WO2024124924A1 - 小程序应用的密钥协商方法及装置 - Google Patents
小程序应用的密钥协商方法及装置 Download PDFInfo
- Publication number
- WO2024124924A1 WO2024124924A1 PCT/CN2023/112431 CN2023112431W WO2024124924A1 WO 2024124924 A1 WO2024124924 A1 WO 2024124924A1 CN 2023112431 W CN2023112431 W CN 2023112431W WO 2024124924 A1 WO2024124924 A1 WO 2024124924A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- server
- mini
- request
- session key
- data
- Prior art date
Links
- 238000000034 method Methods 0.000 title claims abstract description 60
- 238000013475 authorization Methods 0.000 claims abstract description 103
- 238000012545 processing Methods 0.000 description 6
- 238000010586 diagram Methods 0.000 description 4
- 230000008569 process Effects 0.000 description 4
- 230000004044 response Effects 0.000 description 4
- 101100233916 Saccharomyces cerevisiae (strain ATCC 204508 / S288c) KAR5 gene Proteins 0.000 description 3
- 230000006870 function Effects 0.000 description 3
- 238000003672 processing method Methods 0.000 description 3
- 101100012902 Saccharomyces cerevisiae (strain ATCC 204508 / S288c) FIG2 gene Proteins 0.000 description 2
- 230000005540 biological transmission Effects 0.000 description 2
- 238000004891 communication Methods 0.000 description 2
- 238000004590 computer program Methods 0.000 description 2
- 101000827703 Homo sapiens Polyphosphoinositide phosphatase Proteins 0.000 description 1
- 102100023591 Polyphosphoinositide phosphatase Human genes 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 235000014510 cooky Nutrition 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 230000003993 interaction Effects 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000000750 progressive effect Effects 0.000 description 1
Definitions
- One or more embodiments of the present specification relate to the field of information security technology, and in particular, to a key negotiation method and device for a mini-program application.
- mini-program applications Since the launch of mini-program applications, they have been widely used and welcomed by users because of their installation-free and easy-to-use features.
- some mini-program applications (such as government mini-programs and banking mini-programs) need to encrypt data when sending data.
- the keys used to encrypt data in mini-program applications are usually encoded by developers in the front-end code of mini-program applications, making the keys of mini-program applications easy to be stolen by attackers, posing the risk of key leakage.
- One or more embodiments of this specification describe a key negotiation method and device for a mini-program application, which can improve the security of keys during mini-program application negotiation and reduce the risk of key leakage.
- a key negotiation method for a mini-program application is provided, which is applied to a mini-program platform, wherein the method includes: receiving a first request sent by the mini-program application, the first request is used to request authorization to log in to a first server, and the first server is used to provide services to the mini-program application; sending a second request to a second server, the second request is used to request authorization to log in to the first server, and the second server is used to provide services to the mini-program platform; receiving an authorization credential and a session key issued by the second server, the authorization credential and the session key are determined by the second server based on the second request; storing the session key; sending the authorization credential to the first server, the authorization credential being a credential for the second server to authorize the first server to request the session key.
- the authorization certificate after sending the authorization certificate to the first server, it also includes: receiving a third request sent by the mini-program application; carrying the first data in the third request; according to the third request, encrypting the first data using the session key to obtain second data; sending the second data to the first server, and the second data is used for the first server to decrypt using the session key to obtain the first data.
- the method further includes: receiving the first server The third data is sent by the mini-program, where the third data is obtained by encrypting the fourth data by the first server using the session key; decrypting the third data using the session key to obtain the fourth data; and sending the fourth data to the mini-program application.
- a key negotiation method for a mini-program application is provided, which is applied to a first server, and the first server is used to provide services to the mini-program application.
- the method includes: receiving the authorization certificate sent by the mini-program platform, and the authorization certificate is a certificate for the second server to authorize the first server to request a session key; sending a fourth request to the second server, and the fourth request carries the authorization certificate, and the second server is used to provide services to the mini-program platform; receiving the session key and user identifier sent by the second server, and the session key and user identifier are determined by the second server according to the fourth request; and logging in to the user account corresponding to the user identifier according to the user identifier.
- the user account corresponding to the user identifier after logging in to the user account corresponding to the user identifier according to the user identifier, it also includes: receiving second data sent by the mini program platform, the second data being obtained by the mini program platform encrypting the first data using the session key; and decrypting the second data using the session key to obtain the first data.
- the session key after using the session key to decrypt the second data to obtain the first data, it also includes: providing services for the mini-program application based on the first data; generating fourth data when providing services for the mini-program application; using the session key to encrypt the fourth data to obtain third data; and sending the third data to the mini-program platform.
- a key negotiation method for a mini-program application is provided, which is applied to a second server, and the second server is used to provide services to the mini-program platform.
- the method includes: receiving a second request sent by the mini-program platform, and the second request is used to request authorization to log in to the first server; determining an authorization credential and a session key based on the second request; and sending the authorization credential and the session key to the mini-program platform.
- the mini program platform after sending the authorization credential and the session key to the mini program platform, it also includes: receiving a fourth request sent by the first server, the fourth request being used to request obtaining the session key and the user identifier; and sending the session key and the user identifier to the first server according to the fourth request.
- a key negotiation device for a mini-program application which is applied to a mini-program platform, and the device includes: a first receiving module, a first sending module and a storage module, wherein the first receiving module is configured to: receive a first request sent by the mini-program application, the first request is used to request authorization to log in to a first server, and the first server is used to provide services to the mini-program application; the first sending module is configured to: send the second request to a second server, the second request is used to request authorization to log in to the first server, and the second server is used to send the second request to the mini-program application.
- the first receiving module is configured to receive the authorization certificate and session key issued by the second server, and the authorization certificate and session key are determined by the second server according to the second request;
- the storage module is configured to store the session key;
- the first sending module is configured to send the authorization certificate to the first server, and the authorization certificate is the certificate of the second server authorizing the first server to request the session key.
- a key negotiation device for a mini-program application which is applied to a first server, and the first server is used to provide services to the mini-program application.
- the device includes: a second receiving module, a second sending module and a login module, wherein the second receiving module is configured to: receive the authorization credential sent by the mini-program platform, and the authorization credential is the credential of the second server authorizing the first server to request a session key; the second sending module is configured to: send a fourth request to the second server, and the fourth request carries the authorization credential, and the second server is used to provide services to the mini-program platform; the second receiving module is configured to: receive the session key and user identifier sent by the second server, and the session key and user identifier are determined by the second server according to the fourth request, and the session key is consistent with the session key stored in the mini-program platform; the login module is configured to: log in to the user account corresponding to the user identifier according to the user identifier
- a key negotiation device for a mini-program application which is applied to a second server, and the second server is used to provide services to the mini-program platform.
- the method includes: a third receiving module, a third sending module and a determination module, wherein the third receiving module is configured to: receive a second request sent by the mini-program platform, and the second request is used to request authorization to log in to the first server; the determination module is configured to: determine the authorization credential and the session key according to the second request; the third sending module is configured to: send the authorization credential and the session key to the mini-program platform.
- a computing device including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method described in any embodiment of the present specification is implemented.
- the key negotiation method and device for mini-program applications provided in the embodiments of this specification store a session key that is the same as the session key on the first server on the mini-program platform instead of storing the session key in the mini-program application, so that the mini-program application cannot obtain the session key, and attackers who attack the mini-program application cannot steal the session key, thereby reducing the risk of key leakage and providing higher security.
- the session key is associated with the user's login status, that is, the session key is valid when the user account is logged in.
- the session key is automatically updated, further improving the security of the session key.
- FIG1A is a flowchart of a key negotiation method for a mini-program application applied to a mini-program platform provided by an embodiment of the present specification.
- FIG1B is a flowchart of a processing method of a mini-program platform after key negotiation of a mini-program application is completed, provided in one embodiment of the present specification.
- FIG1C is a flowchart of a processing method of the mini-program platform after completing key negotiation of the mini-program application, provided in another embodiment of the present specification.
- FIG. 2 is a flowchart of a key negotiation method for a mini-program application in a first server provided in an embodiment of the present specification.
- FIG3 is a flowchart of a key negotiation method for a mini-program application in a second server provided in an embodiment of the present specification.
- FIG4 is a schematic diagram of a key negotiation device for a mini-program application in a mini-program platform provided by an embodiment of the present specification.
- FIG5 is a schematic diagram of a key negotiation device for a mini-program application in a first server provided by an embodiment of the present specification.
- FIG6 is a schematic diagram of a key negotiation device for a mini-program application in a second server provided by an embodiment of the present specification.
