CN103685194A - Capacity calling method and device, and terminal - Google Patents

Abstract

The invention discloses a capability calling method, device and terminal, comprising: receiving a first capability calling request message sent by a specified application in the terminal, wherein the specified application is one of the applications with capability calling authority in the terminal; Add verification information corresponding to the specified application to the first capability call request message, generate a second capability call request message; send the second capability call request message to the capability open platform; receive the corresponding capability call returned by the capability open platform response message, and send the capability call response message to the specified application. By adopting the method, device and terminal provided by the invention, network resources and terminal resources can be saved.

Description

A capability calling method, device and terminal

technical field

The present invention relates to the field of wireless communication, in particular to a method, device and terminal for invoking a capability.

Background technique

With the development of the Internet and the continuous enrichment of Internet applications, facing the opportunities and challenges brought about by the development of the Internet, telecom operators, on the basis of exploring how to increase application innovation and deeply tap the potential of value-added As well as Internet capabilities, attract global developers, and develop more long-tail applications based on open capabilities by comprehensively lowering the threshold for application innovation.

Not only that, the mobile Internet provides opportunities for new business models such as in-app billing. However, this forward business model of charging end users leads to frequent theft of billing codes, forged user identities, tampering and counterfeiting of applications, etc. occurred, some users were maliciously deducted fees, and operators suffered user complaints, which also seriously affected the commercial interests of application developers and operators. In addition, due to the open source of terminal operating systems and the popularity of smart terminals, as well as the scenario where a single terminal application is downloaded and run by a large number of terminals once released, terminal applications and their capability exposure face greater security risks and challenges.

Therefore, in capability exposure for terminal application scenarios, how to ensure the security of capability exposure, application security, billing security, user privacy security, and application and content security is always a key issue in capability exposure. An effective security mechanism needs to be used to meet the security requirements of capability exposure.

The existing capability exposure system deploys security components in each application, but this method will bring about the problem of repeated download and installation of the same logic, resulting in network resource overhead and a large occupation of terminal resources when installed on the terminal. In addition, the way of deploying security components in each application makes it difficult to solve the problem of updating each security component.

Contents of the invention

Embodiments of the present invention provide a capability invoking method, device, and terminal to solve the problems in the prior art of high network resource overhead during application downloading and large resource occupation of the application installed in the terminal.

An embodiment of the present invention provides a method for invoking a capability, including:

receiving a first capability invocation request message sent by a specified application in the terminal, where the specified application is one of the applications that the terminal has capability invocation authority;

Adding verification information corresponding to the designated application to the first capability invocation request message to generate a second capability invocation request message;

sending the second capability invocation request message to the capability opening platform;

Receive the corresponding capability invocation response message returned by the capability opening platform, and send the capability invocation response message to the specified application.

An embodiment of the present invention provides a capability calling device, including:

A receiving unit, configured to receive a first capability call request message sent by a specified application in the terminal, where the specified application is one of the applications that the terminal has permission to call capabilities; and receive the corresponding capability returned by the capability openness platform invoking a response message, and sending the capability invoking response message to the specified application;

An adding unit, configured to add verification information corresponding to the specified application to the first capability invocation request message, and generate a second capability invocation request message;

A sending unit, configured to send the second capability invocation request message to the capability opening platform.

An embodiment of the present invention provides a terminal, including: the above device for invoking a capability.

The beneficial effects of the present invention include:

In the method provided by the embodiment of the present invention, when there are multiple applications in the terminal, any application can send a capability invocation request message to the capability openness platform through a security middleware, and obtain a capability invocation response message returned by the capability openness platform. Therefore, it is not necessary to download and install security components in each application in the terminal, but only download and install a security middleware in the terminal, which can reduce the overhead of network resources when the application is downloaded, and reduce the number of applications installed in the terminal resources used.

