WO2022062688A1 - 消息推送方法、电子设备及存储介质 - Google Patents
消息推送方法、电子设备及存储介质 Download PDFInfo
- Publication number
- WO2022062688A1 WO2022062688A1 PCT/CN2021/110461 CN2021110461W WO2022062688A1 WO 2022062688 A1 WO2022062688 A1 WO 2022062688A1 CN 2021110461 W CN2021110461 W CN 2021110461W WO 2022062688 A1 WO2022062688 A1 WO 2022062688A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- message
- application
- identity
- data source
- provider
- Prior art date
Links
- 238000000034 method Methods 0.000 title claims abstract description 60
- 238000013507 mapping Methods 0.000 claims abstract description 28
- 238000000605 extraction Methods 0.000 claims abstract description 16
- 238000012795 verification Methods 0.000 claims description 85
- 238000004590 computer program Methods 0.000 claims description 19
- 238000004891 communication Methods 0.000 abstract description 4
- 238000010586 diagram Methods 0.000 description 12
- 235000012054 meals Nutrition 0.000 description 10
- 238000012545 processing Methods 0.000 description 10
- 230000006870 function Effects 0.000 description 9
- 238000013475 authorization Methods 0.000 description 5
- 230000003993 interaction Effects 0.000 description 4
- 238000013461 design Methods 0.000 description 1
- 238000001514 detection method Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 238000009434 installation Methods 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
- 238000012546 transfer Methods 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/12—Applying verification of the received information
- H04L63/126—Applying verification of the received information the source of the received data
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/50—Network services
- H04L67/55—Push-based network services
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/10—Integrity
- H04W12/108—Source integrity
Definitions
- the embodiments of the present application relate to the field of communication technologies, and in particular, to a message pushing method, an electronic device, and a storage medium.
- the Open Authorization (OAUTH) protocol provides a secure, open and simple standard for the authorization of user resources.
- the difference from the previous authorization method is that the authorization of the OAUTH protocol will not allow the third party to access the user's account information (such as user name and password), that is, the third party can apply for the user resource without using the user's user name and password.
- authorization also provides an authentication method between the server and the server based on the network check code (Json Web Token, JWT) method.
- the message provider A can only send the message to the message receiver A. , but the message may be sent to either the message recipient B or the message recipient C, which will cause message stringing.
- the embodiments of the present application provide a message push method, an electronic device and a storage medium. By verifying the message push request of the message provider at the message pusher, and pushing the to-be-pushed message after the verification is passed, the message can be avoided. Connecting to the network can improve the security of message push by the message provider.
- an embodiment of the present application provides a message push method, including:
- the application identifier is used to identify the application; the preset key can be a symmetric or asymmetric key commonly used in the art.
- the message push request includes first information and a first digest used for verification, and the first digest is performed by the message provider using a preset key for the first information.
- the first information includes at least an application identifier; specifically, the message provider may be an object that provides a message to be pushed to the message receiver, wherein the message to be pushed may include an announcement message related to an application , notification messages, and other types of messages to be pushed.
- the first information includes at least an application identification identifier.
- the first information may also include declaration information such as JWT issuer, issue time, and issue validity time, which is not particularly limited in this embodiment of the present application.
- the second digest is compared with the first digest, and if the comparison is consistent, the to-be-pushed message is pushed to the message recipient corresponding to the application identifier.
- the message pusher may push the to-be-pushed message, where the push target object may be the message recipient corresponding to the application ID in the message push request, for example , the message recipient may include a mobile terminal that has installed an application program corresponding to the above-mentioned application program identifier; if the second digest is inconsistent with the first digest, a failure message may be returned to the message provider, and this message push may be ended. Task.
- the message pusher By carrying the summary information and receiver information in the message push request, the message pusher performs comparison based on the summary information to complete the verification of this message push request, and after the verification is passed, the message to be pushed is sent to and received by The receiver corresponding to the party information can avoid the message string network, thereby improving the security of the message push.
- the message push request further includes the signature of the message provider, and before comparing the second digest with the first digest, the message further includes:
- the message push request is authenticated according to the signature to determine whether the identity of the message provider is legitimate.
- the above method further includes:
- the push of the message to be pushed this time is terminated. Specifically, if it is determined that the preset key cannot be found, it can be considered that the message pusher this time is an illegal user, that is, the message pusher has no right to push the message. Therefore, the push of the message to be pushed this time can be terminated. , thereby improving the efficiency of the system and improving the security of message push.
- the first information includes multiple application identifiers
- the message push request includes multiple first digests corresponding to the application identifiers
- a preset key is used to pair the first digest in the message push request.
- the information is abstracted and the second abstract obtained includes:
- the first information in the message push request is digested by using the preset keys corresponding to the application IDs, respectively, to obtain a plurality of second digests corresponding to the application IDs.
- the first information may include multiple application program identities, that is, the message to be pushed may be pushed to multiple recipients. Therefore, the message pusher can use each preset key corresponding to the application identifier to perform digest extraction on the first information to obtain multiple second digests.
- the second abstract is compared with the first abstract, and if the comparison is consistent, the message to be pushed is pushed to the message recipient corresponding to the application ID, including:
- each first abstract is compared with the corresponding second abstract, and if all the first abstracts are consistent with the corresponding second abstracts, the to-be-pushed message can be pushed to the corresponding application ID.
