述云服务接口地址将所述新的云服务访问请求消息发送至所述云服务器。
第二方面，提供一种传输消息的方法，应用于终端，所述方法包括：
获取当前用户的用户标识信息、业务请求数据以及预设服务器为所述当前用户预先分配的访问密钥，所述预设服务器为预先部署的在所述终端和云服务器之间传输消息的服务器；
根据所述用户标识信息、所述业务请求数据以及所述访问密钥生成云服务访问请求消息，所述云服务访问请求消息中包括所述预设服务器的域名地址信息；
将所述云服务访问请求消息发送至所述预设服务器，以便所述预设服务器在对所述云服务访问请求消息进行签名验证并验证通过的情况下，对所述云服务访问请求消息进行重新签名，得到新的云服务访问请求消息，并将所述新的云服务访问请求消息发送至所述云服务器。
第三方面，提供一种传输消息的装置，应用于预设服务器，所述预设服务器为预先部署的在终端和云服务器之间传输消息的服务器，所述装置包括：
第一接收模块，用于接收所述终端发送的云服务访问请求消息，所述云服务访问请求消息中包括所述预设服务器的域名地址信息；
确定模块，用于根据所述云服务访问请求消息确定待访问的云服务接口地址；
验证模块，用于根据所述云服务接口地址对所述云服务访问请求消息进行签名验证，并在验证通过的情况下，对所述云服务访问请求消息进行重新签名，得到新的云服务访问请求消息；
第一发送模块，用于根据所述云服务接口地址将所述新的云服务访问请求消息发送至所述云服务器。
第四方面，提供一种传输消息的装置，应用于终端，所述装置包括：
获取模块，用于获取当前用户的用户标识信息、业务请求数据以及预设服务器为所述当前用户预先分配的访问密钥，所述预设服务器为预先部署的在所述终端和云服务器之间传输消息的服务器；
请求消息生成模块，用于根据所述用户标识信息、所述业务请求数据以及所述访问密钥生成云服务访问请求消息，所述云服务访问请求消息中包括所述预设服务器的域名地址信息；
第二发送模块，用于将所述云服务访问请求消息发送至所述预设服务器，以便所述预设服务器在对所述云服务访问请求消息进行签名验证并验证通过的情况下，对所述云服务访问请求消息进行重新签名，得到新的云服务访问请求消息，并将所述新的云服务访问请求消息发送至所述云服务器。
第五方面，提供一种计算机可读存储介质，其上存储有计算机程序，该程序被处理装置执行时实现本公开第一方面或第二方面所述方法的步骤。
第六方面，提供一种电子设备，包括：存储装置，其上存储有至少一个计算机程序；至少一个处理装置，用于执行所述存储装置中的所述至少一个计算机程序，以实现本公开第一方面或第二方面所述方法的步骤。
第七方面，提供一种计算机程序产品，包括计算机指令，该计算机指令被处理装置执行时实现本公开第一方面或第二方面所述方法的步骤。
第八方面，提供一种计算机程序，该计算机程序被处理装置执行时实现本公开第一方面或第二方面所述方法的步骤。
本公开的其他特征和优点将在随后的具体实施方式部分予以详细说明。
附图说明
结合附图并参考以下具体实施方式，本公开各实施例的上述和其他特征、优点及方面将变得更加明显。贯穿附图中，相同或相似的附图标记表示相同或相似的元素。应当理解附图是示意性的，元件和元素不一定按照比例绘制。在附图中：
图1是一种现有的云服务访问模式下的消息传输示意图；
图2是一种现有的云服务访问模式下的账号分配示意图；
图3是根据一示例性实施例示出的一种传输消息的方法的流程图；
图4是一种现有的云服务访问模式下的消息传输示意图；
图5是根据一示例性实施例示出的一种传输消息的过程示意图；
图6是根据一示例性实施例示出的一种传输消息的方法的流程图；
图7是根据一示例性实施例示出的一种传输消息的方法的流程图；
图8是根据一示例性实施例示出的一种传输消息的方法的流程图；
图9是根据一示例性实施例示出的一种传输消息的方法的流程图；
图10是根据一示例性实施例示出的一种传输消息的过程示意图；
图11是基于定制化SDK的消息传输示意图；
图12是根据一示例性实施例示出的一种传输消息的装置的框图；
图13是根据一示例性实施例示出的一种传输消息的装置的框图；
图14是根据一示例性实施例示出的一种传输消息的装置的框图；
图15是根据一示例性实施例示出的一种电子设备的结构框图。
具体实施方式
下面将参照附图更详细地描述本公开的实施例。虽然附图中显示了本公开的某些实施例，然而应当理解的是，本公开可以通过各种形式来实现，而且不应该被解释为限于这里阐述的实施例，相反提供这些实施例是为了更加透彻和完整地理解本公开。应当理解的是，本公开的附图及实施例仅用于示例性作用，并非用于限制本公开的保护范围。
应当理解，本公开的方法实施方式中记载的各个步骤可以按照不同的顺序执行，和/或并行执行。此外，方法实施方式可以包括附加的步骤和/或省略执行示出的步骤。本公开的范围在此方面不受限制。
本文使用的术语“包括”及其变形是开放性包括，即“包括但不限于”。术语“基于”是“至少部分地基于”。术语“一个实施例”表示“至少一个实施例”；术语“另一实施例”表示“至少一个另外的实施例”；术语“一些实施例”表示“至少一些实施例”。其他术语的相关定义将在下文描述中给出。
需要注意，本公开中提及的“第一”、“第二”等概念仅用于对不同的装置、模块或单元进行区分，并非用于限定这些装置、模块或单元所执行的功能的顺序或者相互依存关系。
需要注意，本公开中提及的“一个”、“多个”的修饰是示意性而非限制性的，本领域技术人员应当理解，除非在上下文另有明确指出，否则应该理解为“一个或多个”。
本公开实施方式中的多个装置之间所交互的消息或者信息的名称仅用于说明性的目的，而并不是用于对这些消息或信息的范围进行限制。
本公开中所有获取信号、信息或数据的动作都是在遵照所在地国家相应的数据保护法规政策的前提下，并获得由相应装置所有者给予授权的情况下进行的。
可以理解的是，在使用本公开各实施例公开的技术方案之前，均应当依据相关法律法规通过恰当的方式对本公开所涉及个人信息的类型、使用范围、使用场景等告知用户并获得用户的授权。
例如，在响应于接收到用户的主动请求时，向用户发送提示信息，以明确地提示用户，其请求执行的操作将需要获取和使用到用户的个人信息。从而，使得用户可以根据提示信息来自主地选择是否向执行本公开技术方案的操作的电子设备、应用程序、服务器或存储介质等软件或硬件提供个人信息。
作为一种可选的但非限定性的实现方式，响应于接收到用户的主动请求，向用户发送提示信息的方式例如可以是弹窗的方式，弹窗中可以以文字的方式呈现提示信息。此外，弹窗中还可以承载供用户选择“同意”或者“不同意”向电子设备提供个人信息的选择控件。
可以理解的是，上述通知和获取用户授权过程仅是示意性的，不对本公开的实现方式构成限定，其它满足相关法律法规的方式也可应用于本公开的实现方式中。
同时，可以理解的是，本技术方案所涉及的数据(包括但不限于数据本身、数据的获取或使用)应当遵循相应法律法规及相关规定的要求。
本公开主要应用于通过调用云厂商提供的API来访问和使用云服务资源的场景中，如图1所示，在使用接口时，需要使用厂商提供的接口访问密钥对发出的原始请求进行签名，然后直接将签名请求发送至云服务器，签名的算法通常是开放的，用户只需要获取到账号的密钥就可以对云服务访问请求进行签名，实现相关功能的接口调用，但由于用户直接访问的是云服务厂商的接口，管理部门无法对各个用户的云服务访问请求进行审计和检测，导致云服务数据访问存在安全风险的问题。
如图2所示，实际应用场景中，当有多个用户使用同一个云服务时，为了对资源的权限进行控制，一般会独立配置多个不同权限的账号，每个账号访问自己所需要的资源，并且同一用户若需要访问多个云厂商提供的云服务，还需要分别针对每个厂商配置不同的账号，但是，厂商账号会有泄露的风险(比如拥有该账号的用户离职，或者该账号丢失等情况)，若某一用户的云服务厂商账号泄露，需要到不同云厂商的管理平台上进行删除操作，另一种可能的场景中，若对某一用户的云服务访问权限进行调整，也需要登录各个云厂商平台进行操作，因此，现有技术中无论是账号泄露还是权限调整，其账号的维护管理均比较困难。
为解决上述存在的问题，本公开提供一种传输消息的方法、装置、存储介质和电子设备，在终端和云服务器之间预先部署用于传输消息的预设服务器，在终端侧调整云厂商接口访问地址(即在原有的接口访问地址中加入预先为预设服务器配置的预设域名后缀后得到域名地址信息)，并使用预设服务器提供的访问密钥对云服务访问请求消息进行签名后，可以将终端发送的云服务访问请求消息引流至预设服务器，由该预设服务器对当前要访问云服务器的用户进行统一的账号验证，也使得管理部门可以通过该预设服务器对该云服务访问请求消息进行审计和检测，对用户使用的功能、频次等进行统一检测管理，实现了云服务访问的可控性，降低了云服务数据访问的安全风险。
通过上述技术方案，预先部署在终端和云服务器之间用于传输消息的预设服务器可以接收所述终端发送的云服务访问请求消息，所述云服务访问请求消息中包括所述预设服务器的域名地址信息；根据所述云服务访问请求消息确定待访问的云服务接口地址；根据所述云服务接口地址对所述云服务访问请求消息进行签名验证，并在验证通过的情况下，对所述云服务访问请求消息进行重新签名，得到新的云服务访问请求消息；根据所述云服务接口地址将所述新的云服务访问请求消息发送至所述云服务器，这样，可以根据该域名地址信息将终端发送的云服务访问请求消息引流至预设服务器，由该预设服务器对当前要访问云服务器的用 户进行统一的账号验证，也使得管理部门可以通过该预设服务器对该云服务访问请求消息进行审计和检测，实现了云服务访问的可控性，降低了云服务数据访问的安全风险。
另外，基于预设服务器对各个用户的云服务访问请求消息进行统一检测和管理，当某一用户对应的账号(一个账号或者多个云厂商对应的多个账号)泄露的情况下，管理部门可以通过该预设服务器删除该用户的账号，无需登录多个云厂商平台分别进行删除操作，从而大大降低了账号的维护管理成本，与此同时，不需要在云厂商中为每个用户单独配置账号，多个用户可以共用一个真实密钥，只需要为每个用户分配一个伪签名密钥即可达到账号隔离的效果，当发生单个用户账号的泄露时不会影响其他用户。