Description of drawings

The accompanying drawings are used to provide a further understanding of the present invention, and constitute a part of the description, and are used together with the embodiments of the present invention to explain the present invention, and do not constitute a limitation to the present invention. In the attached picture:

FIG. 1 is a flowchart of a capability calling method provided by an embodiment of the present invention;

FIG. 2 is a detailed flow chart of a capability calling method provided by an embodiment of the present invention;

Fig. 3 is a detailed flowchart of the security middleware obtaining the application key from the capability opening platform provided by the embodiment of the present invention;

Fig. 4 is a schematic structural diagram of a capability calling device provided by an embodiment of the present invention.

Detailed ways

In order to provide an implementation plan for saving network resources and terminal resources, the embodiments of the present invention provide a capability calling method, device, and terminal. The preferred embodiments of the present invention will be described below in conjunction with the accompanying drawings. It should be understood that the The preferred embodiments are only used to illustrate and explain the present invention, not to limit the present invention. And in the case of no conflict, the embodiments in the present application and the features in the embodiments can be combined with each other.

An embodiment of the present invention provides a method for invoking a capability, as shown in FIG. 1 , including:

Step 101. Receive a first capability invocation request message sent by a specified application in the terminal, wherein the specified application is one of the applications with capability invocation authority in the terminal;

Step 102: Add verification information corresponding to the designated application to the first capability invocation request message to generate a second capability invocation request message;

Step 103, sending the second capability invocation request message to the capability opening platform;

Step 104: Receive the corresponding capability invocation response message returned by the capability opening platform, and send the capability invocation response message to the specified application.

The method provided by the present invention will be described in detail below with specific embodiments in conjunction with the accompanying drawings.

Figure 2 is a detailed flow chart of the capability invocation method provided by the embodiment of the present invention, which specifically includes:

Step 201, the specified application sends a first capability invocation request message carrying the specified application identifier AppID to the security middleware in the terminal to which it belongs.

Wherein, the specified application may be any one of multiple applications of the terminal, that is, any application sends a first capability invocation request message carrying an application identifier to the security middleware when invoking a capability.

Step 202, the security middleware receives the first capability call request message, and returns a verification indication message carrying the random number Random to the designated application.

Step 203, the designated application receives the verification indication message, and generates a first message digest H1 based on the designated application key AppKey and Random.

Step 204, the designated application sends a verification request message carrying H1 to the security middleware.

Step 205, the security middleware receives the verification request message, and verifies the specified application, specifically:

Obtain the application key corresponding to the specified application, generate a second message digest H2 based on the application key corresponding to the specified application and Random, and determine whether H1 and H2 are the same.

Among them, when there is an application key corresponding to the specified application in the application key stored locally, the application key corresponding to the specified application can be directly called; when there is no application key corresponding to the specified application in the locally stored application key When using the key, the security middleware obtains the application key corresponding to the specified application from the capability exposure platform. For the specific obtaining process, refer to process 3.

When H1 and H2 are the same, the verification is passed, and step 206 is entered; when H1 and H2 are different, the verification fails, and the process is stopped.

Step 206, the security middleware adds to the first capability invocation request message the pseudo-code PID generated based on the mobile subscriber international number MSISDN and AppID corresponding to the terminal, the number of times the security middleware receives the first capability invocation request message sent by the specified application Counter, Based on the authentication factor Seed and the terminal token TerToken generated by the Counter, a second capability invocation request message carrying the AppID, PID, Counter and TerToken is generated.

Step 207, the security middleware sends the second capability invocation request message to the capability opening platform.

Step 208, the capability opening platform receives the second capability call request message, and verifies the TerToken, specifically:

Based on the authentication factor shared with the security middleware and the token generated by the Counter, it is judged whether the TerToken is the same as the token.

When the TerToken is the same as the token, the verification is passed, and step 209 is entered; when the TerToken is different from the token, the verification fails, and an error code is returned.

In step 209, the capability opening platform verifies the signing relationship between the application and the capability, the subscription relationship between the user and the application product, the sub-account of the developer, and the account of the user.