- the message receiver can thus realize the push of multiple messages to be pushed on the basis of ensuring the security of message push.
- the embodiment of the present application also provides a message push method, including:
- the message push request includes the application ID and the message provider ID; specifically, the application ID is used to identify the application; the message provider ID is used for to identify the message provider.
- the message pusher can pre-store the application The mapping relationship between the identity identifier and the first data source, and the mapping relationship between the identity identifier of the message provider and the second data source. Based on the application identifier and the message provider identifier, it can be queried whether there is a corresponding first data source and a second data source.
- the first data source and the second data source exist, the first data source and the second data source are compared, and if the comparison is consistent, the to-be-pushed message is pushed to the message receiver corresponding to the application ID.
- the corresponding first data source and the second data source are obtained by querying based on the application ID and the message provider ID.
- the comparison of data sources is used to complete the verification of the message push request, which can avoid message string network and improve the security of message push.
- the method before receiving the message to be pushed and the message push request sent by the message provider, the method further includes:
- the identity registration request includes a data source and an identity registration type
- the identity registration type includes the first type and the second type
- the data source can be used to identify the message provider to store data source address
- the identity registration type can be used to identify the identity of which object the message provider requests this time.
- the first type can correspond to the identity of the message provider
- the second type can correspond to the identity of the application. Identity.
- the data source includes the first data source
- the message provider identity is allocated, the message provider identity is associated with the first data source and stored, and the message provider identity is stored.
- Send it to the message provider if it is determined that the identity registration type is the second type, the above-mentioned data source includes the second data source, assign the application program identity identifier, associate the application program identifier with the second data source and store it, and apply the application identifier to the second data source.
- the program identity is sent to the message provider; specifically, the message provider identity or application program identity can be allocated by the message pusher based on the identity registration type, and the message provider identity and the first data can be assigned by the message pusher respectively.
- the source is associated or the application identity is associated with the second data source and stored locally.
- the identity registration request further includes the identity of the message provider, and the above method further includes:
- Query based on the identity of the message provider to obtain the corresponding first data source compare the first data source obtained by the query with the second data source in the identity registration request, and determine whether to assign the application identity based on the comparison result .
- the second data source carried in the identity registration request should be consistent with the first data source. Therefore, whether to assign the application identity is determined by judging whether the first data source and the second data source are consistent. Identity, which can improve the security of application registration.
- the message push request includes multiple application identities
- the first data source is compared with the second data source, and if the comparison is consistent, the message to be pushed is pushed to the application identities
- the message recipients corresponding to the identifiers include:
- each first data source corresponding to the application ID Compares each first data source corresponding to the application ID with the second data source; if all the first data sources are consistent with the second data source, push the to-be-pushed message to the application ID Identifies the corresponding message recipient.
- each first data source can be compared with the second data source, and if each first data source is consistent with the second data source, the to-be-pushed message can be pushed to the corresponding application ID Therefore, on the basis of ensuring the security of message push, the push of multiple messages to be pushed can be realized.
- an embodiment of the present application provides a message push device, including:
- the sending module is used to send the mapping relationship to the message provider
- a receiving module configured to receive a message to be pushed and a message push request sent by the message provider, wherein the message push request includes first information and a first digest used for verification, and the first digest is used by the message provider using a preset key
- the first information is obtained after digest extraction, and the first information at least includes the application program identifier.
- the verification module is used to query whether there is a preset key corresponding to the application ID in the message push request; if there is a preset key corresponding to the application ID, use the preset key to verify the information in the message push request.
- the first information is abstracted to obtain the second abstract;
- the push module is configured to compare the second abstract with the first abstract, and if the comparison is consistent, push the to-be-pushed message to the message receiver corresponding to the application ID.
- the message push request further includes the signature of the message provider, and the above device further includes:
- the signature verification module is used to authenticate the message push request according to the signature to determine whether the identity of the message provider is legal.
- the above verification module is further configured to terminate the push of the message to be pushed this time if there is no preset key corresponding to the application identification.
- the first information includes multiple application identifiers
- the message push request includes multiple first digests corresponding to the application identifiers
- the verification module is further configured to use the corresponding application identifiers respectively.
- the corresponding preset key is used to digest the first information in the message push request to obtain a plurality of second digests corresponding to the application program identifiers.
- the above push module is further configured to compare the first digest and the second digest corresponding to the same application ID respectively; if the first digest and the second digest of all the application IDs If the comparison is consistent, the to-be-pushed message is pushed to the message receiver corresponding to the application ID.
- the embodiment of the present application also provides a message pushing device, including:
- a receiving module configured to receive a message to be pushed and a message push request sent by a message provider, wherein the message push request includes an application program identity and a message provider identity;
- a verification module configured to query whether there is a first data source corresponding to the application program identity in the message push request and a second data source corresponding to the message provider identity in the message push request;
- the push module is configured to compare the first data source with the second data source if the first data source and the second data source exist, and if the comparison is consistent, push the to-be-pushed message to the corresponding application ID recipient of the message.
- the above-mentioned device further includes:
- the registration module is used to receive the identity registration request sent by the message provider, wherein the identity registration request includes the data source and the identity registration type, and the identity registration type includes the first type and the second type; if it is judged that the identity registration type is the first type, Then the data source includes a first data source, assigns a message provider identity, associates the message provider identity with the first data source and stores it, and sends the message provider identity to the message provider; if the identity registration type is determined For the second type, the data source includes a second data source, assigns an application identifier, associates the application identifier with the second data source and stores it, and sends the application identifier to the message provider.