下面结合附图对本公开的具体实施方式进行详细说明。
图3是根据一示例性实施例示出的一种传输消息的方法的流程图，该方法应用于预设服务器，该预设服务器为预先部署的在终端和云服务器之间传输消息的服务器，该预设服务器可以理解为是在终端和服务器之间预设的中间代理服务，如图3所示，该方法包括以下步骤：
在步骤S301中，接收该终端发送的云服务访问请求消息，该云服务访问请求消息中包括该预设服务器的域名地址信息。
其中，该云服务访问请求消息包括要访问云服务的当前用户(例如，需要使用云服务资源的开发者)的用户标识信息、具体的业务请求数据以及该预设服务器的域名地址信息，其中，该域名地址信息中包括当前用户待访问的云服务器对应的云厂商的云服务接口地址和该预设服务器对应的预设域名后缀，通过在该云服务接口地址后加入该预设域名后缀，可以将该云服务访问请求消息引流至该预设服务器，以便通过该预设服务器对当前要访问云服务器的用户进行统一的账号验证，也使得管理部门可以通过该预设服务器对该云服务访问请求消息进行审计和检测。
在步骤S302中，根据该云服务访问请求消息确定待访问的云服务接口地址。
在本步骤中，可以获取该预设服务器对应的预设域名后缀；从该云服务访问请求消息中获取域名地址信息；这样，可以根据该预设域名后缀从该域名地址信息中确定该云服务接口地址。
上述已经提及，为了将该云服务访问请求消息引流至该预设服务器，可以预先为该预设服务器配置一个预设域名后缀(即该预设域名后缀)，之后可以在云服务接口地址中添加该预设域名后缀，得到该域名地址信息，这样，在根据该预设域名后缀从该域名地址信息中确定该云服务接口地址的过程中，可以将该域名地址信息中的预设域名后缀删除后还原出原有的云服务接口地址。
示例地，图4是现有技术中访问云服务时的访问模式示意图，在原有的模式下，用户可以直接使用云厂商的接口访问地址和密钥访问接口服务，如图4所示，客户端直接可以使用A厂商的云服务接口地址api.a.com访问A厂商接口，直接可以使用B厂商的云服务接口地址api.b.com访问B厂商接口，直接可以使用C厂商的云服务接口地址api.c.com访问C厂商接口，在本公开中，如图5所示，为了将该云服务访问请求消息引流至该预设服务器(即图5中的中间代理)，可以预先为该预设服务器配置一个泛域名*.fusion-api.com，这样，可以在原有的云服务接口地址中添加预设域名后缀.fusion-api.com，就能够完成请求的引流，该预设服务器在接收到请求消息后，可以将请求消息中该域名地址信息中的预设域名后缀删除后还原出原有的云服务接口地址，如图5所示，预设服务器接收到的访问A厂商的云服务访问请求 消息中的域名地址信息为api.a.com.fusion-api.com，对该请求消息进行还原后，可以得到A厂商原始的云服务接口地址为api.a.com，上述示例仅是举例说明，本公开对此不作限定。
实际应用场景中，为了对资源的访问权限进行控制，预设服务器可以预先为不同的用户访问不同的接口分别配置不同的账号(即Access Key Id，AK)，当前用户的用户标识信息包括该AK账号，不同的用户标识信息对应不同的云服务接口，因此，在本步骤另一种可能的实现方式中，还可以根据该云服务访问请求消息中的用户标识信息确定该云服务接口地址，例如，预设服务器可以预先在数据库中存储AK账号与云服务接口的对应关系，服务器在接收到该云服务访问请求消息后，可以从该云服务访问请求消息中的用户标识信息中读取到AK账号，之后可以通过查表的方式获取到当前用户待访问的云服务接口，进而确定出该云服务接口地址。
在步骤S303中，根据该云服务接口地址对该云服务访问请求消息进行签名验证，并在验证通过的情况下，对该云服务访问请求消息进行重新签名，得到新的云服务访问请求消息。
其中，该云服务访问请求消息包括当前用户的用户标识信息和业务请求数据，该业务请求数据包括该当前用户待访问的云服务器的对应的云厂商的厂商标识信息。
图6是根据一示例性实施例示出的一种传输消息的方法的流程图，如图6所示，可以通过执行以下步骤根据该云服务接口地址对该云服务访问请求消息进行签名验证：
在步骤S3031中，根据该云服务接口地址确定该云服务器对应的签名算法。
实际应用场景中，不同的云厂商对应不同的签名算法，并且每个云厂商均对外公开该签名算法，本步骤中，可以根据该云服务接口地址确定当前待访问的云服务器对应的云厂商，进而可以确定出该云厂商对应的签名算法。
在步骤S3032中，根据该用户标识信息和该厂商标识信息获取当前用户对应的第一密钥，该第一密钥为该预设服务器预先生成的。
相比较于云服务器对应的真实密钥，该第一密钥可以理解为是由预设服务器为用户生成的伪秘钥。
在一种可能的应用场景中，可以在预设服务器中预先存储用户、云厂商和该伪密钥的对应关系，这样，在本步骤中可以根据该用户标识信息和该厂商标识信息通过查表的方式获取到该第一密钥。
示例地，表1是预设服务器中存储的用户信息、厂商信息以及对应的密钥信息的对应关系，如表1所示，假设当前用户为用户u1，用户u1想要访问云厂商A提供的云服务资源，此种情况下，预设服务器可以从云服务访问请求消息中获取到用户标识信息u1和厂商标识信息A，之后可以通过查表1，确定出用户u1以及云厂商A对应的第一密钥即为FakeKey1，上述示例仅是举例说明，本公开对此不作限定。
表1
在步骤S3033中，根据该第一密钥、该用户标识信息以及该业务请求数据采用该签名算法生成第一签名。
本步骤可以根据该用户标识信息、该业务请求数据以及该第一密钥基于该签名算法重新计算得到该第一签名，具体的计算方式可以参考相关文献中的描述，在此不作限定。
在步骤S3034中，根据该第一签名对该云服务访问请求消息进行签名验证。
一种可能的实现方式中，可以将该第一签名与该云服务访问请求消息中的签名信息进行比对，若两者完全一致，确定该云服务访问请求消息验证通过，之后，即可对该云服务访问请求消息进行密钥替换，并将采用云服务器提供的真实密钥签名的请求消息发送至云服务器，以便实现对云服务器接口的调用。
在步骤S3035中，根据该用户标识信息和该厂商标识信息获取该云服务器对应的第二密钥，该第二密钥为该云服务器预先生成的。
其中，该第二密钥即为云服务器提供的真实密钥。
在本步骤中，预设服务器也可以通过查表的方式根据该用户标识信息和该厂商标识信息查找到对应的该第二密钥。
示例地，继续以表1为例，假设当前用户为用户u1，用户u1想要访问云厂商A提供的云服务资源，此种情况下，预设服务器可以从云服务访问请求消息中获取到用户标识信息u1和厂商标识信息A，之后可以通过查表1，确定出用户u1以及云厂商A对应的第二密钥即为RealKey1，上述示例仅是举例说明，本公开对此不作限定。
在步骤S3036中，根据该第二密钥、该用户标识信息以及该业务请求数据采用该签名算法生成第二签名。
同样地，本步骤可以根据第二密钥、该用户标识信息以及该业务请求数据基于该签名算法重新计算得到该第二签名。
在步骤S3037中，根据该第二签名对该云服务访问请求消息进行重新签名，得到该新的云服务访问请求消息。
在一种可能的实现方式中，可以将云服务访问请求消息中的原始签名替换为该第二签名，以实现根据该第二签名对该云服务访问请求消息进行重新签名，得到该新的云服务访问请求消息，其中，该原始签名即为终端采用预设服务器分配的伪秘钥生成的签名。
基于图6所示的步骤，预设服务器可以对终端发送的采用伪秘钥签名的云服务访问请求消息进行签名验证，并在验证通过的情况下，可以采用云服务器提供的真实密钥对该云服务访问请求消息进行重新签名，这样不仅可以实现对云服务访问账号的统一管理，还能对各个用户的云服务访问请求进行审计和检测，例如，可以及时掌握用户访问了哪些资源，用了哪些云服务接口功能，云厂商对当前用户请求的处理服务能力质量如何等(比如响应速度)，遇到了哪些问题等，进而可以评估用户使用的资源数据是否安全，也可以对云厂商的服务能力进行评估。
在步骤S304中，根据该云服务接口地址将该新的云服务访问请求消息发送至该云服务器。
采用上述方法，可以根据该域名地址信息将终端发送的云服务访问请求消息引流至预设服务器，由该预设服务器对当前要访问云服务器的用户进行统一的账号验证，也使得管理部门可以通过该预设服务器对该云服务访问请求消息进行审计和检测，实现了云服务访问的可控性，降低了云服务数据访问的安全风险。
另外，基于预设服务器对各个用户的云服务访问请求消息进行统一检测和管理，当某一用户对应的账号(一个账号或者多个云厂商对应的多个账号)泄露的情况下，管理部门可以通过该预设服务器删除该用户的账号，无需登录多个云厂商平台分别进行删除操作，从而大大降低了账号的维护管理成本，与此同时，不需要在云厂商中为每个用户单独配置账号，多个用户可以共用一个真实密钥，只需要为每个用户分配一个伪签名密钥即可达到账号隔离的效果，当发生单个用户账号的泄露时不会影响其他用户。
图7是根据图3所示实施例示出的一种传输消息的方法的流程图，如图7所示，该方法还包括：
在步骤S305中，接收该云服务器根据该新的云服务访问请求消息发送的云服务访问响应消息，并将该云服务访问响应消息发送至该终端。
其中，该云服务访问响应消息可以包括业务响应信息，预设服务器在将重新签名后的新的云服务访问请求消息发送至云服务器后，可以接收到云服务器返回的该云服务访问响应消息，之后可以将该云服务访问响应消息发送至该终端。
如图7所示，该方法还包括以下步骤：
在步骤S306中，根据该新的云服务访问请求消息和该云服务访问响应消息生成访问日志。
其中，该访问日志用于记录当前用户的云服务访问事项，该云服务访问事项包括当前用户访问的目标资源，当前用户使用的目标接口功能，云厂商对当前用户请求的处理服务能力质量(如响应速度)，当前访问是否遇到问题以及遇到何种问题，评估当前用户使用的资源数据是否安全等事项。