- FIG. 1A is a diagram of a key negotiation method for a mini-program application applied to a mini-program platform provided by an embodiment of the present specification. It is understood that the method can be executed by any device, equipment, platform, or device cluster with computing and processing capabilities. The method includes steps 101 to 109.
- Step 101 The mini program platform receives a first request sent by a mini program application.
- the mini program platform corresponds to a first server, which is used to provide services to the mini program application.
- the first request is used to request authorization information of the first server. Specifically, the first request is used to request authorization to log in to the first server, or in other words, the first request is used to request login information of the first server, such as a user account and password.
- the first request is used to request OAuth (Open Authorization) authorization from the first server.
- OAuth Open Authorization
- Step 103 the mini program platform sends a second request to the second server, the second request is used to request authorization to log in to the first server, and the second server is used to provide services to the mini program platform.
- the second request is obtained by converting the first request by the mini program platform, and has the same function as the first request.
- the information carried in the second request is not completely the same as the information carried in the first request.
- the mini program platform forwards the first request sent by the mini program application to the second server, but during the forwarding process, the mini program platform sends the connection address of the mini program platform together with the first request to the second server, so the mini program platform sends a second request to the second server, and the second request may include the first request and the connection address of the mini program platform.
- the second server can determine the authorization credential for logging into the first server and the session key for communication between the mini program platform and the first server according to the second request.
- the second server sends the authorization credential and the session key to the mini program platform.
- the authorization credential can be expressed as code
- the session key can be expressed as session_key.
- Step 105 The mini program platform receives the authorization certificate and session key sent by the second server.
- the authorization credential and the session key are determined by the second server according to the second request.
- Step 107 The mini program platform stores the session key.
- Step 109 The mini program platform sends an authorization certificate to the first server, where the authorization certificate is a certificate for the second server to authorize the first server to request a session key.
- the mini program platform will send the authorization certificate to the first server so that the first server can obtain the session key from the second server based on the authorization certificate.
- step 109 may specifically be: the mini-program platform sends the authorization credential to the mini-program application.
- the mini-program application sends a request to the mini-program platform to send the authorization credential to the first server.
- the mini-program platform sends the authorization credential to the first server in accordance with the request.
- the first server sends a request to the second server for obtaining a session key and a user identifier.
- the second server sends the session key consistent with the mini-program platform and the user identifier to the first server.
- the first server receives the session key and the user identifier, and stores the session key.
- the first server authenticates the user identity based on the user identifier. Specifically, the first server compares the user identifier with the pre-stored user identifier. When the comparison is consistent, the first server determines that the user identity authentication is successful, and logs in to the user account corresponding to the user identifier.
- the first server may send the user login status information to the mini program platform.
- the user login status information may include the user login status, the user temporary identity identifier, etc.
- the user temporary identity identifier may be represented as a cookie.
- the mini program platform After the mini program platform receives the user login status information, the mini program platform returns the login result to the mini program application to inform the mini program application whether it has successfully logged in to the first server.
- a session key that is the same as the session key on the first server is stored on the mini-program platform instead of being stored in the mini-program application, so that the mini-program application cannot obtain the session key, and attackers who attack the mini-program application cannot steal the session key, thereby reducing the risk of key leakage and providing higher security.
- the session key is associated with the user's login status, that is, the session key is valid when the user account is logged in.
- the session key is automatically updated, further improving the security of the session key.
- the key negotiation method for a mini-program application provided in an embodiment of this specification further includes steps 111 to 115 .
- Step 111 the mini program platform receives a third request sent by the mini program application; the third request carries the first data.
- the third request is used to request to send the first data and set an encryption option, wherein the encryption option can be understood as an encryption method and an encryption key.
- Step 113 The mini program platform uses the session key to encrypt the first data according to the third request to obtain the second data.
- the mini program platform uses the session key (such as session_key) stored in step 107 to encrypt the first data to obtain the second data.
- session key such as session_key
- Step 115 The mini program platform sends second data to the first server, and the second data is used for the first server to decrypt using the session key to obtain the first data.
- the first server After the mini program sends the second data to the first server, the first server receives the second data, and the first server uses a session key that is consistent with the session key stored on the mini program platform to decrypt the second data to obtain the first data.
- the mini program platform sends the second data to the first server
- the mini program platform sends the user's temporary identity identifier to the first server.
- the first server receives the user's temporary identity identifier and authenticates the user based on the user's temporary identity identifier.
- the same session key is stored on the mini-program platform and the first server.
- the mini-program platform and the first server can use the session key to encrypt and decrypt the transmitted data.
- the session key has a high security, which further ensures the security of data transmission.
- the key negotiation method for a mini-program application provided in an embodiment of this specification further includes steps 117 to 121 .
- Step 117 the mini program platform receives the third data sent by the first server, where the third data is obtained by the first server encrypting the fourth data using the session key.
- the first server processes the first data to obtain the fourth data, and after the first server uses the session key to encrypt the fourth data to obtain the third data, the first server sends the third data to the mini program platform.
- Step 119 The mini program platform uses the session key to decrypt the third data to obtain the fourth data.
- the mini program platform After receiving the third data sent by the first server, the mini program platform uses the session key to decrypt the third data to obtain fourth data.
- Step 121 The mini program platform sends fourth data to the mini program application.
- the mini program platform returns response information of the first data to the mini program application, and the response information includes the fourth data.
- the same session key is stored on the mini-program platform and the first server.
- the mini-program platform and the first server can use the session key to encrypt and decrypt the transmitted data.
- the session key has a high security, which further ensures the security of data transmission.
- FIG2 shows a flow chart of a key negotiation method for a mini-program application according to an embodiment. It is understood that the method can be executed by any device, equipment, platform, or device cluster with computing and processing capabilities.
- the key negotiation method for a mini-program application provided in an embodiment of this specification is applied to a first server, and the first server is used to provide services to the mini-program application.
- the method includes steps 201 to 215.
- Step 201 the first server receives the authorization certificate sent by the mini-program platform, where the authorization certificate is the certificate for the second server to authorize the first server to request a session key.
- Step 203 The first server sends a fourth request to the second server.
- the fourth request carries an authorization certificate.
- the second server is used to provide services to the mini program platform.
- the fourth request is used to request the second server to send a session key and a user identifier.
- the second server After the second server receives the fourth request sent by the first server, the second server obtains the session key and user identification corresponding to the authorization credential according to the authorization credential, and sends the session key and user identification to the first server.
- Step 205 The first server receives the session key and user identifier sent by the second server.
- the session key and user identifier are determined by the second server according to the fourth request.
- the session key is consistent with the session key stored in the mini program platform.
- Step 207 The first server logs in to the user account corresponding to the user identifier according to the user identifier.
- step 207 after executing step 207, it also includes: step 209, the first server receives second data sent by the mini-program platform, and the second data is obtained by encrypting the first data by the mini-program platform using a session key.
- Step 211 The first server uses the session key to decrypt the second data to obtain the first data.
- the method further includes: step 213, the first server encrypts the fourth data using the session key to obtain the third data.
- the first server may provide services for the mini-program application according to the first data, and generate fourth data when providing services for the mini-program application.
- the fourth data is generated when the server is provided for the mini-program application according to the first data.
- Step 215 The first server sends the third data to the mini program platform.
- a session key that is the same as the session key on the first server is stored on the mini-program platform instead of being stored in the mini-program application, so that the mini-program application cannot obtain the session key, and attackers who attack the mini-program application cannot steal the session key, thereby reducing the risk of key leakage and providing higher security.
- the session key is associated with the user's login status, that is, when the user account is logged in, When you log in again, the session key is automatically updated, further improving the security of the session key.
- FIG3 shows a flow chart of a key negotiation method for a mini-program application according to an embodiment. It is understood that the method can be executed by any device, equipment, platform, or device cluster with computing and processing capabilities.
- the key negotiation method for a mini-program application provided in an embodiment of this specification is applied to a second server, and the second server is used to provide services to the mini-program platform.
- the method includes steps 301 to 309.
- Step 301 The second server receives a second request sent by the mini-program platform, where the second request is used to request authorization to log in to the first server.
- Step 303 The second server determines the authorization credential and the session key according to the second request.
- Step 305 The second server sends the authorization credential and session key to the mini program platform.
- the method further includes: step 307, the second server receives a fourth request sent by the first server, and the fourth request is used to request to obtain a session key and a user identifier.
- Step 309 The second server sends the session key and the user identifier to the first server according to the fourth request.