- the identity registration request further includes the identity of the message provider, and the above device further includes:
- the verification module is configured to perform a query based on the identity of the message provider to obtain the corresponding first data source; compare the first data source obtained by the query with the second data source in the identity registration request, and determine whether or not based on the comparison result Assign an application identity.
- the message push request includes multiple application identifiers
- the above-mentioned push module is further configured to compare each first data source corresponding to the application identifier with the second data source respectively; If all the first data sources are consistent with the second data sources, the to-be-pushed message is pushed to the message receiver corresponding to the application identifier.
- an electronic device including:
- a processor and a memory for storing computer program code, the computer program code including instructions, when the processor reads the instructions from the memory, to cause the electronic device to perform the following steps: create an application identifier and pre- Set the mapping relationship between keys;
- the message push request includes first information and a first digest used for verification, and the first digest is performed by the message provider using a preset key for the first information.
- the first information at least includes the application identification;
- the second digest is compared with the first digest, and if the comparison is consistent, the to-be-pushed message is pushed to the message recipient corresponding to the application identifier.
- the message push request further includes the signature of the message provider, and when the instruction is executed by the electronic device, the electronic device executes the comparison between the second digest and the first digest before executing the The following steps:
- the message provider is authenticated according to the signature to determine whether the identity of the message provider is legitimate.
- the above-mentioned electronic device when executed by the above-mentioned electronic device, the above-mentioned electronic device further executes the following steps:
- the first information includes multiple application identifiers
- the message push request includes multiple first digests corresponding to the application identifiers
- the above-mentioned instruction is executed by the above-mentioned electronic device
- the step of performing digest extraction on the first information in the message push request by using the preset key, and obtaining the second digest includes:
- the first information in the message push request is digested by using the preset keys corresponding to the application IDs, respectively, to obtain a plurality of second digests corresponding to the application IDs.
- the above-mentioned electronic device executes to compare the second abstract with the first abstract, and if the comparison is consistent, pushes the to-be-pushed message to the application program
- the steps of the message receiver corresponding to the identity identification include:
- the to-be-pushed message is pushed to the message recipient corresponding to the application identifier.
- the embodiment of the present application also provides an electronic device, including:
- the message push request includes the application ID and the message provider ID;
- the first data source and the second data source exist, the first data source and the second data source are compared, and if the comparison is consistent, the to-be-pushed message is pushed to the message receiver corresponding to the application ID.
- the identity registration request includes a data source and an identity registration type
- the identity registration type includes a first type and a second type
- the data source includes the first data source, the message provider identity is allocated, the message provider identity is associated with the first data source and stored, and the message provider identity is sent. to the message provider;
- the data source includes the second data source
- the application identification is allocated, the application identification is associated with the second data source and stored, and the application identification is sent to the message provider square.
- the identity registration request further includes the identity of the message provider, and when the above-mentioned instruction is executed by the above-mentioned electronic device, the above-mentioned electronic device further performs the following steps:
- the first data source obtained by the query is compared with the second data source in the identity registration request, and whether to assign the application identity identifier is determined based on the comparison result.
- the message push request includes multiple application identifiers, and when the above instruction is executed by the electronic device, the electronic device executes the comparison between the first data source and the second data source. If yes, the steps of pushing the to-be-pushed message to the message recipient corresponding to the application ID include:
- the to-be-pushed message is pushed to the message receiver corresponding to the application identifier.
- an embodiment of the present application provides a computer-readable storage medium, where a computer program is stored in the computer-readable storage medium, and when it runs on a computer, causes the computer to execute the method described in the first aspect.
- an embodiment of the present application provides a computer program, which is used to execute the method described in the first aspect when the computer program is executed by a computer.
- the program in the fifth aspect may be stored in whole or in part on a storage medium packaged with the processor, and may also be stored in part or in part in a memory not packaged with the processor.
- FIG. 1 is a schematic diagram of an application scenario of a message push method provided by an embodiment of the present application
- FIG. 2 is a schematic diagram of an interaction flow of an embodiment of a message push method provided by the present application
- 3A is a schematic structural diagram of an embodiment of a message push request in JWT format provided by this application;
- 3B is a schematic structural diagram of another embodiment of a message push request in JWT format provided by the present application.
- FIG. 4 is a schematic diagram of an interaction flow of another embodiment of a message push request method provided by the present application.
- FIG. 5 is a schematic structural diagram of another embodiment of a message push request in JWT format provided by the present application.
- FIG. 6 is a schematic structural diagram of an embodiment of a message pushing device provided by the present application.
- FIG. 7 is a schematic structural diagram of another embodiment of a message pushing device provided by the present application.
- FIG. 8 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.
- first and second are only used for descriptive purposes, and should not be construed as indicating or implying relative importance or implicitly indicating the number of indicated technical features.
- a feature defined as “first” or “second” may expressly or implicitly include one or more of that feature.
- plural means two or more.
- JWT is a Json-based open standard for transferring claims between network application environments.
- the JWT is designed to be compact and secure, especially suitable for single sign-on of distributed sites, and the JWT claims are generally used To transfer the authenticated user identity information between the identity provider and the service provider, in order to obtain resources from the resource server, it can also add some additional declaration information necessary for other business logic.