在本步骤中，可以根据该新的云服务访问请求消息、云服务访问响应消息以及请求消息发送时间，响应消息的接收时间等生成该访问日志，以实现对当前用户的云服务访问请求进行审计和检测。
图8是根据一示例性实施例示出的一种传输消息的方法的流程图，该方法可以应用于终端，如图8所示，该方法包括以下步骤：
在步骤S801中，获取当前用户的用户标识信息、业务请求数据以及预设服务器为该当前用户预先分配的访问密钥。
其中，该业务请求数据可以包括当前用户待访问的云服务器的对应的云厂商的厂商标识信息、实际的业务访问参数等信息，该预设服务器为预先部署的在该终端和云服务器之间传输消息的服务器，该预设服务器可以理解为是终端和服务器之间预设的中间代理服务，相比较于原有的云服务访问模式下，云服务器为用户分配的真实密钥，该访问密钥是指由该预设服务器为用户预先分配的伪秘钥。
在步骤S802中，根据该用户标识信息、该业务请求数据以及该访问密钥生成云服务访问请求消息，该云服务访问请求消息中包括该预设服务器的域名地址信息。
在本步骤中，可以根据该业务请求数据中的厂商标识信息获取该云服务器的云服务接口地址；根据该云服务接口地址和该预设服务器对应的预设域名后缀生成域名地址信息；根据该访问密钥、该用户标识信息以及该业务请求数据采用该云服务器提供的签名算法生成第三签名；根据该第三签名、该用户标识信息、该业务请求数据以及该域名地址信息生成该云服务访问请求消息。
本公开中为了通过该预设服务器对用户发送的云服务访问请求进行统一的检测和管理，需要将该云服务访问请求消息引流至该预设服务器，在一种可能的实现方式中，可以预先为该预设服务器配置一个泛域名，终端可以根据该泛域名调整每个云厂商的云服务接口地址，例如，A厂商的云服务接口地址为api.a.com，可以再改地址后添加一个预设域名后缀.fusion-api.com后生成域名地址信息，这样，终端可以根据该域名地址信息将该云服务访问请求消息发送至该预设服务器，从而实现请求消息的引流。
需要说明的是，可以预先设置该预设域名后缀与该预设服务器IP地址的对应关系，这样可以保证发送至该预设域名后缀对应的地址上的消息均可以引流至该预设服务器。
在生成该域名地址信息后，即可根据该访问密钥、该用户标识信息以及该业务请求数据采用该云服务器提供的签名算法计算得到该第三签名，具体生成该第三签名的过程可以参考相关文献中的描述，在此不作限定，在生成该第三签名后，即可根据该第三签名、该用户标识信息、该业务请求数据以及该域名地址信息生成该云服务访问请求消息。
在步骤S803中，将该云服务访问请求消息发送至该预设服务器。
这样该预设服务器在对该云服务访问请求消息进行签名验证通过的情况下，可以对该云服务访问请求消息进行重新签名，得到新的云服务访问请求消息，并将该新的云服务访问请求消息发送至该云服务器。
采用上述方法，终端可以通过调整云厂商的云服务接口地址，在该云服务接口地址后加入该预设服务器对应的预设域名后缀后，将终端发送的云服务访问请求消息发送至预设服务器，由该预设服务器对当前要访问云服务器的用户进行统一的账号验证，也使得管理部门可以通过该预设服务器对该云服务访问请求消息进行审计和检测，实现了云服务访问的可控性，降低了云服务数据访问的安全风险。
另外，基于预设服务器对各个用户的云服务访问请求消息进行统一检测和管理，当某一用户对应的账号(一个账号或者多个云厂商对应的多个账号)泄露的情况下，管理部门可以通过该预设服务器删除该用户的账号，无需登录多个云厂商平台分别进行删除操作，从而大大降低了账号的维护管理成本，与此同时，不需要在云厂商中为每个用户单独配置账号，多个用户可以共用一个真实密钥，只需要为每个用户分配一个伪签名密钥即可达到账号隔离的效果，当发生单个用户账号的泄露时不会影响其他用户。
图9是根据一示例性实施例示出的一种传输消息的方法的流程图，如图9所示，该方法包括以下步骤：
在步骤S901中，终端获取当前用户的用户标识信息、业务请求数据以及预设服务器为该当前用户预先分配的访问密钥。
其中，该当前用户一般是指当前时刻需要使用云服务资源的开发者，该业务请求数据可以包括当前用户待访问的云服务器的对应的云厂商的厂商标识信息、实际的业务访问参数等信息，该预设服务器为预先部署的在该终端和云服务器之间传输消息的服务器，该预设服务器可以理解为是终端和服务器之间预设的中间代理服务，相比较于原有的云服务访问模式下，云服务器为用户分配的真实密钥，该访问密钥是指由该预设服务器为用户预先分配的伪秘钥。
在步骤S902中，终端根据该用户标识信息、该业务请求数据以及该访问密钥生成云服务访问请求消息，该云服务访问请求消息中包括该预设服务器的域名地址信息。
其中，该业务请求数据包括该当前用户待访问的该云服务器的对应的云厂商的厂商标识信息，在本步骤中，终端可以根据该厂商标识信息获取该云服务器的云服务接口地址；根据该云服务接口地址和该预设服务器对应的预设域名后缀生成域名地址信息；根据该访问密钥、该用户标识信息以及该业务请求数据采用该云服务器提供的签名算法生成第三签名；根据该第三签名、该用户标识信息、该业务请求数据以及该域名地址信息生成该云服务访问请求消息。
在本公开中，为了通过该预设服务器对用户发送的云服务访问请求进行统一的检测和管理，需要将该云服务访问请求消息引流至该预设服务器，在一种可能的实现方式中，可以预先为该预设服务器配置一个泛域名，终端可以根据该泛域名调整每个云厂商的云服务接口地址，例如，A厂商的云服务接口地址为api.a.com，可以再改地址后添加一个预设域名后缀.fusion-api.com后生成域名地址信息，这样，终端可以根据该域名地址信息将该云服务访问请求消息发送至该预设服务器，从而实现请求消息的引流。
需要说明的是，可以预先设置该预设域名后缀与该预设服务器IP地址的对应关系，这样可以保证发送至该预设域名后缀对应的地址上的消息均可以引流至该预设服务器。
在步骤S903中，终端将该云服务访问请求消息发送至该预设服务器。
在步骤S904中，预设服务器根据该云服务访问请求消息确定待访问的云服务接口地址。
在本步骤中，可以获取该预设服务器对应的预设域名后缀，并从该云服务访问请求消息中获取域名地址信息，根据该预设域名后缀从该域名地址信息中确定该云服务接口地址，具体示例可以参考图3对应的实施例中的描述，在此不再赘述。
在另一种可能的实现方式中，不同的用户标识信息可以对应不同的云服务接口，因此本步骤还可以根据该云服务访问请求消息中的用户标识信息确定该云服务接口地址，例如，预设服务器可以预先在数据库中存储AK账号与云服务接口的对应关系，服务器在接收到该云服务访问请求消息后，可以从该云服务访问请求消息中的用户标识信息中读取到AK账号，之后可以通过查表的方式获取到当前用户待访问的云服务接口，进而确定出该云服务接口地址。
在步骤S905中，预设服务器根据该云服务接口地址对该云服务访问请求消息进行签名验证，并在验证通过的情况下，对该云服务访问请求消息进行重新签名，得到新的云服务访问请求消息。
其中，该云服务访问请求消息包括当前用户的用户标识信息和业务请求数据，该业务请求数据包括该当前用户待访问的云服务器的对应的云厂商的厂商标识信息。
在本步骤中，可以根据该云服务接口地址确定该云服务器对应的签名算法；根据该用户标识信息和该厂商标识信息获取当前用户对应的第一密钥，该第一密钥为该预设服务器预先生成的；根据该第一密钥、该用户标识信息以及该业务请求数据采用该签名算法生成第一签名；根据该第一签名对该云服务访问请求消息进行签名验证。
之后，可以根据该用户标识信息和该厂商标识信息获取该云服务器对应的第二密钥，该第二密钥为该云服务器预先生成的；根据该第二密钥、该用户标识信息以及该业务请求数据采用该签名算法生成第二签名；根据该第二签名对该云服务访问请求消息进行重新签名，得到该新的云服务访问请求消息。
其中，该相比较于云服务器对应的真实密钥，该第一密钥可以理解为是由预设服务器为用户生成的伪秘钥，该第二密钥即为云服务器提供的真实密钥。
本步骤的具体实现方式也可以参考图6对应的实施例中的相关描述，在此不再赘述。
在步骤S906中，预设服务器根据该云服务接口地址将该新的云服务访问请求消息发送至该云服务器。
在步骤S907中，预设服务器接收该云服务器根据该新的云服务访问请求消息发送的云服务访问响应消息，并将该云服务访问响应消息发送至该终端。
其中，该云服务访问响应消息可以包括业务响应信息，预设服务器在将重新签名后的新的云服务访问请求消息发送至云服务器后，可以接收到云服务器返回的该云服务访问响应消息，之后可以将该云服务访问响应消息发送至该终端。
在步骤S908中，预设服务器根据该新的云服务访问请求消息和该云服务访问响应消息生成访问日志，该访问日志用于记录当前用户的云服务访问事项。
其中，该访问日志用于记录当前用户的云服务访问事项，该云服务访问事项包括当前用户访问的目标资源，当前用户使用的目标接口功能，云厂商对当前用户请求的处理服务能力质量(如响应速度)，当前访问是否遇到问题以及遇到何种问题，评估当前用户使用的资源数据是否安全等事项。
在本步骤中，可以根据该新的云服务访问请求消息、云服务访问响应消息以及请求消息发送时间，响应消息的接收时间等生成该访问日志，以实现对当前用户的云服务访问请求进行审计和检测。