When the verification is passed, enter step 210; when the verification fails, an error code is returned.

Step 210, the capability opening platform performs withholding fee processing on applications and users.

Step 211, the capability opening platform sends an invocation request message to the capability platform.

Step 212, the capability platform returns a capability call response message to the capability opening platform.

Step 213, the capability opening platform receives the capability invocation response message, and sends the capability invocation response message to the security middleware.

Step 214, the security middleware receives the capability invocation response message, and sends the capability invocation response message to the designated application.

After the capability opening platform completes the capability call, it can also perform operations such as fee deduction processing. This part is an existing technology and will not be described in detail here.

Fig. 3 is a detailed flow chart of the security middleware obtaining the application key corresponding to the specified application from the capability exposure platform when there is no application key corresponding to the specified application among the application keys locally stored by the security middleware in the above step 205 , including:

Step 301, the security middleware generates a third message digest H3 based on the security middleware key Mkey, AppID, H1, Random and timestamp Timestamp;

Step 302, the security middleware sends a specified application key acquisition request message carrying security middleware identifiers MiddlewareID, AppID, H1, H3, Random, and Timestamp to the capability exposure platform;

Step 303, the capability opening platform receives the specified application key acquisition request message, and verifies H3, specifically:

The capability exposure platform obtains the security middleware key corresponding to the security middleware through MiddlewareID, generates the fourth message digest H4 based on the security middleware key corresponding to the security middleware, AppID, H1, Random and Timestamp, and judges whether H3 and H4 are same.

When H3 and H4 are the same, the verification of H3 is passed, and step 304 is entered; when H3 and H4 are different, the verification of H3 fails, and the process is stopped.

Step 304, the capability opening platform verifies H1, specifically:

The capability exposure platform obtains the application key corresponding to the specified application through the AppID, generates the fifth message digest H5 based on the application key corresponding to the specified application and Random, and determines whether H1 and H5 are the same.

When H1 and H5 are the same, the verification of H1 is passed, and step 305 is entered; when H1 and H5 are different, the verification of H1 fails, and the process is stopped.

Step 305, the capability opening platform returns a key response message carrying the application key corresponding to the specified application to the security middleware.

Preferably, the security middleware key corresponding to the security middleware can be used to encrypt the application key corresponding to the specified application, and the capability opening platform returns the encrypted application key corresponding to the specified application to the security middleware. Key reply message.

Step 306, the security middleware receives the key response message.

The security middleware decrypts the encrypted application key corresponding to the specified application, obtains the application key corresponding to the specified application, and stores it locally.

The download and installation of security middleware does not require new development requirements for developers. Users can obtain and install security middleware installation files through client integration, website download, etc. After the security middleware is installed, the initialization process is automatically initiated. .

It can be seen that by using the method provided by the embodiment of the present invention, it is not necessary to download and install security components in each application in the terminal, but only download and install a security middleware in the terminal, thereby reducing the load on network resources when downloading applications. Overhead, reducing the resources occupied by the application installed in the terminal.

Moreover, the security middleware can automatically update the version. The security middleware regularly communicates with the capability exposure platform to obtain the version information of the security middleware, automatically downloads when a new version is found, and completes background replacement and update. Therefore, the problem existing in the prior art that the security components deployed in each application are difficult to update can be solved.

Based on the same inventive concept, according to the capability invocation method provided by the above-mentioned embodiments of the present invention, correspondingly, the embodiment of the present invention also provides a capability invocation device, which is equivalent to the security middleware in the above method, and its structural diagram is as follows As shown in Figure 4, it specifically includes:

The receiving unit 401 is configured to receive a first capability invocation request message sent by a specified application in the terminal, where the specified application is one of the applications with capability invocation authority in the terminal; and receive the corresponding capability invocation returned by the capability opening platform A response message, and send the capability call response message to the specified application;

Adding unit 402, configured to add verification information corresponding to the specified application to the first capability invocation request message, and generate a second capability invocation request message;

The sending unit 403 is configured to send the second capability invocation request message to the capability opening platform.