- the JWT can also be used directly for authentication, and can also be encrypted.
- the JWT can be composed of three parts, the first part is the header, the second part is the payload, and the third part is the signature.
- the JWT can be used for signature authentication, for example, the message provider can send the message push request to the message pusher by means of JWT.
- the message pusher After the message pusher performs signature authentication on the message push request, it determines whether the identity of the message provider is legal, that is, determines whether the message provider can push the message to be pushed to the message receiver.
- the current signature authentication method cannot determine to which message recipients the message to be pushed is pushed, and it may happen that the message to be pushed sent to message recipient A is sent to message recipient B. Therefore, the above-mentioned signature authentication method cannot solve the problem of message chaining, thereby bringing security risks to the data push of the message provider.
- an embodiment of the present application provides a message push method.
- the message pushing method provided by the embodiment of the present application can be applied to a data processing device, and the data processing device can be a server, and the present application does not specifically limit the specific form of the data processing device that executes the technical solution.
- the application scenario of the embodiment of the present application is shown in FIG. 1 .
- the application scenario includes a message provider 110 , a message pusher 120 and a message receiver 130 , where the message provider 110 is used to send the message to be pushed to the message pusher 120 and the message push request, so that the message pusher 120 pushes the to-be-pushed message after verifying the message push request.
- the message to be pushed may include announcement messages, notification messages, and other types of messages related to the application.
- the message to be pushed may be "announcement information of service upgrade at 1:00 am".
- the to-be-pushed message may also be other types of messages, which are not particularly limited in this embodiment of the present application.
- the message pusher 120 is configured to receive the message to be pushed and the message push request sent by the message provider 110 , verify the message push request, and push the to-be-pushed message to the correct message receiver 130 .
- the message pusher 120 includes a push system 121 and a verification system 122.
- the verification system 122 is used to verify the message push request, and the push system 121 is used to push the to-be-pushed message to the message receiver 130 after the message push request is verified. .
- the message to be pushed sent by the message provider 110 is based on an application, therefore, the message pusher 120 can push the message to be pushed to the corresponding application installed on the message receiver 130 (for example, a mobile terminal). program.
- the message pusher 120 pushes an announcement message corresponding to the music application 131, if the music application 131 is installed on the message receiver 130, the announcement message can be received.
- the message receiver 130 is configured to receive the message pushed by the message pusher 120 .
- the message recipient 130 may be a mobile terminal installed with an application program (for example, a music application 131, a map application 132, etc.), or may be other types of terminals installed with the above-mentioned application programs, which are not specially limited in this application. .
- Step 201 the message pusher 120 creates an application key corresponding to the application.
- the message pusher 120 may preset identities of multiple applications (eg, music applications, map applications, ordering applications, etc.) Set the map application ID. It is understood that the identity of the application is used to identify the application. Optionally, the identity of the application program may also be sent by the message provider 110 to the message pusher 120 in advance, which is not specifically limited in this application.
- applications eg, music applications, map applications, ordering applications, etc.
- the identity of the application program may also be sent by the message provider 110 to the message pusher 120 in advance, which is not specifically limited in this application.
- the message pusher 120 After the message pusher 120 obtains the identity of the application, it can create a corresponding application key for each application, for example, can create a corresponding application key for the music application 131 (hereinafter referred to as the music application key), A corresponding application key (hereinafter referred to as a map application key) may be created for the map application 132 .
- the application key may use a symmetric or asymmetric key commonly used in the art, which is not particularly limited in this embodiment of the present application.
- Step 202 the message pusher 120 sends the mapping relationship between the application program and the application key to the message provider 110 .
- a one-to-one mapping relationship between applications and application keys may be established in the message pusher 120, and the mapping relationship may be stored in a local database.
- the message pusher 120 may send the mapping relationship to the message provider 110 .
- the local database may be set in the verification system 122 in the message pusher 120 .
- the message provider 110 obtains the statement information, the music application 131 identity and the map application 132 identity, and uses the music application key to extract a summary of the statement information, the music application 131 identity and the map application 132 identity, and generates a For the corresponding abstract (hereinafter referred to as the music application abstract), extract the declaration information, the music application 131 ID and the map application 132 ID by using the map application key to generate the corresponding abstract (hereinafter referred to as the map application abstract).
- the declaration information may include information related to this message push request, where the message push request is used by the message provider 100 to request the message pusher 200 to push the message to be pushed.
- the message push request may be sent by way of JWT, therefore, the claim information may include the claim information registered by the JWT in the standard protocol.
- related information such as the time (for example, the time when the JWT is issued) and the validity period of the issuance (for example, the valid time period of the JWT), please refer to the protocol RFC7523 for details, which will not be repeated here.
- the statement information may also include other related information, and the specific content and form of the statement information are not particularly limited in this embodiment of the present application.
- mapping relationship between the application program and the application key is stored in the local database of the message provider 110
- the message provider 110 obtains the above-mentioned declaration information, the music application 131 identity and the map application 132 identity
- it can Using the mapping relationship, the corresponding music application key is obtained by querying the identity of the music application 131
- the corresponding map application key is obtained by querying the identity of the map application 132 .
- use the music application key to extract a summary of the declaration information, the music application 131 identity and the map application 132 identity, so that the music application summary corresponding to the music application 131 identity can be obtained.