示例地，图10是根据一示例性实施例示出的一种在终端、预设服务器(即图10中的中间代理)和云服务器之间传输消息的过程示意图，终端侧先使用预设服务器分配的伪秘钥(即第一密钥)对原始的云服务访问请求消息进行签名，如图10所示，用户u1想要访问A厂商提供的云服务，在终端侧基于预设服务器分配的伪秘钥对请求消息进行签名后得到的云服务访问请求消息为“vendor＝A,user＝u1,sign＝signA(u1,FakeKey1)”，终端将该云服务访问请求消息发送至预设服务器，预设服务器在表1中查表获取到用户u1和厂商A对应的伪秘钥为FakeKey1，基于该伪秘钥FakeKey1和厂商A提供的签名算法重新生成签名后对请求消息“vendor＝A,user＝u1,sign＝signA(u1,FakeKey1)”进行签名验证，在验证通过后，根据用户u1和厂商A继续查表1获取到厂商A为用户u1分配的真实密钥RealKey1，然后根据该真实密钥RealKey1采用厂商A提供的签名算法重新生成签名后，将请求消息进行密钥替换后，得到新的云服务访问请求消息为“vendor＝A,user＝u1,sign＝signA(u1,RealKey1)”，然后预设服务器将该新的云服务访问请求消息发送至A厂商对应的云服务器，以实现对A厂商提供的云服务的资源访问，上述示例仅是举例说明，本公开对此不作限定。
采用上述方法，可以根据云服务访问请求消息中的域名地址信息将终端发送的云服务访问请求消息引流至预设服务器，由该预设服务器对当前要访问云服务器的用户进行统一的账号验证，也使得管理部门可以通过该预设服务器对该云服务访问请求消息进行审计和检测，实现了云服务访问的可控性，降低了云服务数据访问的安全风险。
基于预设服务器对各个用户的云服务访问请求消息进行统一检测和管理，当某一用户对应的账号(一个账号或者多个云厂商对应的多个账号)泄露的情况下，管理部门可以通过该预设服务器删除该用户的账号，无需登录多个云厂商平台分别进行删除操作，从而大大降低 了账号的维护管理成本，与此同时，不需要在云厂商中为每个用户单独配置账号，多个用户可以共用一个真实密钥，只需要为每个用户分配一个伪签名密钥即可达到账号隔离的效果，当发生单个用户账号的泄露时不会影响其他用户。
另外，基于上述的云服务访问模式，用户可以继续使用原有的厂商接口规范和软件开发工具包(Software Development Kit，SDK)，只需要在终端侧的SDK中在待访问的云厂商的接口访问地址后添加预设服务器对应的预设域名后缀即可，用户使用较方便，并且现有的云厂商的功能接口可以直接支持，通用型强，实现成本较低。
为了解决现有技术中在通过调用云厂商提供的API来访问和使用云服务资源时，由于用户直接访问的是云服务厂商的接口，管理部门无法对各个用户的云服务访问请求进行审计和检测，导致云服务数据访问存在安全风险的问题，本公开还可以通过开发统一网关的方式将所有的用户的云服务访问请求统一对接网关服务。
在一种可能的实现方式中，终端可以向网关发送第一请求消息，该第一请求消息用于请求从网关获取云服务资源信息，其中，终端可以使用网关提供的密钥以及网关提供的签名算法对该第一请求消息进行签名，网关在接收到该第一请求消息后，对该第一请求消息进行签名验证，并在验证通过的情况下，可以采用云厂商提供的密钥和签名算法对该第一请求消息进行重新签名后得到第二请求消息，然后将该第二请求消息发送至云服务器。
采用统一对接网关服务的方式，管理部门也可以通过该网关服务对用户的云服务访问请求进行审计和检测，实现了云服务访问的可控性，降低云服务数据访问的安全风险，与此同时，当某一用户对应的账号(一个账号或者多个云厂商对应的多个账号)泄露的情况下，管理部门也可以通过该网关服务删除该用户的账号，无需登录多个云厂商平台分别进行删除操作，从而降低了账号的维护管理成本，另外，不需要在云厂商中为每个用户单独配置账号，多个用户可以共用一个真实密钥，只需要为每个用户分配一个伪签名密钥即可达到账号隔离的效果，当发生单个用户账号的泄露时不会影响其他用户。
需要说明的是，用户使用网关服务，由网关服务去调用云厂商的接口，在预先配置该统一网关的过程中，需要对每个云厂商的每一个接口进行适配，但每个云厂商有多个产品，每个产品对应几十个开放接口，也就是说每个厂商一般可能会有上千个接口，统一网关需要将该厂商对应的上千个接口都封装起来，开发成本较高，针对不同的云厂商，对应的接口规范不一样，若在网关侧用一个接口去隐藏全部云厂商对应的接口功能，也会增加开发成本，并且采用这种统一网关，云厂商的SDK和文档不再可用，对于用户来说需要额外的学习成本。
为了解决现有技术中在通过调用云厂商提供的API来访问和使用云服务资源时，由于用户直接访问的是云服务厂商的接口，管理部门无法对各个用户的云服务访问请求进行审计和检测，导致云服务数据访问存在安全风险的问题，本公开还可以通过定制化SDK的方式进行云服务资源的访问，具体地，可以在终端侧的不同云厂商的SDK中添加统一的审计代码，以实现账号的获取以及访问请求的审计。
图11是根据一示例性实施例示出的一种基于定制化SDK进行云服务访问的传输消息过程示意图，如图11所示，终端可以向审计服务器发送第三请求消息(即图11中所示的步骤1)，该第三请求消息用于请求获取待访问的云服务器对应的厂商账号，并请求对该云服务访问请求进行审计，审计服务接收到该第三请求消息后可以对该云服务访问请求进行审计，还可以对该第三请求消息进行签名验证，在验证通过的情况下，可以将当前用户要访问的云服务器 对应的厂商账号发送至终端，之后终端可以采用审计服务发送的厂商账号和密钥信息对访问请求消息进行签名后发送至云服务器(即图11中所示的步骤2)。
因此，采用定制化SDK的方式，管理部门也可以通过该审计服务对用户的云服务访问请求进行审计和检测，实现了云服务访问的可控性，降低云服务数据访问的安全风险，与此同时，当某一用户对应的账号(一个账号或者多个云厂商对应的多个账号)泄露的情况下，管理部门也可以通过该审计服务删除该用户的账号，无需登录多个云厂商平台分别进行删除操作，从而降低了账号的维护管理成本。
需要说明的是，采用定制化SDK的方式，由于用户可能使用的是不同编程语言的SDK，采用这种方案需要对每个云厂商的每一种语言的SDK进行改造，这也会增加开发成本。
图12是根据一示例性实施例示出的一种传输消息的装置的框图，应用于预设服务器，所述预设服务器为预先部署的在终端和云服务器之间传输消息的服务器，如图12所示，所述装置包括：
第一接收模块1201，用于接收所述终端发送的云服务访问请求消息，所述云服务访问请求消息中包括所述预设服务器的域名地址信息；
确定模块1202，用于根据所述云服务访问请求消息确定待访问的云服务接口地址；
验证模块1203，用于根据所述云服务接口地址对所述云服务访问请求消息进行签名验证，并在验证通过的情况下，对所述云服务访问请求消息进行重新签名，得到新的云服务访问请求消息；
第一发送模块1204，用于根据所述云服务接口地址将所述新的云服务访问请求消息发送至所述云服务器。
可选地，所述确定模块1202，用于获取所述预设服务器对应的预设域名后缀；从所述云服务访问请求消息中获取所述域名地址信息；根据所述预设域名后缀从所述域名地址信息中确定所述云服务接口地址。
可选地，所述云服务访问请求消息包括当前用户的用户标识信息和业务请求数据，所述业务请求数据包括所述当前用户待访问的云服务器的对应的云厂商的厂商标识信息，所述验证模块1203，用于根据所述云服务接口地址确定所述云服务器对应的签名算法；根据所述用户标识信息和所述厂商标识信息获取当前用户对应的第一密钥，所述第一密钥为所述预设服务器预先生成的；根据所述第一密钥、所述用户标识信息以及所述业务请求数据采用所述签名算法生成第一签名；根据所述第一签名对所述云服务访问请求消息进行签名验证。
可选地，所述验证模块1203，用于根据所述用户标识信息和所述厂商标识信息获取所述云服务器对应的第二密钥，所述第二密钥为所述云服务器预先生成的；根据所述第二密钥、所述用户标识信息以及所述业务请求数据采用所述签名算法生成第二签名；根据所述第二签名对所述云服务访问请求消息进行重新签名，得到所述新的云服务访问请求消息。
可选地，图13是根据图12所示实施例示出的一种传输消息的装置的框图，如图13所示，该装置还包括：
第二接收模块1205，用于接收所述云服务器根据所述新的云服务访问请求消息发送的云服务访问响应消息，并将所述云服务访问响应消息发送至所述终端。
可选地，如图13所示，该装置还包括：
日志生成模块1206，用于根据所述新的云服务访问请求消息和所述云服务访问响应消息生成访问日志，所述访问日志用于记录当前用户的云服务访问事项。
采用上述装置，可以将终端发送的云服务访问请求消息引流至预设服务器，由该预设服务器对当前要访问云服务器的用户进行统一的账号验证，也使得管理部门可以通过该预设服务器对该云服务访问请求消息进行审计和检测，实现了云服务访问的可控性，降低了云服务数据访问的安全风险。
另外，基于预设服务器对各个用户的云服务访问请求消息进行统一检测和管理，当某一用户对应的账号(一个账号或者多个云厂商对应的多个账号)泄露的情况下，管理部门可以通过该预设服务器删除该用户的账号，无需登录多个云厂商平台分别进行删除操作，从而大大降低了账号的维护管理成本，与此同时，不需要在云厂商中为每个用户单独配置账号，多个用户可以共用一个真实密钥，只需要为每个用户分配一个伪签名密钥即可达到账号隔离的效果，当发生单个用户账号的泄露时不会影响其他用户。
图14是根据一示例性实施例示出的一种传输消息的装置的框图，应用于终端，如图14所示，所述装置包括：
获取模块1401，用于获取当前用户的用户标识信息、业务请求数据以及预设服务器为所述当前用户预先分配的访问密钥，所述预设服务器为预先部署的在所述终端和云服务器之间传输消息的服务器；
请求消息生成模块1402，用于根据所述用户标识信息、所述业务请求数据以及所述访问密钥生成云服务访问请求消息，所述云服务访问请求消息中包括所述预设服务器的域名地址信息；
第二发送模块1403，用于将所述云服务访问请求消息发送至所述预设服务器，以便所述预设服务器在对所述云服务访问请求消息进行签名验证通过的情况下，对所述云服务访问请求消息进行重新签名，得到新的云服务访问请求消息，并将所述新的云服务访问请求消息发送至所述云服务器。