Further, the receiving unit 401 is specifically configured to receive a first capability invocation request message carrying a specified application identifier AppID sent by a specified application in the terminal;

The adding unit 402 is specifically configured to add a pseudocode PID generated based on the mobile subscriber international number MSISDN and AppID corresponding to the terminal to the first capability call request message. The receiving unit 401 receives the first capability call sent by the specified application. The counter of the number of request messages, the terminal token TerToken generated based on the authentication factor Seed and Counter.

Further, the capability calling device also includes:

The verification unit 404 is configured to pass the verification of the designated application before adding the verification information corresponding to the designated application in the first capability invocation request message.

Further, the verification unit 404 is specifically configured to return a verification instruction message carrying a random number Random to the designated application; receive a verification request message sent by the designated application and carry the first message digest H1 generated based on the designated application key AppKey and Random ; Obtain an application key corresponding to the specified application, generate a second message digest H2 based on the application key corresponding to the specified application and Random, and determine that H1 and H2 are the same.

Further, the verification unit 404 is specifically configured to call the application key corresponding to the specified application when there is an application key corresponding to the specified application in the locally stored application key; When there is no application key corresponding to the specified application, send a specified application key acquisition request message to the capability openness platform; receive a key response message carrying the application key corresponding to the specified application returned by the capability openness platform.

The capability invocation device also has the functions of application integrity detection, sensitive information security protection, security reinforcement, support for local simulation test and remote invocation test, and the like.

Application integrity detection: The capability invocation device calculates the MAC fingerprint of the media access control and matches it with the securely stored MAC fingerprint to prevent the online terminal capability invocation device from being tampered with during download and operation.

Sensitive information security protection: Capability calling devices provide sensitive information security protection mechanisms (such as encrypted storage, discrete storage, code obfuscation, security algorithm conversion, Mechanisms such as clearing the memory in time) ensure that the AppKey preset in the capability calling device will not be cracked statically (such as static anti-reverse engineering analysis) or dynamically cracked (such as memory space sniffing, dynamic code tracking, etc.).

Security hardening: use software engineering methods (such as code obfuscation, etc.) to ensure that the application programming interface API provided by the capability call device will not be illegally tampered with under any circumstances (including static anti-reverse engineering analysis, dynamic code tracking), and through software engineering methods To prevent the capability calling device from being tampered with statically or dynamically, that is, after the capability calling device is illegally tampered with, it needs to refuse execution and prompt an abnormal error.

Support local simulation test: the capability invocation device can identify the user environment, and if it is a test environment, the initialization process will be closed, thereby supporting local simulation testing of terminal applications.

Support remote invocation test: In order to meet the needs of online testing by developers using the emulator, the ability invocation device can realize the support of the emulator test function.

Based on the same inventive concept, according to the capability invocation method provided in the foregoing embodiments of the present invention, correspondingly, the embodiment of the present invention further provides a terminal, including the capability invocation apparatus shown in FIG. 4 above.

To sum up, the solution provided by the embodiment of the present invention includes: receiving a first capability invocation request message sent by a specified application in the terminal, wherein the specified application is one of the applications with capability invocation authority in the terminal; Add verification information corresponding to the specified application to the first capability call request message, generate a second capability call request message; send the second capability call request message to the capability open platform; receive the corresponding capability call response returned by the capability open platform message, and send the capability call response message to the specified application. By adopting the solutions provided by the embodiments of the present invention, network resources and terminal resources can be saved on the premise of ensuring the security of capability opening.

Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalent technologies, the present invention also intends to include these modifications and variations.

Claims (11)

1. a capacity calling method, is characterized in that, comprising:

The first ability call request message that appointment application in receiving terminal sends, wherein, described appointment is applied as described terminal and has respectively one of application that ability is called authority;

In described the first ability call request message, add and apply corresponding authorization information with described appointment, generate the second ability call request message;

To ability open platform, send described the second ability call request message;

Receive the corresponding ability that described ability open platform returns and call response message, and to described appointment application, send described ability and call response message.