- the message provider 110 can also use the map application key to extract a summary of the declaration information, the music application 131 identity and the map application 132 identity, thereby obtaining a map application summary corresponding to the map application 132 identity.
- the abstract extraction method may be a HASHMAC512 method, or other abstract extraction methods, which are not particularly limited in this embodiment of the present application.
- the message provider 110 when the message provider 110 performs digest extraction, it may not perform digest extraction on the declaration information.
- the message provider 110 can perform abstract extraction on the music application 131 identity and the map application 132 identity, so as to obtain the music application summary corresponding to the music application 131 identity and the music application 131 identity and the map.
- the application 132 identity identifier is used for abstract extraction, thereby obtaining a map application abstract corresponding to the map application 132 identifier. That is, the declaration information is optional information when the message provider 110 performs digest extraction.
- Step 204 the message provider 110 sends the message to be pushed and a message push request to the message pusher 120, wherein the message push request includes the declaration information, the music application 131 identity, the map application 132 identity, the music application abstract and the map application abstract.
- the message provider 110 can generate a message push request according to the declaration information, the music application 131 identity, the map application 132 identity, the music application summary and the map application summary; wherein , the message push request may be used by the message provider 100 to request the message pusher 120 to push the message to be pushed sent by the push provider 110 , and the message push request may be in the form of JWT.
- FIG. 3A shows an existing message push request data packet 300 in JWT format, and the data packet 300 includes a header, a payload and a signature.
- the header of the data packet 300 includes an application identification field (sub) and a first field (aa), the sub field is used to indicate the location of the application identification in the payload, and the aa field is used to identify the declaration information in the payload.
- the payload of the data packet 300 may contain declaration information and information corresponding to the sub field (for example, the identity of the application); the signature of the data packet 300 is used for the validity of the identity of the message provider, for example, message push
- the party 120 can verify the identity of the message provider 110 to determine the validity of the identity of the message provider 110 ; wherein the signature can be used to identify the identity of the message provider 110 . That is, by verifying the signature, the message push request of the message provider 110 this time can be verified to determine whether the message push request is legal. It can be seen from the above data packet 300 that the data packet 300 only contains the application identification field. After the message pusher 200 receives the data packet 300, it cannot verify the correspondence between the message provider 110 and the message receiver 130. Therefore, the message The pusher 200 directly pushes the to-be-pushed message to the message receiver 130 corresponding to the application identifier in the payload information, which may cause messages to be networked and bring about data security problems.
- a message push request data packet 310 in the JWT format of the present application is shown.
- the data packet 310 may include a header, a payload and a signature;
- aa a summary field
- vfs a summary field
- other fields may also be included, which is not limited in this embodiment of the present application.
- the vfs field is used to identify the location of the summary information in the payload;
- the payload of the data packet 310 may include declaration information, application identification information and summary information.
- the application identification information corresponds to the sub field
- the summary information corresponds to the vfs field
- the declaration information corresponds to the aa field.
- the application identification information includes the music application 131 identification and the map application 132 identification.
- the summary information includes a music application summary and a map application summary.
- the signature of the data packet 310 has the same function as the signature of the data packet 300, and details are not described herein again.
- the data package 310 carries summary information (for example, a music application summary and a map application summary), so the message pusher 200 can verify according to the summary information to determine whether the message to be pushed this time can be sent to the installed music application And the mobile terminal of the map application, which can avoid message string network and ensure data security.
- the message provider 110 After the message provider 110 generates the above message push request, it can be sent to the message pusher 120 together with the message to be pushed to be pushed this time, so that the message pusher 120 can push the to-be-pushed message to the message pusher 120.
- the message recipient 130 corresponding to the above-mentioned music application 131 identity and/or map application 132 identity (eg, a mobile terminal that has installed the music application 131 and/or the map application 132 ).
- Step 205 the message pusher 120 reads the message push request.
- the message pusher 120 can read the message push request to obtain the statement information, the music application 131 identity, and the map application 132 identity in the message push request. logo, music application summary, and map application summary.
- the above message push request can be read through the push system 121 in the message pusher 120, thereby obtaining the statement information, the music application 131 identity, the map application 132 identity, the music application abstract and the map application Abstract, and can send the above statement information, music application 131 identity, map application 132 identity, music application summary and map application summary to the verification system 122 in the message pusher 120, so that the verification system 122 can according to the above statement information , music application 131 identity, map application 132 identity, music application abstract and map application abstract for verification.
- identity verification can also be performed according to the signature information in the message push request, wherein the signature information can be used to verify the identity of the message provider 110.
- Legality if the signature verification is passed, it means that the identity of the message provider 110 is legal, and further verification can be performed to determine which message receivers 130 the message provider 110 can push the to-be-pushed message to. If the signature verification fails, the message is pushed The party 120 can directly end the current verification, and can return a failure message to the message provider 110 for informing the message provider 110 that this message push task failed.
- a verification interface corresponding to the JWT can be added between the message provider 110 and the message pusher 120.
- the first An interface the first interface can be used to transmit the JWT
- the code example is as follows:
- grant_type urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer-with-vfs
- Step 206 the message pusher 120 inquires according to the music application 131 identity and the map application 132 identity, and obtains the music application key corresponding to the music application 131 identity and the map application key corresponding to the map application 132 identity.