- a session key that is the same as the session key on the first server is stored on the mini-program platform instead of being stored in the mini-program application, so that the mini-program application cannot obtain the session key, and attackers who attack the mini-program application cannot steal the session key, thereby reducing the risk of key leakage and providing higher security.
- the session key is associated with the user's login status, that is, the session key is valid when the user account is logged in.
- the session key is automatically updated, further improving the security of the session key.
- the following describes the key negotiation method of the mini-program application and the data processing method after the key negotiation in combination with the mini-program application, the mini-program platform, the first server, and the second server.
- the process described may include steps 401 to 447 (some of which are optional). Please refer to the following description of the embodiments.
- Step 401 The mini program application sends a first request to the mini program platform, where the first request is used to request to obtain authorization information of a first server.
- the mini program platform receives the first request.
- Step 403 the mini program platform sends a second request to the second server, the second request is used to request authorization to log in to the first server, and the second server is used to provide services to the mini program platform.
- the second server receives the second request.
- step 103 please refer to the relevant description in the above step 103, which will not be repeated here.
- Step 405 The second server determines the authorization credentials for logging into the first server and the session key for communication between the mini-program platform and the first server according to the second request.
- step 103 please refer to the relevant description in the above step 103, which will not be repeated here.
- Step 407 The second server sends the authorization certificate and the session key to the mini program platform, and correspondingly, the mini program platform receives the authorization certificate and the session key.
- Step 409 The mini program platform stores the session key.
- step 411 the mini program platform sends the authorization credential to the mini program application, and correspondingly, the mini program application receives the authorization credential.
- Step 413 The mini program application sends a request to the mini program platform to send the authorization credential to the first server.
- Step 417 The mini program platform sends the authorization certificate to the first server according to the request. Correspondingly, the first server receives the authorization certificate.
- Step 419 The first server sends a request for obtaining a session key and a user identifier to the second server.
- the second server receives the request.
- Step 421 The second server sends a session key consistent with the mini-program platform and a user identifier to the first server according to the request.
- the first server receives the session key and the user identifier.
- Step 423 The first server stores the session key.
- Step 425 The first server authenticates the user identity according to the user identifier.
- Step 427 After determining that the user identity authentication is successful, the first server logs in to the user account corresponding to the user identifier.
- Step 429 The first server sends the user login status information to the mini program platform, where the user login status information may include the user's temporary identity.
- the mini program platform receives the user login status information.
- Step 431 the mini program platform returns the login result to the mini program application to inform the mini program application whether it has successfully logged into the first server.
- Step 433 The mini program application sends a third request to the mini program platform, wherein the third request carries the first data.
- the mini program platform receives the third request.
- Step 435 The mini program platform uses the session key to encrypt the first data according to the third request to obtain the second data.
- Step 437 the mini program platform sends the second data to the first server, where the second data is used for the first server to decrypt using the session key to obtain the first data.
- the first server receives the second data.
- the mini program platform sends the second data to the first server
- the mini program platform sends the user's temporary identity to the first server.
- Step 439 The first server uses a session key that is consistent with the session key stored on the mini-program platform to decrypt the second data to obtain the first data.
- the first server receives the temporary user identity sent by the mini program platform and authenticates the user based on the temporary user identity.
- Step 441 The first server uses the session key to encrypt the fourth data to obtain the third data, where the fourth data is generated when providing services for the mini-program application based on the first data.
- Step 443 The first server sends the third data to the mini program platform.
- the mini program platform receives the third data.
- Step 445 The mini program platform uses the session key to decrypt the third data to obtain the fourth data.
- Step 447 The mini program platform returns response information of the first data to the mini program application, where the response information includes the fourth data. Correspondingly, the mini program application receives the fourth data.
- the implementation of this specification also provides a key negotiation device for a mini-program application, which can be any device, equipment, platform, or device cluster with computing and processing capabilities.
- the key negotiation device for a mini-program application provided in the embodiment of this specification is applied to a mini-program platform, and the device 500 includes: a first receiving module 501, a first sending module 505, and a storage module 503, wherein the first receiving module 501 is configured to: receive a first request sent by the mini-program application, the first request is used to request authorization to log in to the first server, and the first server is used to provide services to the mini-program application.
- the first sending module 505 is configured to: send a second request to the second server, where the second request is used to request authorization to log in to the first server, and the second server is used to provide services to the mini-program platform.
- the first receiving module 501 is configured to receive the authorization credential and the session key sent by the second server, where the authorization credential and the session key are determined by the second server according to the second request.
- the storage module 503 is configured to store a session key.
- the first sending module 505 is configured to: send an authorization certificate to the first server, where the authorization certificate is a certificate for the second server to authorize the first server to request a session key.
- the device further includes: a first encryption module 507, wherein the first receiving module 501 is configured Set to: receive a third request sent by the mini program application; the third request carries the first data.
- the first encryption module 507 is configured to: according to the third request, use the session key to encrypt the first data to obtain the second data.
- the first sending module 505 is configured to send second data to the first server, where the second data is used for the first server to decrypt using a session key to obtain the first data.
- the device further includes: a first decryption module 509, wherein the first receiving module 501 is configured to: receive third data sent by the first server, where the third data is obtained by encrypting fourth data by the first server using a session key.
- the first decryption module 509 is configured to: use the session key to decrypt the third data to obtain the fourth data.
- the first sending module 505 is configured to send fourth data to the mini-program application.
- the implementation of this specification also provides a key negotiation device for a mini-program application, which can be any device, equipment, platform, or device cluster with computing and processing capabilities.
- the key negotiation device for a mini-program application provided in the embodiment of this specification is applied to a first server, which is used to provide services to the mini-program application.
- the device 600 includes: a second receiving module 601, a second sending module 605, and a login module 603, wherein the second receiving module 601 is configured to: receive an authorization credential sent by the mini-program platform, which is a credential for the second server to authorize the first server to request a session key.
- the second sending module 605 is configured to: send a fourth request to the second server, the fourth request carries the authorization certificate, and the second server is used to provide services to the mini program platform.
- the second receiving module 601 is configured to receive a session key and a user identifier sent by the second server, where the session key and the user identifier are determined by the second server according to the fourth request.
- the login module 603 is configured to log in to the user account corresponding to the user identifier according to the user identifier.
- the device also includes: a second decryption module 607, wherein the second receiving module 601 is configured to: receive second data sent by the mini-program platform, and the second data is obtained by encrypting the first data by the mini-program platform using a session key.
- a second decryption module 607 wherein the second receiving module 601 is configured to: receive second data sent by the mini-program platform, and the second data is obtained by encrypting the first data by the mini-program platform using a session key.
- the second decryption module 607 is configured to: use the session key to decrypt the second data to obtain the first data.
- the device also includes: a second encryption module 609, wherein the second encryption module 609 is configured to: use a session key to encrypt fourth data to obtain third data, and the fourth data is generated when providing services for the mini-program application based on the first data; the second sending module 605 is configured to: send the third data to the mini-program platform.
- a second encryption module 609 wherein the second encryption module 609 is configured to: use a session key to encrypt fourth data to obtain third data, and the fourth data is generated when providing services for the mini-program application based on the first data
- the second sending module 605 is configured to: send the third data to the mini-program platform.
- the implementation of this specification also provides a key negotiation device for a small program application, which can be any device, equipment, platform, or device cluster with computing and processing capabilities.
- the key negotiation device for the mini-program application provided in the example is applied to the second server, and the second server is used to provide services to the mini-program platform.
- the device 700 includes: a third receiving module 701, a third sending module 705 and a determination module 703, wherein the third receiving module 701 is configured to: receive a second request sent by the mini-program platform, and the second request is used to request authorization to log in to the first server.
- the determination module 703 is configured to determine the authorization credential and the session key according to the second request.
- the third sending module 705 is configured to send the authorization certificate and session key to the mini program platform.
- the third receiving module 701 is configured to: receive a fourth request sent by the first server, where the fourth request is used to request to obtain a session key and a user identifier.
- the third sending module 705 is configured to send the session key and the user identifier to the first server according to the fourth request.
- One embodiment of the present specification provides a computer-readable storage medium having a computer program stored thereon.
- the computer program When the computer program is executed in a computer, the computer is caused to execute a method in any one of the embodiments of the present specification.
- An embodiment of the present specification provides a computing device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method in any embodiment of the present specification is implemented.
- the structure illustrated in the embodiments of this specification does not constitute a specific limitation on the key agreement device of the applet application.
- the key agreement device of the applet application may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently.
- the components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.