可选地，所述业务请求数据包括所述当前用户待访问的所述云服务器的对应的云厂商的厂商标识信息，所述请求消息生成模块1402，用于根据所述厂商标识信息获取所述云服务器的云服务接口地址；根据所述云服务接口地址和所述预设服务器对应的预设域名后缀生成域名地址信息；根据所述访问密钥、所述用户标识信息以及所述业务请求数据采用所述云服务器提供的签名算法生成第三签名；根据所述第三签名、所述用户标识信息、所述业务请求数据以及所述域名地址信息生成所述云服务访问请求消息。
采用上述装置，终端可以通过调整云厂商的云服务接口地址，在该云服务接口地址后加入该预设服务器对应的预设域名后缀后，将终端发送的云服务访问请求消息发送至预设服务器，由该预设服务器对当前要访问云服务器的用户进行统一的账号验证，也使得管理部门可以通过该预设服务器对该云服务访问请求消息进行审计和检测，实现了云服务访问的可控性，降低了云服务数据访问的安全风险。
另外，基于预设服务器对各个用户的云服务访问请求消息进行统一检测和管理，当某一用户对应的账号(一个账号或者多个云厂商对应的多个账号)泄露的情况下，管理部门可以通过该预设服务器删除该用户的账号，无需登录多个云厂商平台分别进行删除操作，从而大大降低了账号的维护管理成本，与此同时，不需要在云厂商中为每个用户单独配置账号，多 个用户可以共用一个真实密钥，只需要为每个用户分配一个伪签名密钥即可达到账号隔离的效果，当发生单个用户账号的泄露时不会影响其他用户。
下面参考图15，其示出了适于用来实现本公开实施例的电子设备1500的结构示意图。本公开实施例中的终端设备可以包括但不限于诸如移动电话、笔记本电脑、数字广播接收器、个人数字助理(Personal Digital Assistant，PDA)、平板电脑(Portable Android Device，PAD)、便携式多媒体播放器(Portable Media Player，PMP)、车载终端(例如车载导航终端)等等的移动终端以及诸如数字TV(Television)、台式计算机等等的固定终端。图15示出的电子设备仅仅是一个示例，不应对本公开实施例的功能和使用范围带来任何限制。
如图15所示，电子设备1500可以包括处理装置(例如中央处理器、图形处理器等)1501，其可以根据存储在只读存储器(Read Only Memory，ROM)1502中的程序或者从存储装置1508加载到随机访问存储器(Random Access Memory，RAM)1503中的程序而执行各种适当的动作和处理。在RAM 1503中，还存储有电子设备1500操作所需的各种程序和数据。处理装置1501、ROM 1502以及RAM 1503通过总线1504彼此相连。输入/输出(Input/Output，I/O)接口1505也连接至总线1504。
通常，以下装置可以连接至I/O接口1505：包括例如触摸屏、触摸板、键盘、鼠标、摄像头、麦克风、加速度计、陀螺仪等的输入装置1506；包括例如液晶显示器(Liquid Crystal Display，LCD)、扬声器、振动器等的输出装置1507；包括例如磁带、硬盘等的存储装置1508；以及通信装置1509。通信装置1509可以允许电子设备1500与其他设备进行无线或有线通信以交换数据。虽然图15示出了具有各种装置的电子设备1500，但是应理解的是，并不要求实施或具备所有示出的装置。可以替代地实施或具备更多或更少的装置。
特别地，根据本公开的实施例，上文参考流程图描述的过程可以被实现为计算机软件程序。例如，本公开的实施例包括一种计算机程序产品，其包括承载在非暂态计算机可读介质上的计算机程序，该计算机程序包含用于执行流程图所示的方法的程序代码。在这样的实施例中，该计算机程序可以通过通信装置1509从网络上被下载和安装，或者从存储装置1508被安装，或者从ROM 1502被安装。在该计算机程序被处理装置1501执行时，执行本公开实施例的方法中限定的上述功能。
本公开实施例还提供了一种计算机程序，该计算机程序存储在可读存储介质中，电子设备的一个或多个处理器可以从所述可读存储介质中读取所述计算机程序，所述一个或多个处理器执行所述计算机程序，使得所述电子设备执行上述任一实施例提供的方案。
需要说明的是，本公开上述的计算机可读介质可以是计算机可读信号介质或者计算机可读存储介质或者是上述两者的任意组合。计算机可读存储介质例如可以是——但不限于——电、磁、光、电磁、红外线、或半导体的系统、装置或器件，或者任意以上的组合。计算机可读存储介质的更具体的例子可以包括但不限于：具有一个或多个导线的电连接、便携式计算机磁盘、硬盘、随机访问存储器(RAM)、只读存储器(ROM)、可擦式可编程只读存储器(Erasable Programmable Read-Only Memory，EPROM或闪存)、光纤、便携式紧凑磁盘只读存储器(Portable Compact Disk Read-Only Memory，CD-ROM)、光存储器件、磁存储器件、或者上述的任意合适的组合。在本公开中，计算机可读存储介质可以是任何包含或存储程序的有形介质，该程序可以被指令执行系统、装置或者器件使用或者与其结合使用。而在本公开中，计算机可读信号介质可以包括在基带中或者作为载波一部分传播的数据信号，其中承 载了计算机可读的程序代码。这种传播的数据信号可以采用多种形式，包括但不限于电磁信号、光信号或上述的任意合适的组合。计算机可读信号介质还可以是计算机可读存储介质以外的任何计算机可读介质，该计算机可读信号介质可以发送、传播或者传输用于由指令执行系统、装置或者器件使用或者与其结合使用的程序。计算机可读介质上包含的程序代码可以用任何适当的介质传输，包括但不限于：电线、光缆、RF(Radio Frequency，射频)等等，或者上述的任意合适的组合。
在一些实施方式中，客户端、服务器可以利用诸如超文本传输协议(HTTP，HyperText Transfer Protocol)之类的任何当前已知或未来研发的网络协议进行通信，并且可以与任意形式或介质的数字数据通信(例如，通信网络)互连。通信网络的示例包括局域网(LAN，Local Area Network)，广域网(WAN，Wide Area Network)，网际网(例如，互联网)以及端对端网络(例如，ad hoc端对端网络)，以及任何当前已知或未来研发的网络。
上述计算机可读介质可以是上述电子设备中所包含的；也可以是单独存在，而未装配入该电子设备中。
上述计算机可读介质承载有一个或者多个程序，当上述一个或者多个程序被该电子设备执行时，使得该电子设备：接收所述终端发送的云服务访问请求消息；根据所述云服务访问请求消息确定待访问的云服务接口地址；根据所述云服务接口地址对所述云服务访问请求消息进行签名验证，并在验证通过的情况下，对所述云服务访问请求消息进行重新签名，得到新的云服务访问请求消息；根据所述云服务接口地址将所述新的云服务访问请求消息发送至所述云服务器。
或者，上述计算机可读介质承载有一个或者多个程序，当上述一个或者多个程序被该电子设备执行时，使得该电子设备：获取当前用户的用户标识信息、业务请求数据以及预设服务器为所述当前用户预先分配的访问密钥，所述预设服务器为预先部署的在所述终端和云服务器之间传输消息的服务器；根据所述用户标识信息、所述业务请求数据以及所述访问密钥生成云服务访问请求消息；将所述云服务访问请求消息发送至所述预设服务器，以便所述预设服务器在对所述云服务访问请求消息进行签名验证通过的情况下，对所述云服务访问请求消息进行重新签名，得到新的云服务访问请求消息，并将所述新的云服务访问请求消息发送至所述云服务器。
可以以一种或多种程序设计语言或其组合来编写用于执行本公开的操作的计算机程序代码，上述程序设计语言包括但不限于面向对象的程序设计语言—诸如Java、Smalltalk、C++，还包括常规的过程式程序设计语言——诸如“C”语言或类似的程序设计语言。程序代码可以完全地在用户计算机上执行、部分地在用户计算机上执行、作为一个独立的软件包执行、部分在用户计算机上部分在远程计算机上执行、或者完全在远程计算机或服务器上执行。在涉及远程计算机的情形中，远程计算机可以通过任意种类的网络——包括局域网(LAN)或广域网(WAN)——连接到用户计算机，或者，可以连接到外部计算机(例如利用因特网服务提供商来通过因特网连接)。
附图中的流程图和框图，图示了按照本公开各种实施例的系统、方法和计算机程序产品的可能实现的体系架构、功能和操作。在这点上，流程图或框图中的每个方框可以代表一个模块、程序段、或代码的一部分，该模块、程序段、或代码的一部分包含一个或多个用于实现规定的逻辑功能的可执行指令。也应当注意，在有些作为替换的实现中，方框中所标注的 功能也可以以不同于附图中所标注的顺序发生。例如，两个接连地表示的方框实际上可以基本并行地执行，它们有时也可以按相反的顺序执行，这依所涉及的功能而定。也要注意的是，框图和/或流程图中的每个方框、以及框图和/或流程图中的方框的组合，可以用执行规定的功能或操作的专用的基于硬件的系统来实现，或者可以用专用硬件与计算机指令的组合来实现。
描述于本公开实施例中所涉及到的模块可以通过软件的方式实现，也可以通过硬件的方式来实现。其中，模块的名称在某种情况下并不构成对该模块本身的限定，例如，第一接收模块还可以被描述为“接收请求消息的模块”。
本文中以上描述的功能可以至少部分地由一个或多个硬件逻辑部件来执行。例如，非限制性地，可以使用的示范类型的硬件逻辑部件包括：现场可编程门阵列(Field-Programmable Gate Array，FPGA)、专用集成电路(Application Specific Integrated Circuit，ASIC)、专用标准产品(Application Specific Standard Product，ASSP)、片上系统(System-on-a-chip，SOC)、复杂可编程逻辑设备(Complex Programmable Logic Device，CPLD)等等。