- mapping relationship between the application program and the application key is stored in the local database of the message pusher 120, after the message pusher 120 obtains the above-mentioned music application 131 identity and map application 132 identity through reading, it can The mapping relationship is queried in the local database of the message pusher 120 according to the music application 131 identity and the map application 132 identity, so that the music application key corresponding to the music application 131 identity and the map application 132 identity can be obtained. Identifies the corresponding map application key.
- the local database can be set in the verification system 122 of the message pusher 120. Therefore, when the verification system 122 receives the music application 131 identity and the map application 132 identity sent by the push system 121, it can The local database of the verification system 122 is queried according to the music application 131 identity and the map application 132 identity, so that the music application key corresponding to the music application 131 identity and the map corresponding to the map application 132 identity can be obtained. Application key.
- the verification system 122 can send a verification failure message to the push system 121. After receiving the above verification failure message, the push system 121 can end this verification and report the failure to the message provider 110. The message is used to notify the message provider 110 that this message push task fails.
- Step 207 the message pusher 120 uses the music application key to extract the declaration information, the music application 131 identity and the map application 132 identity, and generates a music application abstract, and uses the map key to extract the declaration information, the music application 131 identity And map application 132 identity identification to extract abstract, generate map application abstract.
- the message pusher 120 can use the music application key to extract the above statement information, the music application 131 identity and the map application 132 identity.
- the corresponding music application abstract is generated, and the above statement information, the music application 131 identity identifier and the map application 132 identity identifier are extracted using the map application key to generate the corresponding map application abstract.
- the method of extracting the abstract may be the same as the method in step 203, for example, the HASHMAC512 method, which will not be repeated here.
- Step 208 the message pusher 120 compares the music application summary generated at the message pusher 120 with the music application summary in the message push request, and compares the map application summary generated at the message pusher 120 with the message push request. map application summary for comparison.
- the message pusher 120 can compare the generated music application summary with the music application summary in the message push request, and compare the generated map application summary with the music application summary in the message push request.
- the map application summary is compared to complete the verification of the message push request.
- Step 209 if both the music application summary comparison and the map application summary comparison pass, the message pusher 120 pushes the to-be-pushed message to the message receiver 130 that has installed the music application 131 and/or the map application 132 .
- the music application summary generated by the message pusher 120 is consistent with the music application summary in the message push request, and the map application summary generated by the message pusher 120 is consistent. If it is consistent with the map application summary in the message push request, it can be considered that the verification of the message push request is passed, and the message pusher 120 can push the to-be-pushed message to the message receiver 130 having installed the music application 131 and/or the map application 132 .
- Step 210 if any one of the comparison of the music application digest and the map application digest fails, the message pusher 120 returns a verification failure message to the message provider 110 .
- the message pusher 120 may send a verification failure message to the message provider 110 for notifying the message provider 110 that the current message push task fails, and ends the current message push.
- the digest information in the message push request is consistent with the digest information generated by the message pusher 120, and further, it is possible to determine whether the digest information to be pushed is to be pushed. Whether the message can be sent to the application corresponding to the application ID in the message push request, thereby avoiding message stringing and improving the security of message push.
- Another message pushing method is described below by taking the message provider 110 respectively sending two messages to be pushed corresponding to the music application 131 and the map application 132, and comparing the data sources as an example.
- FIG. 4 shows an interaction flow chart of another embodiment of the message pushing method of the present application, including:
- Step 401 the message provider 110 sends an identity registration request to the message pusher 120 to obtain the identity of the message provider 110 .
- the identity registration request may be used by the message provider 110 to request the message pusher 120 to obtain the identity of the message provider 110 .
- the message provider 110 itself has an identity, which is used to identify the message provider 110 in the network, but is different from the identity of the message provider, the identity obtained by the request is Subsequently, the message push request is verified at the message pusher 120, wherein the identity identifier obtained by the request can be represented by a number.
- the identity identifier of the message provider 110 mentioned below refers to the identity identifier requested by the message provider 110 or assigned to the message provider 110 by the message pusher 120 .
- the identity registration request may include an identity registration type, and the identity registration type is used by the message pusher 120 to identify the target object registered by the message provider 110 this time. Through the identity registration type, it can be identified that the identity is registered for the application program this time. The identity is also registered with the message provider 110 .
- the identity registration type may include an application type and a service party type. If the message pusher 120 identifies that it is an application type, an identity can be registered for the application to complete the identity registration of the application on the message pusher 120; If the message pusher 120 recognizes that it is a service party, an identity identifier may be registered for the message provider 110 to complete the identity registration of the message provider 110 on the message pusher 120 .
- the identity registration request may also include a data source, and the data source may be used to represent the source address of the data of each service provided by the message provider 110, and the data source may correspond to the message provider 110.
- the data source may be the address of the target server where the message provider 110 stores business data. For example, if the message provider 110 can provide meal ordering service, music service and map service, the server address of the above-mentioned meal ordering service, music service and map service will be provided.
- the data source corresponding to the message provider 110 should be the same as the data source of all applications (eg, ordering application, music application, map application, etc.) belonging to the same message provider 110, That is, the data source is the same, and the user can receive meal ordering service through the meal ordering application on the mobile terminal, music service through the music application 131 on the mobile terminal, and map service through the map application 132 on the mobile terminal.
- the data source may be characterized by a unique IP address, or may be characterized by a unique ID number, which is not limited in this embodiment of the present application.