Landscapes
- Computer And Data Communications (AREA)
Abstract
本说明书实施例提供了小程序应用的密钥协商方法及装置。包括：接收小程序应用发送的用于请求授权登录第一服务器的第一请求，并向第二服务器发送与第一请求关联的第二请求，以及接收第二服务器根据第二请求确定并下发的授权凭证和会话密钥后，存储会话密钥，并向第一服务器发送第二服务器授权第一服务器请求会话密钥的授权凭证。如此进行密钥协商，降低了密钥泄露的风险，安全性较高。
Description
本说明书一个或多个实施例涉及信息安全技术领域，尤其涉及小程序应用的密钥协商方法及装置。
小程序应用因为其免安装、易使用的特点，一经推出就得到用户的广泛使用和欢迎。为了确保小程序应用发送数据的保密性，部分小程序应用(如政务类小程序和银行类小程序)在发送数据时需要对数据进行加密。然而，用于小程序应用加密数据的密钥通常被开发者编码在小程序应用的前端代码中，导致小程序应用的密钥容易被攻击者窃取，存在密钥泄露的风险。
发明内容
本说明书一个或多个实施例描述了小程序应用的密钥协商方法及装置，能够提高小程序应用协商时密钥的安全性，降低密钥泄露风险。
根据第一方面，提供小程序应用的密钥协商方法，应用于小程序平台，其中，该方法包括：接收小程序应用发送的第一请求，所述第一请求用于请求授权登录第一服务器，所述第一服务器用于向所述小程序应用提供服务；向第二服务器发送所述第二请求，所述第二请求用于请求授权登录所述第一服务器，所述第二服务器用于向所述小程序平台提供服务；接收所述第二服务器下发的授权凭证和会话密钥，所述授权凭证和会话密钥是所述第二服务器根据所述第二请求确定的；存储所述会话密钥；向所述第一服务器发送所述授权凭证，所述授权凭证为所述第二服务器授权所述第一服务器请求所述会话密钥的凭证。
可选地，在向所述第一服务器发送所述授权凭证之后，还包括：接收所述小程序应用发送的第三请求；所述第三请求中携带所述第一数据；根据所述第三请求，采用所述会话密钥对所述第一数据进行加密，得到第二数据；向所述第一服务器发送所述第二数据，所述第二数据用于供所述第一服务器采用所述会话密钥进行解密得到所述第一数据。
可选地，在向所述第一服务器发送所述授权凭证之后，还包括：接收所述第一服务
器发送的第三数据，所述第三数据为所述第一服务器采用所述会话密钥对第四数据进行加密得到的；采用所述会话密钥对所述第三数据进行解密，得到所述第四数据；向所述小程序应用发送所述第四数据。
根据第二方面，提供小程序应用的密钥协商方法，应用于第一服务器，所述第一服务器用于向所述小程序应用提供服务，所述方法包括：接收所述小程序平台发送的所述授权凭证，所述授权凭证为第二服务器授权所述第一服务器请求会话密钥的凭证；向第二服务器发送第四请求，所述第四请求中携带所述授权凭证，所述第二服务器用于向所述小程序平台提供服务；接收所述第二服务器下发的会话密钥和用户标识，所述会话密钥和用户标识是所述第二服务器根据所述第四请求确定的；根据所述用户标识登录所述用户标识对应的用户账号。
可选地，在根据所述用户标识登录所述用户标识对应的用户账号之后，还包括：接收所述小程序平台发送的第二数据，所述第二数据为所述小程序平台采用所述会话密钥对第一数据进行加密得到的；采用所述会话密钥对所述第二数据进行解密，得到所述第一数据。
可选地，在采用会话密钥对第二数据进行解密，得到第一数据之后，还包括：根据第一数据，为小程序应用提供服务；在为小程序应用提供服务时，产生第四数据；采用所述会话密钥对第四数据进行加密，得到第三数据；向所述小程序平台发送第三数据。
根据第三方面，提供小程序应用的密钥协商方法，应用于第二服务器，所述第二服务器用于向所述小程序平台提供服务，所述方法包括：接收所述小程序平台发送的第二请求，所述第二请求用于请求授权登录第一服务器；根据所述第二请求，确定授权凭证和会话密钥；向所述小程序平台发送所述授权凭证和所述会话密钥。
可选地，在向所述小程序平台发送所述授权凭证和所述会话密钥之后，还包括：接收所述第一服务器发送的第四请求，所述第四请求用于请求获取会话密钥和用户标识；根据所述第四请求，将所述会话密钥和所述用户标识发送给所述第一服务器。
根据第四方面，提供小程序应用的密钥协商装置，应用于小程序平台，该装置包括：第一接收模块、第一发送模块和存储模块，其中，所述第一接收模块配置为：接收小程序应用发送的第一请求，所述第一请求用于请求授权登录第一服务器，所述第一服务器用于向所述小程序应用提供服务；所述第一发送模块配置为：向第二服务器发送所述第二请求，所述第二请求用于请求授权登录第一服务器，所述第二服务器用于向所述小程
序平台提供服务；所述第一接收模块配置为：接收所述第二服务器下发的授权凭证和会话密钥，所述授权凭证和会话密钥是所述第二服务器根据所述第二请求确定的；所述存储模块配置为：存储所述会话密钥；所述第一发送模块配置为：向所述第一服务器发送所述授权凭证，所述授权凭证为所述第二服务器授权所述第一服务器请求所述会话密钥的凭证。
根据第五方面，提供小程序应用的密钥协商装置，应用于第一服务器，所述第一服务器用于向所述小程序应用提供服务，所述装置包括：第二接收模块、第二发送模块和登录模块，其中，所述第二接收模块配置为：接收所述小程序平台发送的所述授权凭证，所述授权凭证为第二服务器授权所述第一服务器请求会话密钥的凭证；所述第二发送模块配置为：向第二服务器发送第四请求，所述第四请求中携带所述授权凭证，所述第二服务器用于向所述小程序平台提供服务；所述第二接收模块配置为：接收所述第二服务器下发的会话密钥和用户标识，所述会话密钥和用户标识是所述第二服务器根据所述第四请求确定的，所述会话密钥与所述小程序平台中存储的会话密钥一致；所述登录模块配置为：根据所述用户标识登录所述用户标识对应的用户账号。
根据第六方面，提供小程序应用的密钥协商装置，应用于第二服务器，所述第二服务器用于向所述小程序平台提供服务，所述方法包括：第三接收模块、第三发送模块和确定模块，其中，所述第三接收模块配置为：接收所述小程序平台发送的第二请求，所述第二请求用于请求授权登录第一服务器；所述确定模块配置为：根据所述第二请求，确定授权凭证和会话密钥；所述第三发送模块配置为：向所述小程序平台发送所述授权凭证和所述会话密钥。
根据第七方面，提供一种计算设备，包括存储器和处理器，所述存储器中存储有可执行代码，所述处理器执行所述可执行代码时，实现本说明书任一实施例所述的方法。
在本说明书实施例提供的小程序应用的密钥协商方法及装置，通过在小程序平台上存储与第一服务器上会话密钥相同的会话密钥，而非在小程序应用中存储该会话密钥，使得小程序应用不能获知会话密钥，致使攻击小程序应用的攻击者无法窃取到会话密钥，降低了密钥泄露的风险，安全性较高。
另外，会话密钥与用户的登录状态关联，也就是说，在用户账号处于登录状态时会话密钥有效。当重新登录用户账号时，会话密钥自动更新，进一步提高了会话密钥的安全性。
进一步地，无需在小程序应用中存储该会话密钥，无需开发者在小程序应用上实现复杂的加密逻辑，简化了小程序应用的逻辑。
为了更清楚地说明本说明书实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图是本说明书的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1A是本说明书一个实施例提供的应用于小程序平台的小程序应用的密钥协商方法的流程图。
图1B是本说明书一个实施例提供的在完成小程序应用的密钥协商之后小程序平台的处理方法的流程图。
图1C是本说明书另一个实施例提供的在完成小程序应用的密钥协商之后小程序平台的处理方法的流程图。
图2是本说明书一个实施例提供的应用于第一服务器中的小程序应用的密钥协商方法的流程图。
图3是本说明书一个实施例提供的应用于第二服务器中的小程序应用的密钥协商方法的流程图。
图4是本说明书一个实施例提供的应用于小程序平台中的小程序应用的密钥协商装置的示意图。
图5是本说明书一个实施例提供的应用于第一服务器中的小程序应用的密钥协商装置的示意图。
图6是本说明书一个实施例提供的应用于第二服务器中的小程序应用的密钥协商装置的示意图。
下面结合附图，对本说明书提供的方案进行描述。
图1A是本说明书一个实施例提供的应用于小程序平台的小程序应用的密钥协商方
法的流程图。可以理解，该方法可以通过任何具有计算、处理能力的装置、设备、平台、设备集群来执行。该方法包括步骤101至步骤109。
步骤101，小程序平台接收小程序应用发送的第一请求。
该小程序平台对应第一服务器，该第一服务器用于向小程序应用提供服务。
该第一请求用于请求获取第一服务器的授权信息。具体的，第一请求用于请求授权登录第一服务器，或者说，第一请求用于请求获取第一服务器的登录信息，如用户账号和密码。
示例性的，该第一请求用于请求获取第一服务器的OAuth(Open Authorization)的授权。