2. the method for claim 1, is characterized in that, the first ability call request message that the appointment application in receiving terminal sends, is specially:

The first ability call request message of carrying appointment application identities AppID that appointment application in receiving terminal sends;

In described the first ability call request message, add and apply corresponding authorization information with described appointment, be specially:

In described the first ability call request message, add pseudo-code PID, the number of times Counter that receives the described the first ability call request message of described appointment application transmission, the terminal token TerToken based on authentication factor S eed and Counter generation based on mobile subscriber's international number MSISDN corresponding to described terminal and AppID generation.

3. method as claimed in claim 1 or 2, is characterized in that, before in described the first ability call request message, interpolation is applied corresponding authorization information with described appointment, also comprises:

Described appointment application verification is passed through.

4. method as claimed in claim 3, is characterized in that, described appointment application verification is passed through, and is specially:

To described appointment application, return to the checking Indication message that carries random number R andom;

Receive the checking request message that carries the first eap-message digest H1 based on specifying application key A ppKey and Random to generate that described appointment application sends;

Obtain with described appointment and apply corresponding application key, based on applying corresponding application key with described appointment and Random generates the second eap-message digest H2, determine that H1 is identical with H2.

5. method as claimed in claim 4, is characterized in that, obtains with described appointment and applies corresponding application key, is specially:

In the application key of this locality storage, exist while applying corresponding application key with described appointment, transfer with described appointment and apply corresponding application key;

In the application key of this locality storage, do not exist while applying corresponding application key with described appointment, to described ability open platform, send and specify application cipher key acquisition request message; Receive the key response message of applying corresponding application key with described appointment of carrying that described ability open platform returns.

6. an ability calling device, is characterized in that, comprising:

Receiving element, applies for the appointment of receiving terminal the first ability call request message sending, and wherein, described appointment is applied as described terminal and has respectively one of application that ability is called authority; And the corresponding ability that receiving ability open platform returns calls response message, and to described appointment application, send described ability and call response message;

Adding device, for adding and apply corresponding authorization information with described appointment in described the first ability call request message, generates the second ability call request message;

Transmitting element, for sending described the second ability call request message to described ability open platform.

7. device as claimed in claim 6, is characterized in that, described receiving element, the first ability call request message of carrying appointment application identities AppID sending specifically for the appointment application receiving in described terminal;

Described adding device, the pseudo-code PID specifically for interpolation in described the first ability call request message based on mobile subscriber's international number MSISDN corresponding to described terminal and AppID generation, the number of times Counter that receives the described the first ability call request message of described appointment application transmission, the terminal token TerToken based on authentication factor S eed and Counter generation.

8. device as claimed in claim 6, is characterized in that, also comprises:

Authentication unit, before applying corresponding authorization information in described the first ability call request message interpolation with described appointment, passes through described appointment application verification.

9. device as claimed in claim 8, is characterized in that, described authentication unit, specifically for returning to described appointment application the checking Indication message that carries random number R andom; Receive the checking request message that carries the first eap-message digest H1 based on specifying application key A ppKey and Random to generate that described appointment application sends; Obtain with described appointment and apply corresponding application key, based on applying corresponding application key with described appointment and Random generates the second eap-message digest H2, determine that H1 is identical with H2.

10. device as claimed in claim 9, is characterized in that, described authentication unit, while applying corresponding application key specifically for existing in the application key when local storage with described appointment, is transferred with described appointment and applied corresponding application key; In the application key of this locality storage, do not exist while applying corresponding application key with described appointment, to described ability open platform, send and specify application cipher key acquisition request message; Receive the key response message of applying corresponding application key with described appointment of carrying that described ability open platform returns.

11. 1 kinds of terminals, is characterized in that, comprise the ability calling device described in claim 6-10 any one.

Images