- two fields may be carried in the identity registration request, for example, a data source (source) field and a type (evidence) field, wherein the source field may be used to identify the data source corresponding to the message provider 110 , the evidence field can be used to identify the identity registration type of this registration.
- the evidence field may include two numeric types, for example, a character type and a numeric type.
- the value of the evidence field is the character string NEW_APP, that is, the value type of the evidence field is a character type, so that the message pusher can determine that the identity registration type is the server type according to the identity registration request, That is to say, this time, the identity identifier is registered for the message provider 110,
- a registration interface can also be established between the message provider 110 and the message pusher 120, so that the message provider 110 can call the registration interface to transmit the identity registration request and complete the identity registration process.
- the code example is as follows:
- Step 402 the message pusher 120 reads the identity registration request, and obtains the identity registration type in the identity registration request.
- Step 403 judging that the current identity registration type is the service provider type, the message pusher 120 allocates the identity of the message provider 110, associates the identity of the message provider 110 with the data source in the identity registration request and stores it.
- the message pusher 120 reads the identity registration request to obtain the data source and the identity registration type in the identity registration request. If it is determined after reading that the identity registration type is the server type, an identity identifier can be assigned to the message provider 110, and the identity identifier of the message provider 110 can be associated with the data source in the identity registration request and stored, and then The identity of the message provider 110 may be sent to the message provider 110 .
- the data source stored in association with the identity of the message provider 110 may be regarded as a service-side data source.
- the identity registration request of the message provider 110 can be directly sent to the verification system 122 of the message pusher 120.
- the verification system 122 can first read the evidence field in the identity registration request, If the value of the evidence field is a string, exemplarily, it can be NEW_APP, then it can be considered that the identity of the message provider 110 is allocated this time, and the verification system 122 can allocate an identity, and the allocated identity is used as the message.
- the identity identifier used by the provider 110 for subsequent verification, where the identity identifier of the message provider 110 may be a number.
- the verification system 122 can then associate the identity of the message provider 110 with the source field information in the identity registration request and store it in the local database in the verification system 122, and can return the identity of the message provider 110 to the The message provider 110, whereby the message provider 110 completes the task of registering the identity of the message provider 110 on the message pusher 120.
- the verification system 122 parses the evidence field information, it can further read the source field information, and can query whether there is a data source corresponding to the source field information in the local database of the verification system 122, if there is a data source corresponding to the source field information.
- the data source corresponding to the source field information it can be considered that the data source has been registered, that is, the registration request can be ended, and a failure message can be returned to the message provider 110 to notify the message provider that the registration failed this time. If there is no data source corresponding to the source field information, the identity of the message provider 110 may be assigned.
- Step 404 the message pusher 120 sends the assigned identity of the message provider 110 to the message provider 110 .
- Step 405 the message provider 110 sends an identity registration request to the message pusher 120 to obtain the identity of the application.
- the identity of the application is different from its own identity, and is an identity that is allocated by the request and subsequently used for verification of the message push request.
- the identifier of the application mentioned below refers to the identifier that the message provider 110 requests to obtain for the application or the message pusher 120 assigns to the application.
- the message provider 110 can also request the identity registration corresponding to the message provider 110.
- application registration identity exemplaryily, if the message provider 110 includes a meal ordering application, a music application, and a map application, the message provider 110 may register for the meal ordering application, the music application, and the map application to obtain the corresponding information about the meal ordering application, the music application, and the map application.
- Identity It should be noted that the message provider 110 can register an identity for an application through an identity registration request, and the message provider 110 can also register identities for multiple applications through an identity registration request. No special restrictions are made.
- the value of the evidence field can be set as the identity identifier of the message provider 110, that is, once the , the value type of the evidence field is the digital type represented by the identity identifier of the message provider 110, so that the message pusher 120 can determine that the current identity registration type is the application type according to the identity registration request, that is, it indicates that this time It is to register the identity for the corresponding application program in the message provider 110, and secondly, it can also indicate that the application program registered this time is associated with the message provider 110 corresponding to the value of the evidence field.
- the identity can be registered with the music application 131 to which the message provider AA belongs, or the identity can be registered with the map application 132 to which the message provider AA belongs, or the message Other applications (meal ordering applications) to which the provider AA belongs to register the identities.
- Step 406 the message pusher 120 reads the identity registration request, and obtains the identity registration type in the identity registration request.
- Step 407 judging that the current identity registration type is the application type, the message pusher 120 assigns the identity of the application, associates the identity of the application with the data source and stores it.
- the message pusher 120 determines that the identity registration type is the application type by reading the identity registration request, it can assign the identity of the application, and can combine the identity of the application with the data in the identity registration request
- the source is associated and stored, and the identity of the application can then be sent to the message provider 110 .
- the data source stored in association with the application program can be considered as the application data source, for example, the data source stored in association with the music application can be considered as the music application data source, and the data source stored in association with the map application can be considered as the map application data source , the data source stored in association with the meal ordering application can be considered as the meal ordering application data source, etc.
- the identity registration request of the message provider 110 can be directly sent to the verification system 122 of the message pusher 120.
- the verification system 122 can first read the evidence field in the identity registration request, If the value of the evidence field is a number, it can be considered that this time is the identity of the assigned application.
- the value of the evidence field can be the identity of the message provider 110. First, it can be determined that the identity is assigned to the application, and secondly, it can be known that the registered application is the same as the one in the evidence field.