步骤103，小程序平台向第二服务器发送第二请求，第二请求用于请求授权登录第一服务器，第二服务器用于向小程序平台提供服务。
该第二请求是小程序平台对第一请求进行转化得到的，其与第一请求的功能相同。第二请求中携带的信息与第一请求中携带的信息不完全相同。
示例性的，小程序平台将小程序应用发送的第一请求转发给第二服务器，但在转发的过程中，小程序平台将小程序平台的连接地址与第一请求一起发送给第二服务器，故小程序平台发送第二请求给第二服务器，该第二请求可以包括第一请求和小程序平台的连接地址。
在第二服务器接收到小程序平台发送的第二请求之后，第二服务器可以根据第二请求确定用于登录第一服务器的授权凭证，及小程序平台与第一服务器之间进行通信的会话密钥。第二服务器将授权凭证和会话密钥发送给小程序平台。示例性的，授权凭证可以表示为code，会话密钥可以表示为session_key。
步骤105，小程序平台接收第二服务器下发的授权凭证和会话密钥。
如上述，授权凭证和会话密钥是第二服务器根据第二请求确定的。
步骤107，小程序平台存储会话密钥。
步骤109，小程序平台向第一服务器发送授权凭证，授权凭证为第二服务器授权第一服务器请求会话密钥的凭证。
可以理解为，小程序平台会将授权凭证发送给第一服务器，以便于第一服务器根据授权凭证从第二服务器上获取到会话密钥。
具体实施时，步骤109具体可以为：小程序平台将授权凭证发送给小程序应用。小程序应用向小程序平台发送用于请求将授权凭证发送给第一服务器。小程序平台根据该请求将授权凭证发送给第一服务器。第一服务器向第二服务器发送用于获取会话密钥和用户标识的请求。第二服务器根据该请求将与小程序平台一致的会话密钥，及用户标识发送给第一服务器。第一服务器接收会话密钥和用户标识，并存储会话密钥。第一服务器根据用户标识认证用户身份。具体的，第一服务器将用户标识与预存的用户标识进行比对，在比对一致时，第一服务器确定用户身份认证通过，并登录用户标识对应的用户账号。
在第一服务器登录用户账号之后，第一服务器可以将用户登录状态信息发送给小程序平台。该用户登录状态信息可以包括用户登录状态、用户临时身份标识等，该用户临时身份标识可以表示为cookie。小程序平台接收到用户登录状态信息之后，小程序平台向小程序应用返回登录结果，以告知小程序应用是否登录成功第一服务器。
这样，在小程序平台上存储与第一服务器上会话密钥相同的会话密钥，而非在小程序应用中存储该会话密钥，使得小程序应用不能获知会话密钥，致使攻击小程序应用的攻击者无法窃取到会话密钥，降低了密钥泄露的风险，安全性较高。
另外，会话密钥与用户的登录状态关联，也就是说，在用户账号处于登录状态时会话密钥有效。当重新登录用户账号时，会话密钥自动更新，进一步提高了会话密钥的安全性。
另外，无需在小程序应用中存储该会话密钥，无需开发者在小程序应用上实现复杂的加密逻辑，简化了小程序应用的逻辑。
在一些实施例中，图1B所示，执行步骤109之后，本说明书实施例提供的小程序应用的密钥协商方法还包括步骤111至步骤115。
步骤111，小程序平台接收小程序应用发送的第三请求；第三请求中携带第一数据。
该第三请求用于请求发送第一数据，并设置加密选项。其中，加密选项可以理解为加密方式、加密的密钥。
步骤113，小程序平台根据第三请求，采用会话密钥对第一数据进行加密，得到第二数据。
示例性的，小程序平台采用步骤107中存储的会话密钥(如session_key)对第一数据进行加密，以得到第二数据。
步骤115，小程序平台向第一服务器发送第二数据，第二数据用于供第一服务器采用会话密钥进行解密得到第一数据。
在小程序将第二数据发送给第一服务器之后，第一服务器接收到第二数据，第一服务器采用与小程序平台上存储的会话密钥一致的会话密钥对第二数据进行解密，得到第一数据。
进一步的，在小程序平台向第一服务器发送第二数据时，小程序平台向第一服务器发送用户临时身份标识，第一服务器接收到用户临时身份标识，并根据该用户临时身份标识认证用户。
这样，在小程序平台和第一服务器上存储相同的会话密钥，在小程序应用向第一服务器传输数据时，小程序平台和第一服务器可以采用该会话密钥对传输的数据进行加密解密，该会话密钥的安全性较高，进一步确保了数据传输的安全性。
在一些实施例中，图1C所示，执行步骤109之后，本说明书实施例提供的小程序应用的密钥协商方法还包括步骤117至步骤121。
步骤117，小程序平台接收第一服务器发送的第三数据，第三数据为第一服务器采用会话密钥对第四数据进行加密得到的。
示例性的，如上述，在第一服务器采用会话密钥对第二数据进行解密，得到第一数据之后，第一服务器对第一数据进行处理得到第四数据，第一服务器采用会话密钥对第四数据进行加密得到第三数据之后，第一服务器将第三数据发送给小程序平台。
步骤119，小程序平台采用会话密钥对第三数据进行解密，得到第四数据。
小程序平台在接收到第一服务器发送的第三数据之后，小程序平台采用会话密钥对第三数据进行解密，得到第四数据。
步骤121，小程序平台向小程序应用发送第四数据。
可以理解为，小程序平台向小程序应用返回第一数据的响应信息，该响应信息包括第四数据。
这样，在小程序平台和第一服务器上存储相同的会话密钥，在小程序应用向第一服务器传输数据时，小程序平台和第一服务器可以采用该会话密钥对传输的数据进行加密解密，该会话密钥的安全性较高，进一步确保了数据传输的安全性。
图2示出根据一个实施例的小程序应用的密钥协商方法的流程图。可以理解，该方法可以通过任何具有计算、处理能力的装置、设备、平台、设备集群来执行。参见图2，本说明书实施例提供的小程序应用的密钥协商方法，应用于第一服务器，第一服务器用于向小程序应用提供服务，该方法包括步骤201至步骤215。
步骤201，第一服务器接收小程序平台发送的授权凭证，授权凭证为第二服务器授权所述第一服务器请求会话密钥的凭证。
具体实施时，参见上述步骤109中对第一服务器的相关描述，在此不再赘述。
步骤203，第一服务器向第二服务器发送第四请求，第四请求中携带授权凭证，第二服务器用于向小程序平台提供服务。
该第四请求用于请求第二服务器下发会话密钥和用户标识。
在第二服务器接收到第一服务器发送的第四请求之后，第二服务器根据授权凭证获取授权凭证对应的会话密钥和用户标识。第二服务器将会话密钥和用户标识发送给第一服务器。
具体实施时，参见上述步骤109中对第二服务器的相关描述，在此不再赘述。
步骤205，第一服务器接收第二服务器下发的会话密钥和用户标识，会话密钥和用户标识是第二服务器根据第四请求确定的，会话密钥与小程序平台中存储的会话密钥一致。
步骤207，第一服务器根据用户标识登录用户标识对应的用户账号。
具体实施时，参见上述步骤109中对第一服务器的相关描述，在此不再赘述。
在一些实施例中，在执行步骤207之后，还包括：步骤209，第一服务器接收小程序平台发送的第二数据，第二数据为小程序平台采用会话密钥对第一数据进行加密得到的。
具体实施时，参见上述步骤115中对第一服务器的相关描述，在此不再赘述。
步骤211，第一服务器采用会话密钥对第二数据进行解密，得到第一数据。
具体实施时，参见上述步骤115中对第一服务器的相关描述，在此不再赘述。
在一些实施例中，在执行步骤211之后，还包括：步骤213，第一服务器采用会话密钥对第四数据进行加密，得到第三数据。
其中，在步骤213之前，第一服务器可以根据第一数据为小程序应用提供服务，在为小程序应用提供服务时，产生第四数据。换句话说，第四数据是在根据第一数据为小程序应用提供服务器时产生的。
具体实施时，参见上述步骤117中对第一服务器的相关描述，在此不再赘述。
步骤215，第一服务器向小程序平台发送第三数据。
具体实施时，参见上述步骤117中对第一服务器的相关描述，在此不再赘述。
这样，在小程序平台上存储与第一服务器上会话密钥相同的会话密钥，而非在小程序应用中存储该会话密钥，使得小程序应用不能获知会话密钥，致使攻击小程序应用的攻击者无法窃取到会话密钥，降低了密钥泄露的风险，安全性较高。
另外，会话密钥与用户的登录状态关联，也就是说，在用户账号处于登录状态时会
话密钥有效。当重新登录用户账号时，会话密钥自动更新，进一步提高了会话密钥的安全性。
另外，无需在小程序应用中存储该会话密钥，无需开发者在小程序应用上实现复杂的加密逻辑，简化了小程序应用的逻辑。
图3示出根据一个实施例的小程序应用的密钥协商方法的流程图。可以理解，该方法可以通过任何具有计算、处理能力的装置、设备、平台、设备集群来执行。参见图3，本说明书实施例提供的小程序应用的密钥协商方法，应用于第二服务器，第二服务器用于向小程序平台提供服务，该方法包括步骤301至步骤309。
步骤301，第二服务器接收小程序平台发送的第二请求，第二请求用于请求授权登录第一服务器。
具体实施时，参见上述步骤103中对第二服务器的相关描述，在此不再赘述。
步骤303，第二服务器根据第二请求，确定授权凭证和会话密钥。
具体实施时，参见上述步骤103中对第二服务器的相关描述，在此不再赘述。