在本公开的上下文中，机器可读介质可以是有形的介质，其可以包含或存储以供指令执行系统、装置或设备使用或与指令执行系统、装置或设备结合地使用的程序。机器可读介质可以是机器可读信号介质或机器可读储存介质。机器可读介质可以包括但不限于电子的、磁性的、光学的、电磁的、红外的、或半导体系统、装置或设备，或者上述内容的任何合适组合。机器可读存储介质的更具体示例会包括基于一个或多个线的电气连接、便携式计算机盘、硬盘、随机存取存储器(RAM)、只读存储器(ROM)、可擦除可编程只读存储器(EPROM或快闪存储器)、光纤、便捷式紧凑盘只读存储器(CD-ROM)、光学储存设备、磁储存设备、或上述内容的任何合适组合。
根据本公开的一个或多个实施例，示例1提供了一种传输消息的方法，应用于预设服务器所述预设服务器，为预先部署的在终端和云服务器之间传输消息的服务器，所述方法包括：接收所述终端发送的云服务访问请求消息，所述云服务访问请求消息中包括所述预设服务器的域名地址信息；根据所述云服务访问请求消息确定待访问的云服务接口地址；根据所述云服务接口地址对所述云服务访问请求消息进行签名验证，并在验证通过的情况下，对所述云服务访问请求消息进行重新签名，得到新的云服务访问请求消息；根据所述云服务接口地址将所述新的云服务访问请求消息发送至所述云服务器。
根据本公开的一个或多个实施例，示例2提供了示例1的方法，所述根据所述域名地址信息确定待访问的云服务接口地址包括：获取所述预设服务器对应的预设域名后缀；从所述云服务访问请求消息中获取所述域名地址信息；根据所述预设域名后缀从所述域名地址信息中确定所述云服务接口地址。
根据本公开的一个或多个实施例，示例3提供了示例1的方法，所述云服务访问请求消息包括当前用户的用户标识信息和业务请求数据，所述业务请求数据包括所述当前用户待访问的云服务器的对应的云厂商的厂商标识信息，所述根据所述云服务接口地址对所述云服务访问请求消息进行签名验证包括：根据所述云服务接口地址确定所述云服务器对应的签名算法；根据所述用户标识信息和所述厂商标识信息获取当前用户对应的第一密钥，所述第一密钥为所述预设服务器预先生成的；根据所述第一密钥、所述用户标识信息以及所述业务请求数据采用所述签名算法生成第一签名；根据所述第一签名对所述云服务访问请求消息进行签名验证。
根据本公开的一个或多个实施例，示例4提供了示例3的方法，所述对所述云服务访问请求消息进行重新签名，得到新的云服务访问请求消息包括：根据所述用户标识信息和所述厂商标识信息获取所述云服务器对应的第二密钥，所述第二密钥为所述云服务器预先生成的；根据所述第二密钥、所述用户标识信息以及所述业务请求数据采用所述签名算法生成第二签名；根据所述第二签名对所述云服务访问请求消息进行重新签名，得到所述新的云服务访问请求消息。
根据本公开的一个或多个实施例，示例5提供了示例1-4任一项的方法，所述方法还包括：接收所述云服务器根据所述新的云服务访问请求消息发送的云服务访问响应消息，并将所述云服务访问响应消息发送至所述终端。
根据本公开的一个或多个实施例，示例6提供了示例5的方法，在所述接收所述云服务器根据所述新的云服务访问请求消息发送的云服务访问响应消息后，所述方法还包括：根据所述新的云服务访问请求消息和所述云服务访问响应消息生成访问日志，所述访问日志用于记录当前用户的云服务访问事项。
根据本公开的一个或多个实施例，示例7提供了一种传输消息的方法，应用于终端，所述方法包括：获取当前用户的用户标识信息、业务请求数据以及预设服务器为所述当前用户预先分配的访问密钥，所述预设服务器为预先部署的在所述终端和云服务器之间传输消息的服务器；根据所述用户标识信息、所述业务请求数据以及所述访问密钥生成云服务访问请求消息，所述云服务访问请求消息中包括所述预设服务器的域名地址信息；将所述云服务访问请求消息发送至所述预设服务器，以便所述预设服务器在对所述云服务访问请求消息进行签名验证通过的情况下，对所述云服务访问请求消息进行重新签名，得到新的云服务访问请求消息，并将所述新的云服务访问请求消息发送至所述云服务器。
根据本公开的一个或多个实施例，示例8提供了示例7的方法，所述业务请求数据包括所述当前用户待访问的所述云服务器的对应的云厂商的厂商标识信息，所述根据所述用户标识信息、所述业务请求数据以及所述访问密钥生成云服务访问请求消息包括：根据所述厂商标识信息获取所述云服务器的云服务接口地址；根据所述云服务接口地址和所述预设服务器对应的预设域名后缀生成所述域名地址信息；根据所述访问密钥、所述用户标识信息以及所述业务请求数据采用所述云服务器提供的签名算法生成第三签名；根据所述第三签名、所述用户标识信息、所述业务请求数据以及所述域名地址信息生成所述云服务访问请求消息。
根据本公开的一个或多个实施例，示例9提供了一种传输消息的装置，应用于预设服务器，所述预设服务器为预先部署的在终端和云服务器之间传输消息的服务器，所述装置包括：第一接收模块，用于接收所述终端发送的云服务访问请求消息，所述云服务访问请求消息中包括所述预设服务器的域名地址信息；确定模块，用于根据所述云服务访问请求消息确定待访问的云服务接口地址；验证模块，用于根据所述云服务接口地址对所述云服务访问请求消息进行签名验证，并在验证通过的情况下，对所述云服务访问请求消息进行重新签名，得到新的云服务访问请求消息；第一发送模块，用于根据所述云服务接口地址将所述新的云服务访问请求消息发送至所述云服务器。
根据本公开的一个或多个实施例，示例10提供了示例9的装置，所述确定模块，用于获取所述预设服务器对应的预设域名后缀；从所述云服务访问请求消息中获取所述域名地址信息；根据所述预设域名后缀从所述域名地址信息中确定所述云服务接口地址。
根据本公开的一个或多个实施例，示例11提供了示例9的装置，所述云服务访问请求消息包括当前用户的用户标识信息和业务请求数据，所述业务请求数据包括所述当前用户待访问的云服务器的对应的云厂商的厂商标识信息；所述验证模块，用于根据所述云服务接口地址确定所述云服务器对应的签名算法；根据所述用户标识信息和所述厂商标识信息获取当前用户对应的第一密钥，所述第一密钥为所述预设服务器预先生成的；根据所述第一密钥、所述用户标识信息以及所述业务请求数据采用所述签名算法生成第一签名；根据所述第一签名对所述云服务访问请求消息进行签名验证。
根据本公开的一个或多个实施例，示例12提供了示例11的装置，所述验证模块，用于根据所述用户标识信息和所述厂商标识信息获取所述云服务器对应的第二密钥，所述第二密钥为所述云服务器预先生成的；根据所述第二密钥、所述用户标识信息以及所述业务请求数据采用所述签名算法生成第二签名；根据所述第二签名对所述云服务访问请求消息进行重新签名，得到所述新的云服务访问请求消息。
根据本公开的一个或多个实施例，示例13提供了示例9-12任一项的装置，所述装置还包括：
第二接收模块，用于接收所述云服务器根据所述新的云服务访问请求消息发送的云服务访问响应消息，并将所述云服务访问响应消息发送至所述终端。
根据本公开的一个或多个实施例，示例14提供了示例13的装置，所述装置还包括：日志生成模块，用于根据所述新的云服务访问请求消息和所述云服务访问响应消息生成访问日志，所述访问日志用于记录当前用户的云服务访问事项。
根据本公开的一个或多个实施例，示例15提供了一种传输消息的装置，应用于终端，所述装置包括：
获取模块，用于获取当前用户的用户标识信息、业务请求数据以及预设服务器为所述当前用户预先分配的访问密钥，所述预设服务器为预先部署的在所述终端和云服务器之间传输消息的服务器；
请求消息生成模块，用于根据所述用户标识信息、所述业务请求数据以及所述访问密钥生成云服务访问请求消息，所述云服务访问请求消息中包括所述预设服务器的域名地址信息；
第二发送模块，用于将所述云服务访问请求消息发送至所述预设服务器，以便所述预设服务器在对所述云服务访问请求消息进行签名验证通过的情况下，对所述云服务访问请求消息进行重新签名，得到新的云服务访问请求消息，并将所述新的云服务访问请求消息发送至所述云服务器。
根据本公开的一个或多个实施例，示例16提供了示例15的装置，所述业务请求数据包括所述当前用户待访问的所述云服务器的对应的云厂商的厂商标识信息，所述请求消息生成模块，用于根据所述厂商标识信息获取所述云服务器的云服务接口地址；根据所述云服务接口地址和所述预设服务器对应的预设域名后缀生成域名地址信息；根据所述访问密钥、所述用户标识信息以及所述业务请求数据采用所述云服务器提供的签名算法生成第三签名；根据所述第三签名、所述用户标识信息、所述业务请求数据以及所述域名地址信息生成所述云服务访问请求消息。
以上描述仅为本公开的较佳实施例以及对所运用技术原理的说明。本领域技术人员应当理解，本公开中所涉及的公开范围，并不限于上述技术特征的特定组合而成的技术方案，同 时也应涵盖在不脱离上述公开构思的情况下，由上述技术特征或其等同特征进行任意组合而形成的其它技术方案。例如上述特征与本公开中公开的(但不限于)具有类似功能的技术特征进行互相替换而形成的技术方案。
此外，虽然采用特定次序描绘了各操作，但是这不应当理解为要求这些操作以所示出的特定次序或以顺序次序执行来执行。在一定环境下，多任务和并行处理可能是有利的。同样地，虽然在上面论述中包含了若干具体实现细节，但是这些不应当被解释为对本公开的范围的限制。在单独的实施例的上下文中描述的某些特征还可以组合地实现在单个实施例中。相反地，在单个实施例的上下文中描述的各种特征也可以单独地或以任何合适的子组合的方式实现在多个实施例中。
尽管已经采用特定于结构特征和/或方法逻辑动作的语言描述了本主题，但是应当理解所附权利要求书中所限定的主题未必局限于上面描述的特定特征或动作。相反，上面所描述的特定特征和动作仅仅是实现权利要求书的示例形式。关于上述实施例中的装置，其中各个模块执行操作的具体方式已经在有关该方法的实施例中进行了详细描述，此处将不做详细阐述说明。