步骤305，第二服务器向小程序平台发送授权凭证和会话密钥。
具体实施时，参见上述步骤103中对第二服务器的相关描述，在此不再赘述。
在一些实施例中，在执行步骤305之后，还包括：步骤307，第二服务器接收第一服务器发送的第四请求，第四请求用于请求获取会话密钥和用户标识。
具体实施时，参见上述步骤203中对第二服务器的相关描述，在此不再赘述。
步骤309，第二服务器根据第四请求，将会话密钥和用户标识发送给第一服务器。
具体实施时，参见上述步骤203中对第二服务器的相关描述，在此不再赘述。
这样，在小程序平台上存储与第一服务器上会话密钥相同的会话密钥，而非在小程序应用中存储该会话密钥，使得小程序应用不能获知会话密钥，致使攻击小程序应用的攻击者无法窃取到会话密钥，降低了密钥泄露的风险，安全性较高。
另外，会话密钥与用户的登录状态关联，也就是说，在用户账号处于登录状态时会话密钥有效。当重新登录用户账号时，会话密钥自动更新，进一步提高了会话密钥的安全性。
另外，无需在小程序应用中存储该会话密钥，无需开发者在小程序应用上实现复杂的加密逻辑，简化了小程序应用的逻辑。
为了更加便于理解，下面结合小程序应用、小程序平台、第一服务器、第二服务器配合完成的处理，来对小程序应用的密钥协商方法及密钥协商之后的数据处理方法进行说明。具体的，该说明的过程可以包括步骤401-步骤447(其中部分步骤可选)，具体
请参考以下实施例的描述。
步骤401，小程序应用向小程序平台发送第一请求，该第一请求用于请求获取第一服务器的授权信息。相应的，小程序平台接收第一请求。
具体实施时，参见上述步骤101中的相关描述，在此不再赘述。
步骤403，小程序平台向第二服务器发送第二请求，第二请求用于请求授权登录第一服务器，第二服务器用于向小程序平台提供服务。相应的，第二服务器接收第二请求。
具体实施时，参见上述步骤103中的相关描述，在此不再赘述。
步骤405，第二服务器根据第二请求确定用于登录第一服务器的授权凭证，及小程序平台与第一服务器之间进行通信的会话密钥。
具体实施时，参见上述步骤103中的相关描述，在此不再赘述。
步骤407，第二服务器将授权凭证和会话密钥发送给小程序平台，相应的，小程序平台接收授权凭证和会话密钥。
步骤409，小程序平台存储会话密钥。
步骤411，小程序平台将授权凭证发送给小程序应用，相应的，小程序应用接收授权凭证。
步骤413，小程序应用向小程序平台发送用于请求将授权凭证发送给第一服务器。
步骤417，小程序平台根据该请求，向第一服务器发送授权凭证。相应的，第一服务器接收授权凭证。
步骤419，第一服务器向第二服务器发送用于获取会话密钥和用户标识的请求。相应的，第二服务器接收该请求。
步骤421，第二服务器根据该请求，将与小程序平台一致的会话密钥，及用户标识发送给第一服务器。相应的，第一服务器接收会话密钥和用户标识。
步骤423，第一服务器存储会话密钥。
步骤425，第一服务器根据用户标识认证用户身份。
步骤427，在确定用户身份认证通过后，第一服务器登录用户标识对应的用户账号。
步骤429，第一服务器将用户登录状态信息发送给小程序平台，该用户登录状态信息可以包括用户临时身份标识。相应的，小程序平台接收用户登录状态信息。
步骤431，小程序平台向小程序应用返回登录结果，以告知小程序应用是否登录成功第一服务器。
步骤433，小程序应用向小程序平台发送的第三请求，第三请求中携带第一数据。相应的，小程序平台接收第三请求。
步骤435，小程序平台根据第三请求，采用会话密钥对第一数据进行加密，得到第二数据。
步骤437，小程序平台向第一服务器发送第二数据，第二数据用于供第一服务器采用会话密钥进行解密得到第一数据。相应的，第一服务器接收第二数据。
进一步的，在小程序平台向第一服务器发送第二数据时，小程序平台向第一服务器发送用户临时身份标识。
步骤439，第一服务器采用与小程序平台上存储的会话密钥一致的会话密钥对第二数据进行解密，得到第一数据。
进一步的，第一服务器接收到小程序平台发送的用户临时身份标识，并根据该用户临时身份标识认证用户。
步骤441，第一服务器采用会话密钥对第四数据进行加密得到第三数据，该第四数据为在根据第一数据为小程序应用提供服务时产生的。
步骤443，第一服务器向小程序平台发送第三数据。相应的，小程序平台接收第三数据。
步骤445，小程序平台采用会话密钥对第三数据进行解密，得到第四数据。
步骤447，小程序平台向小程序应用返回第一数据的响应信息，该响应信息包括第四数据。相应的，小程序应用接收第四数据。
本说明书实施还提供小程序应用的密钥协商装置，该小程序应用的密钥协商装置可以为任何具有计算、处理能力的装置、设备、平台、设备集群。参见图4，本说明书实施例提供的小程序应用的密钥协商装置，应用于小程序平台，该装置500包括：第一接收模块501、第一发送模块505和存储模块503，其中，第一接收模块501配置为：接收小程序应用发送的第一请求，第一请求用于请求授权登录第一服务器，第一服务器用于向小程序应用提供服务。
第一发送模块505配置为：向第二服务器发送第二请求，第二请求用于请求授权登录第一服务器，第二服务器用于向小程序平台提供服务。
第一接收模块501配置为：接收第二服务器下发的授权凭证和会话密钥，授权凭证和会话密钥是第二服务器根据第二请求确定的。
存储模块503配置为：存储会话密钥。
第一发送模块505配置为：向第一服务器发送授权凭证，授权凭证为第二服务器授权第一服务器请求会话密钥的凭证。
在一些实施例中，该装置还包括：第一加密模块507，其中，第一接收模块501配
置为：接收小程序应用发送的第三请求；第三请求中携带第一数据。
第一加密模块507配置为：根据第三请求，采用会话密钥对第一数据进行加密，得到第二数据。
第一发送模块505配置为：向第一服务器发送第二数据，第二数据用于供第一服务器采用会话密钥进行解密得到第一数据。
在一些实施例中，该装置还包括：第一解密模块509，其中，第一接收模块501配置为：接收第一服务器发送的第三数据，第三数据为第一服务器采用会话密钥对第四数据进行加密得到的。
第一解密模块509配置为：采用会话密钥对第三数据进行解密，得到第四数据。
第一发送模块505配置为：向小程序应用发送第四数据。
本说明书实施还提供小程序应用的密钥协商装置，该小程序应用的密钥协商装置可以为任何具有计算、处理能力的装置、设备、平台、设备集群。参见图5，本说明书实施例提供的小程序应用的密钥协商装置，应用于第一服务器，第一服务器用于向小程序应用提供服务，该装置600包括：第二接收模块601、第二发送模块605和登录模块603，其中，第二接收模块601配置为：接收小程序平台发送的授权凭证，授权凭证为第二服务器授权所述第一服务器请求会话密钥的凭证。
第二发送模块605配置为：向第二服务器发送第四请求，第四请求中携带授权凭证，第二服务器用于向小程序平台提供服务。
第二接收模块601配置为：接收第二服务器下发的会话密钥和用户标识，会话密钥和用户标识是第二服务器根据第四请求确定的。
登录模块603配置为：根据用户标识登录用户标识对应的用户账号。
在一些实施例中，该装置还包括：第二解密模块607，其中，第二接收模块601配置为：接收小程序平台发送的第二数据，第二数据为小程序平台采用会话密钥对第一数据进行加密得到的。
第二解密模块607配置为：采用会话密钥对第二数据进行解密，得到第一数据。
在一些实施例中，该装置还包括：第二加密模块609，其中，第二加密模块609配置为：采用会话密钥对第四数据进行加密，得到第三数据，第四数据是在根据所述第一数据为小程序应用提供服务时产生的；第二发送模块605配置为：向小程序平台发送第三数据。
本说明书实施还提供小程序应用的密钥协商装置，该小程序应用的密钥协商装置可以为任何具有计算、处理能力的装置、设备、平台、设备集群。参见图6，本说明书实
施例提供的小程序应用的密钥协商装置，应用于第二服务器，第二服务器用于向小程序平台提供服务，该装置700包括：第三接收模块701、第三发送模块705和确定模块703，其中，第三接收模块701配置为：接收小程序平台发送的第二请求，第二请求用于请求授权登录第一服务器。
确定模块703配置为：根据第二请求，确定授权凭证和会话密钥。
第三发送模块705配置为：向小程序平台发送授权凭证和会话密钥。
在一些实施例中，第三接收模块701配置为：接收第一服务器发送的第四请求，第四请求用于请求获取会话密钥和用户标识。
第三发送模块705配置为：根据第四请求，将会话密钥和用户标识发送给第一服务器。
本说明书一个实施例提供了一种计算机可读存储介质，其上存储有计算机程序，当所述计算机程序在计算机中执行时，令计算机执行说明书中任一个实施例中的方法。
本说明书一个实施例提供了一种计算设备，包括存储器和处理器，所述存储器中存储有可执行代码，所述处理器执行所述可执行代码时，实现执行说明书中任一个实施例中的方法。