Claims (14)

  1. 一种传输消息的方法，应用于预设服务器，所述预设服务器为预先部署的在终端和云服务器之间传输消息的服务器，所述方法包括：
    接收所述终端发送的云服务访问请求消息，所述云服务访问请求消息中包括所述预设服务器的域名地址信息；
    根据所述云服务访问请求消息确定待访问的云服务接口地址；
    根据所述云服务接口地址对所述云服务访问请求消息进行签名验证，并在验证通过的情况下，对所述云服务访问请求消息进行重新签名，得到新的云服务访问请求消息；
    根据所述云服务接口地址将所述新的云服务访问请求消息发送至所述云服务器。
  2. 根据权利要求1所述的方法，其中，所述根据所述云服务访问请求消息确定待访问的云服务接口地址包括：
    获取所述预设服务器对应的预设域名后缀；
    从所述云服务访问请求消息中获取所述域名地址信息；
    根据所述预设域名后缀从所述域名地址信息中确定所述云服务接口地址。
  3. 根据权利要求1或2所述的方法，其中，所述云服务访问请求消息包括当前用户的用户标识信息和业务请求数据，所述业务请求数据包括所述当前用户待访问的所述云服务器的对应的云厂商的厂商标识信息，所述根据所述云服务接口地址对所述云服务访问请求消息进行签名验证包括：
    根据所述云服务接口地址确定所述云服务器对应的签名算法；
    根据所述用户标识信息和所述厂商标识信息获取当前用户对应的第一密钥，所述第一密钥为所述预设服务器预先生成的；
    根据所述第一密钥、所述用户标识信息以及所述业务请求数据采用所述签名算法生成第一签名；
    根据所述第一签名对所述云服务访问请求消息进行签名验证。
  4. 根据权利要求3所述的方法，其中，所述对所述云服务访问请求消息进行重新签名，得到新的云服务访问请求消息包括：
    根据所述用户标识信息和所述厂商标识信息获取所述云服务器对应的第二密钥，所述第二密钥为所述云服务器预先生成的；
    根据所述第二密钥、所述用户标识信息以及所述业务请求数据采用所述签名算法生成第二签名；
    根据所述第二签名对所述云服务访问请求消息进行重新签名，得到所述新的云服务访问请求消息。
  5. 根据权利要求1-4任一项所述的方法，其中，所述方法还包括：
    接收所述云服务器根据所述新的云服务访问请求消息发送的云服务访问响应消息，并将所述云服务访问响应消息发送至所述终端。
  6. 根据权利要求5所述的方法，其中，在所述接收所述云服务器根据所述新的云服务访问请求消息发送的云服务访问响应消息后，所述方法还包括：
    根据所述新的云服务访问请求消息和所述云服务访问响应消息生成访问日志，所述访问日志用于记录当前用户的云服务访问事项。
  7. 一种传输消息的方法，应用于终端，所述方法包括：
    获取当前用户的用户标识信息、业务请求数据以及预设服务器为所述当前用户预先分配的访问密钥，所述预设服务器为预先部署的在所述终端和云服务器之间传输消息的服务器；
    根据所述用户标识信息、所述业务请求数据以及所述访问密钥生成云服务访问请求消息，所述云服务访问请求消息中包括所述预设服务器的域名地址信息；
    将所述云服务访问请求消息发送至所述预设服务器，以便所述预设服务器在对所述云服务访问请求消息进行签名验证并验证通过的情况下，对所述云服务访问请求消息进行重新签名，得到新的云服务访问请求消息，并将所述新的云服务访问请求消息发送至所述云服务器。
  8. 根据权利要求7所述的方法，其中，所述业务请求数据包括所述当前用户待访问的所述云服务器的对应的云厂商的厂商标识信息，所述根据所述用户标识信息、所述业务请求数据以及所述访问密钥生成云服务访问请求消息包括：
    根据所述厂商标识信息获取所述云服务器的云服务接口地址；
    根据所述云服务接口地址和所述预设服务器对应的预设域名后缀生成所述域名地址信息；
    根据所述访问密钥、所述用户标识信息以及所述业务请求数据采用所述云服务器提供的签名算法生成第三签名；
    根据所述第三签名、所述用户标识信息、所述业务请求数据以及所述域名地址信息生成所述云服务访问请求消息。
  9. 一种传输消息的装置，应用于预设服务器，所述预设服务器为预先部署的在终端和云服务器之间传输消息的服务器，所述装置包括：
    第一接收模块，用于接收所述终端发送的云服务访问请求消息，所述云服务访问请求消息中包括所述预设服务器的域名地址信息；
    确定模块，用于根据所述云服务访问请求消息确定待访问的云服务接口地址；
    验证模块，用于根据所述云服务接口地址对所述云服务访问请求消息进行签名验证，并在验证通过的情况下，对所述云服务访问请求消息进行重新签名，得到新的云服务访问请求消息；
    第一发送模块，用于根据所述云服务接口地址将所述新的云服务访问请求消息发送至所述云服务器。
  10. 一种传输消息的装置，应用于终端，所述装置包括：
    获取模块，用于获取当前用户的用户标识信息、业务请求数据以及预设服务器为所述当前用户预先分配的访问密钥，所述预设服务器为预先部署的在所述终端和云服务器之间传输消息的服务器；
    请求消息生成模块，用于根据所述用户标识信息、所述业务请求数据以及所述访问密钥生成云服务访问请求消息，所述云服务访问请求消息中包括所述预设服务器的域名地址信息；
    第二发送模块，用于将所述云服务访问请求消息发送至所述预设服务器，以便所述预设服务器在对所述云服务访问请求消息进行签名验证并验证通过的情况下，对所述云服务访问请求消息进行重新签名，得到新的云服务访问请求消息，并将所述新的云服务访问请求消息发送至所述云服务器。
  11. 一种计算机可读存储介质，其上存储有计算机程序，其中，所述计算机程序被处理 装置执行时实现权利要求1-6或权利要求7-8中任一项所述方法的步骤。
  12. 一种电子设备，包括：
    存储装置，其上存储有至少一个计算机程序；
    至少一个处理装置，用于执行所述存储装置中的所述至少一个计算机程序，以实现权利要求1-6或权利要求7-8中任一项所述方法的步骤。
  13. 一种计算机程序产品，包括计算机指令，其中，所述计算机指令被处理装置执行时实现权利要求1-6或权利要求7-8中任一项所述方法的步骤。
  14. 一种计算机程序，其中，所述计算机程序被处理装置执行时实现权利要求1-6或权利要求7-8中任一项所述方法的步骤。
PCT/CN2023/082351 2022-03-29 2023-03-17 传输消息的方法、装置、存储介质及电子设备 WO2023185514A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210324115.0A CN114640533B (zh) 2022-03-29 2022-03-29 传输消息的方法、装置、存储介质及电子设备
CN202210324115.0 2022-03-29