可以理解的是，本说明书实施例示意的结构并不构成对小程序应用的密钥协商装置的具体限定。在说明书的另一些实施例中，小程序应用的密钥协商装置可以包括比图示更多或者更少的部件，或者组合某些部件，或者拆分某些部件，或者不同的部件布置。图示的部件可以以硬件、软件或者软件和硬件的组合来实现。
上述装置、系统内的各模块之间的信息交互、执行过程等内容，由于与本说明书方法实施例基于同一构思，具体内容可参见本说明书方法实施例中的叙述，此处不再赘述。
本说明书中的各个实施例均采用递进的方式描述，各个实施例之间相同相似的部分互相参见即可，每个实施例重点说明的都是与其他实施例的不同之处。尤其，对于装置实施例而言，由于其基本相似于方法实施例，所以描述的比较简单，相关之处参见方法实施例的部分说明即可。
本领域技术人员应该可以意识到，在上述一个或多个示例中，本申请所描述的功能可以用硬件、软件、挂件或它们的任意组合来实现。当使用软件实现时，可以将这些功能存储在计算机可读介质中或者作为计算机可读介质上的一个或多个指令或代码进行传输。
以上所述的具体实施方式，对本申请的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上所述为本申请的具体实施方式，并不用于限定本申请的保
护范围，凡在本申请的技术方案的基础之上，所做的任何修改、等同替换、改进等，均应包括在本申请的保护范围之内。
Claims (12)
- 小程序应用的密钥协商方法，应用于小程序平台，其中，该方法包括：接收小程序应用发送的第一请求，所述第一请求用于请求授权登录第一服务器，所述第一服务器用于向所述小程序应用提供服务；向第二服务器发送第二请求，所述第二请求用于请求授权登录所述第一服务器，所述第二服务器用于向所述小程序平台提供服务；接收所述第二服务器下发的授权凭证和会话密钥，所述授权凭证和会话密钥是所述第二服务器根据所述第二请求确定的；存储所述会话密钥；向所述第一服务器发送所述授权凭证，所述授权凭证为所述第二服务器授权所述第一服务器请求所述会话密钥的凭证。
- 根据权利要求1所述的方法，在向所述第一服务器发送所述授权凭证之后，还包括：接收所述小程序应用发送的第三请求；所述第三请求中携带第一数据；根据所述第三请求，采用所述会话密钥对所述第一数据进行加密，得到第二数据；向所述第一服务器发送所述第二数据，所述第二数据用于供所述第一服务器采用所述会话密钥进行解密得到所述第一数据。
- 根据权利要求1或2所述的方法，其特征在于，在向所述第一服务器发送所述授权凭证之后，还包括：接收所述第一服务器发送的第三数据，所述第三数据为所述第一服务器采用所述会话密钥对第四数据进行加密得到的；采用所述会话密钥对所述第三数据进行解密，得到所述第四数据；向所述小程序应用发送所述第四数据。
- 小程序应用的密钥协商方法，应用于第一服务器，所述第一服务器用于向小程序应用提供服务，所述方法包括：接收小程序平台发送的授权凭证，所述授权凭证为第二服务器授权所述第一服务器请求会话密钥的凭证；向第二服务器发送第四请求，所述第四请求中携带所述授权凭证，所述第二服务器用于向所述小程序平台提供服务；接收所述第二服务器下发的会话密钥和用户标识，所述会话密钥和用户标识是所述第二服务器根据所述第四请求确定的；根据所述用户标识登录所述用户标识对应的用户账号。
- 根据权利要求4所述的方法，其特征在于，在根据所述用户标识登录所述用户标识对应的用户账号之后，还包括：接收所述小程序平台发送的第二数据，所述第二数据为所述小程序平台采用所述会话密钥对第一数据进行加密得到的；采用所述会话密钥对所述第二数据进行解密，得到所述第一数据。
- 根据权利要求5所述的方法，其特征在于，在采用所述会话密钥对所述第二数据进行解密，得到所述第一数据之后，还包括：根据所述第一数据，为小程序应用提供服务；在为小程序应用提供服务时，产生第四数据；采用所述会话密钥对所述第四数据进行加密，得到第三数据；向所述小程序平台发送所述第三数据。
- 小程序应用的密钥协商方法，应用于第二服务器，所述第二服务器用于向小程序平台提供服务，所述方法包括：接收所述小程序平台发送的第二请求，所述第二请求用于请求授权登录第一服务器；根据所述第二请求，确定授权凭证和会话密钥；向所述小程序平台发送所述授权凭证和所述会话密钥。
- 根据权利要求7所述的方法，在向所述小程序平台发送所述授权凭证和所述会话密钥之后，还包括：接收第一服务器发送的第四请求，所述第四请求用于请求获取会话密钥和用户标识；根据所述第四请求，将所述会话密钥和所述用户标识发送给所述第一服务器。
- 小程序应用的密钥协商装置，应用于小程序平台，该装置包括：第一接收模块、第一发送模块和存储模块，其中，所述第一接收模块配置为：接收小程序应用发送的第一请求，所述第一请求用于请求授权登录第一服务器，所述第一服务器用于向所述小程序应用提供服务；所述第一发送模块配置为：向第二服务器发送第二请求，所述第二请求用于请求授权登录第一服务器，所述第二服务器用于向所述小程序平台提供服务；所述第一接收模块配置为：接收所述第二服务器下发的授权凭证和会话密钥，所述授权凭证和会话密钥是所述第二服务器根据所述第二请求确定的；所述存储模块配置为：存储所述会话密钥；所述第一发送模块配置为：向所述第一服务器发送所述授权凭证，所述授权凭证为 所述第二服务器授权所述第一服务器请求所述会话密钥的凭证。
- 小程序应用的密钥协商装置，应用于第一服务器，所述第一服务器用于向小程序应用提供服务，所述装置包括：第二接收模块、第二发送模块和登录模块，其中，所述第二接收模块配置为：接收小程序平台发送的授权凭证，所述授权凭证为第二服务器授权所述第一服务器请求会话密钥的凭证；所述第二发送模块配置为：向第二服务器发送第四请求，所述第四请求中携带所述授权凭证，所述第二服务器用于向所述小程序平台提供服务；所述第二接收模块配置为：接收所述第二服务器下发的会话密钥和用户标识，所述会话密钥和用户标识是所述第二服务器根据所述第四请求确定的；所述登录模块配置为：根据所述用户标识登录所述用户标识对应的用户账号。
- 小程序应用的密钥协商装置，应用于第二服务器，所述第二服务器用于向小程序平台提供服务，所述装置包括：第三接收模块、第三发送模块和确定模块，其中，所述第三接收模块配置为：接收所述小程序平台发送的第二请求，所述第二请求用于请求授权登录第一服务器；所述确定模块配置为：根据所述第二请求，确定授权凭证和会话密钥；所述第三发送模块配置为：向所述小程序平台发送所述授权凭证和所述会话密钥。
- 一种计算设备，包括存储器和处理器，所述存储器中存储有可执行代码，所述处理器执行所述可执行代码时，实现权利要求1-8中任一项所述的方法。
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211606601.8 | 2022-12-13 | ||
| CN202211606601.8A CN116032556A (zh) | 2022-12-13 | 2022-12-13 | 小程序应用的密钥协商方法及装置 |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| WO2024124924A1 true WO2024124924A1 (zh) | 2024-06-20 |
Family
ID=86090309
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| PCT/CN2023/112431 WO2024124924A1 (zh) | 2022-12-13 | 2023-08-11 | 小程序应用的密钥协商方法及装置 |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN116032556A (zh) |
| WO (1) | WO2024124924A1 (zh) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116032556A (zh) * | 2022-12-13 | 2023-04-28 | 支付宝(杭州)信息技术有限公司 | 小程序应用的密钥协商方法及装置 |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103634265A (zh) * | 2012-08-20 | 2014-03-12 | 腾讯科技（深圳）有限公司 | 安全认证的方法、设备及系统 |
| CN104065616A (zh) * | 2013-03-20 | 2014-09-24 | 中国移动通信集团公司 | 单点登录方法和系统 |
| US20140317408A1 (en) * | 2013-04-19 | 2014-10-23 | Kaseya International Limited | Data backup and service encryption key management |