Publications (1)

Publication Number Publication Date
WO2023185514A1 true WO2023185514A1 (zh) 2023-10-05

Family

ID=81951746

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/082351 WO2023185514A1 (zh) 2022-03-29 2023-03-17 传输消息的方法、装置、存储介质及电子设备

Country Status (2)

Country Link
CN (1) CN114640533B (zh)
WO (1) WO2023185514A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114640533B (zh) * 2022-03-29 2023-11-24 北京有竹居网络技术有限公司 传输消息的方法、装置、存储介质及电子设备
CN118250103B (zh) * 2024-05-29 2024-08-13 杭州政云数据技术有限公司 一种用户授权方法、装置、设备及介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103795690A (zh) * 2012-10-31 2014-05-14 华为技术有限公司 一种云访问控制的方法、代理服务器和系统
WO2019127973A1 (zh) * 2017-12-29 2019-07-04 平安科技（深圳）有限公司 镜像仓库的权限认证方法、系统、设备及存储介质
WO2021126321A1 (en) * 2019-12-17 2021-06-24 Microsoft Technology Licensing, Llc Browser hooks on objects in web pages
CN113630479A (zh) * 2021-07-29 2021-11-09 万翼科技有限公司 域名的解析方法及相关产品
CN114640533A (zh) * 2022-03-29 2022-06-17 北京有竹居网络技术有限公司 传输消息的方法、装置、存储介质及电子设备

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2014067080A1 (zh) * 2012-10-31 2014-05-08 华为技术有限公司 发送云服务器地址的方法、设备
CN104601592B (zh) * 2015-01-31 2017-10-17 华为技术有限公司 一种接入云服务的方法及接入设备
CN109462568B (zh) * 2017-09-06 2022-07-05 中国电信股份有限公司 Portal认证方法、系统和Portal代理服务器
CN112272158A (zh) * 2020-09-16 2021-01-26 厦门网宿有限公司 一种数据代理方法、系统及代理服务器
CN114117532A (zh) * 2021-11-29 2022-03-01 深圳壹账通智能科技有限公司 云服务器的访问方法、装置、电子设备及存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103795690A (zh) * 2012-10-31 2014-05-14 华为技术有限公司 一种云访问控制的方法、代理服务器和系统
WO2019127973A1 (zh) * 2017-12-29 2019-07-04 平安科技（深圳）有限公司 镜像仓库的权限认证方法、系统、设备及存储介质
WO2021126321A1 (en) * 2019-12-17 2021-06-24 Microsoft Technology Licensing, Llc Browser hooks on objects in web pages
CN113630479A (zh) * 2021-07-29 2021-11-09 万翼科技有限公司 域名的解析方法及相关产品
CN114640533A (zh) * 2022-03-29 2022-06-17 北京有竹居网络技术有限公司 传输消息的方法、装置、存储介质及电子设备

Also Published As

Publication number Publication date
CN114640533B (zh) 2023-11-24
CN114640533A (zh) 2022-06-17

Similar Documents

Publication Publication Date Title
CN111639319B (zh) 用户资源授权方法、装置及计算机可读存储介质
WO2023185514A1 (zh) 传输消息的方法、装置、存储介质及电子设备
US10762193B2 (en) Dynamically generating and injecting trusted root certificates
CN110839087B (zh) 接口调用方法及装置、电子设备和计算机可读存储介质
CN112039826B (zh) 应用于小程序端的登录方法和装置，电子设备，可读介质
CN112866385B (zh) 接口调用方法、装置、电子设备和存储介质
CN112131021A (zh) 一种访问请求处理方法及装置
CN111199037B (zh) 登录方法、系统和装置
CN107920060B (zh) 基于账号的数据访问方法和装置
WO2024183779A1 (zh) 资源访问控制方法及装置、计算机可读介质和电子设备
CN115174558B (zh) 云网端一体化身份认证方法、装置、设备及存储介质
CN116011590A (zh) 联邦学习方法、装置和系统
CN117061105A (zh) 数据处理方法、装置、可读介质及电子设备
CN115730324A (zh) 业务系统的访问方法、装置、存储介质及电子设备
CN113297588A (zh) 密码处理设备、以及密码处理设备的控制方法和装置
CN111367590A (zh) 中断事件处理方法及其装置
CN115174106B (zh) 云服务认证方法、装置、设备及存储介质
CN113760563B (zh) 基于开放平台的数据处理方法、装置以及数据处理系统
US20240104192A1 (en) System and method for implementing trust broker framework in o-ran
CN115174062B (zh) 云服务认证方法、装置、设备及存储介质
CN116738472B (zh) 应用于任务数据交互的任务数据加密方法、装置与设备
CN112261659B (zh) 终端和服务器的控制方法、装置、终端和存储介质
CN116471327B (zh) 云资源处理方法、装置、设备及存储介质
US20240323186A1 (en) Integrated system, interface calling method, authentication method, and related device
CN111191203A (zh) 身份验证方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23777888

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2023777888

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2023777888

Country of ref document: EP

Effective date: 20240926