| CN105681030A (zh) * | 2015-12-31 | 2016-06-15 | 腾讯科技（深圳）有限公司 | 密钥管理系统、方法及装置 |
| CN111064757A (zh) * | 2020-03-18 | 2020-04-24 | 腾讯科技（深圳）有限公司 | 应用访问方法、装置、电子设备以及存储介质 |
| CN111901346A (zh) * | 2020-07-29 | 2020-11-06 | 北京奇艺世纪科技有限公司 | 一种身份认证系统 |
| CN116032556A (zh) * | 2022-12-13 | 2023-04-28 | 支付宝(杭州)信息技术有限公司 | 小程序应用的密钥协商方法及装置 |
Family Cites Families (12)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101420413B (zh) * | 2007-10-25 | 2012-11-07 | 华为技术有限公司 | 会话密钥协商方法、认证服务器及网络设备 |
| KR101138283B1 (ko) * | 2010-04-22 | 2012-04-24 | 비씨카드(주) | 모바일 결제 방법 및 시스템 |
| CN105391734B (zh) * | 2015-12-10 | 2019-01-11 | 布比（北京）网络技术有限公司 | 一种安全登录系统及方法、登录服务器和认证服务器 |
| CN106712932B (zh) * | 2016-07-20 | 2019-03-19 | 腾讯科技（深圳）有限公司 | 密钥管理方法、装置及系统 |
| CN109905350B (zh) * | 2017-12-08 | 2022-08-12 | 阿里巴巴集团控股有限公司 | 一种数据传输方法及系统 |
| CN110022279B (zh) * | 2018-01-08 | 2021-11-26 | 普天信息技术有限公司 | 一种微服务系统中认证鉴权的方法和系统 |
| CN110535648B (zh) * | 2018-05-24 | 2022-05-06 | 腾讯科技（深圳）有限公司 | 电子凭证生成及验证和密钥控制方法、装置、系统和介质 |
| CN112039826B (zh) * | 2019-06-03 | 2023-05-30 | 北京京东尚科信息技术有限公司 | 应用于小程序端的登录方法和装置，电子设备，可读介质 |
| CN111030818A (zh) * | 2020-01-09 | 2020-04-17 | 上海金仕达软件科技有限公司 | 一种基于微服务网关的统一会话管理方法及系统 |
| CN111259356B (zh) * | 2020-02-17 | 2022-09-02 | 北京百度网讯科技有限公司 | 授权方法、辅助授权组件、管理服务器和计算机可读介质 |
| CN114598454B (zh) * | 2020-12-03 | 2023-11-21 | 中移(成都)信息通信科技有限公司 | 密钥生成及身份认证方法、装置、设备及计算机存储介质 |
| CN114257382B (zh) * | 2022-01-30 | 2024-06-11 | 支付宝(杭州)信息技术有限公司 | 密钥管理和业务处理方法、装置及系统 |
-
2022
- 2022-12-13 CN CN202211606601.8A patent/CN116032556A/zh active Pending
-
2023
- 2023-08-11 WO PCT/CN2023/112431 patent/WO2024124924A1/zh unknown
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103634265A (zh) * | 2012-08-20 | 2014-03-12 | 腾讯科技（深圳）有限公司 | 安全认证的方法、设备及系统 |
| CN104065616A (zh) * | 2013-03-20 | 2014-09-24 | 中国移动通信集团公司 | 单点登录方法和系统 |
| US20140317408A1 (en) * | 2013-04-19 | 2014-10-23 | Kaseya International Limited | Data backup and service encryption key management |
| CN105681030A (zh) * | 2015-12-31 | 2016-06-15 | 腾讯科技（深圳）有限公司 | 密钥管理系统、方法及装置 |
| CN111064757A (zh) * | 2020-03-18 | 2020-04-24 | 腾讯科技（深圳）有限公司 | 应用访问方法、装置、电子设备以及存储介质 |
| CN111901346A (zh) * | 2020-07-29 | 2020-11-06 | 北京奇艺世纪科技有限公司 | 一种身份认证系统 |
| CN116032556A (zh) * | 2022-12-13 | 2023-04-28 | 支付宝(杭州)信息技术有限公司 | 小程序应用的密钥协商方法及装置 |
Also Published As
| Publication number | Publication date |
|---|---|
| CN116032556A (zh) | 2023-04-28 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US11501294B2 (en) | Method and device for providing and obtaining graphic code information, and terminal | |
| CN105850073B (zh) | 信息系统访问认证方法及装置 | |
| US7992193B2 (en) | Method and apparatus to secure AAA protocol messages | |
| KR101265873B1 (ko) | 분산된 단일 서명 서비스 방법 | |
| KR101534890B1 (ko) | 신뢰된 장치별 인증 | |
| USH2270H1 (en) | Open protocol for authentication and key establishment with privacy | |
| US9137017B2 (en) | Key recovery mechanism | |
| WO2019109852A1 (zh) | 一种数据传输方法及系统 | |
| CN109981665B (zh) | 资源提供方法及装置、资源访问方法及装置和系统 | |
| US10686771B2 (en) | User sign-in and authentication without passwords | |
| EP2414983B1 (en) | Secure Data System | |
| CN113225352A (zh) | 一种数据传输方法、装置、电子设备及存储介质 | |
| US20210392004A1 (en) | Apparatus and method for authenticating device based on certificate using physical unclonable function | |
| WO2024124924A1 (zh) | 小程序应用的密钥协商方法及装置 | |
| CN114553480B (zh) | 跨域单点登录方法、装置、电子设备及可读存储介质 | |
| JP2014235753A (ja) | データを入力する方法と装置 | |
| CN117336092A (zh) | 一种客户端登录方法、装置、电子设备和存储介质 | |
| JP2003234734A (ja) | 相互認証方法及びサーバ装置及びクライアント装置及び相互認証プログラム及び相互認証プログラムを格納した記憶媒体 | |
| CN107682380B (zh) | 一种交叉认证的方法及装置 | |
| CN113727059B (zh) | 多媒体会议终端入网认证方法、装置、设备及存储介质 | |
| CN110912857A (zh) | 移动应用间共享登录的方法、存储介质 | |
| CN115348015A (zh) | 安全接入方法及装置、计算机可读存储介质、电子设备 | |
| CN114282254A (zh) | 加密、解密方法及装置、电子设备 | |
| CN113660285A (zh) | 多媒体会议在网终端管控方法、装置、设备及存储介质 | |
| CN112887983A (zh) | 设备身份认证方法、装置、设备及介质 |