- the application program corresponding to the message provider 110 corresponding to the numerical value.
- a query can be performed in the local database in the verification system 122 to obtain the server data source corresponding to the identity of the message provider 110, and the query can be The obtained data source is compared with the data source corresponding to the source field information in the identity registration request. If the server data source obtained by the query is inconsistent with the data source corresponding to the source field information in the identity registration request, the registration can be ended. request, and a failure message may be returned to the message provider 110 to notify the message provider that the registration failed this time.
- the identity of the application can be assigned, and the identity of the application corresponds to the source field information in the identity registration request.
- the data source is stored after being associated, and the identity of the application is sent to the message provider 110, whereby the message provider 110 completes the task of registering the identity of the application on the message pusher 120.
- Step 408 the message pusher 120 sends the assigned application identifier to the message provider 110 .
- Step 409 the message provider 110 sends the message push request and the message to be pushed to the message pusher 120 .
- the message provider 110 can send the message push request and the message to be pushed to the message pusher 120 .
- the message push request may include the identity of the message provider 110, the identity of the music application 131, and the identity of the map application 132, and the message push request may be in the form of JWT.
- the JWT may include a header, a payload and a signature.
- the JWT header may include multiple fields.
- the JWT header may include an application identification field (sub) and a message provider identification field (aud), where the sub field is used to identify the application identification Identifies the location in the payload, the aud field is used to identify the location of the message provider identity in the payload.
- the payload may include data information corresponding to the field information.
- the data information may include application identification information corresponding to the sub field (for example, the identification of the music application 131 and the identification of the map application 132) and the identification of the application corresponding to the sub field.
- the identity information of the message provider 110 corresponding to the aud field.
- Step 410 the message pusher 120 reads the message push request, and obtains the identity of the message provider 110 , the identity of the music application 131 and the identity of the map application 132 .
- the message pusher 120 can read the message push request, thereby obtaining the application identifiers (for example, the identifiers of the music application 131 and the map application 132) in the message push request. identity) and the identity of the message provider 110.
- the application identifiers for example, the identifiers of the music application 131 and the map application 132 in the message push request. identity
- the message provider 110 may send a message push request to the push system 121 of the message pusher 120. Therefore, a second interface may also be established between the message provider 110 and the push system 121 for transmitting the above message push request;
- the code example is as follows:
- grant_type urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer-with-source
- Step 411 the message pusher 120 inquires according to the identity of the music application 131, the identity of the map application 132 and the identity of the message provider 110, and obtains the music data source corresponding to the identity of the music application 131 and the map application.
- the map data source corresponding to the identity of the message provider 132 and the server data source corresponding to the identity of the message provider 110 are examples of the message pusher 120 .
- the message pusher 120 After the message pusher 120 obtains the identity of the message provider 110, the identity of the music application 131, and the identity of the map application 132 in the message push request, it can obtain the identity of the music application 131 and the identity of the above-mentioned music application 131 through a query.
- the application data source corresponding to the identity of the map application 132 eg, the music application data source corresponding to the identity of the music application 131 and the map application data source corresponding to the identity of the map application 132
- the server data source corresponding to the ID e.g, the music application data source corresponding to the identity of the music application 131 and the map application data source corresponding to the identity of the map application 132 .
- the push system 121 of the message pusher 120 obtains the identity of the music application 131, the identity of the map application 132, and the identity of the message provider 110 by reading, the identity of the music application 131, The identity of the map application 132 and the identity of the message provider 110 are sent to the verification system 122.
- the verification system 122 receives the identity of the music application 131, the identity of the map application 132 and the identity of the message provider 110, it can By querying the local database in the verification system 122, the music application data source, the map application data source and the map application data source corresponding to the identity of the music application 131, the identity of the map application 132 and the identity of the message provider 110 can be obtained respectively. Servant data source.
- the verification system 122 passes the query, if at least one data source does not exist in the music application data source, the map application data source and the server data source, it can be considered that the current music application 131 identity identifier, the map application 132's identity There is a counterfeiter in the identity identifier and the identity identifier of the message provider 110, so this verification can be ended, and a verification failure message can be returned to the push system 121.
- the push system 121 receives the above verification failure message, it can stop this message. The task is pushed, and a failure message can be returned to the message provider 110 .
- Step 412 the message pusher 120 compares the music application data source, the map application data source and the server data source.
- the above data source comparison may include comparing the music application data source and the map application data source with the server data source respectively.
- the music application data source, map application data source and server data source can be respectively obtained. source for comparison.
- the music application data source can be compared with the server data source first, and then the map application data source can be compared with the server data source; or the map application data source can be compared with the server data source first. Yes, and then compare the music application data source with the server data source; you can also compare the music application data source with the server data source, and compare the map application data source with the server data source. This is not particularly limited in the application examples.
- Step 413 if the above data sources are all consistent, push the to-be-pushed message sent by the message provider 110 to the message receiver 130 having installed the music application 131 and/or the map application 132 .
- the message pusher 120 may push the to-be-pushed message sent by the message provider 110 to the message receiver 130 having installed the music application 131 and/or the map application 132 .
- the music application data source is consistent with the server data source
- the map application data source is consistent with the server data source, it can be considered that the data sources are consistent.
- the above data sources are compared in the verification system 122, and it is determined that the above data sources are consistent, for example, the music application data source is consistent with the server data source, and the map application data source is consistent with the server data source, Then it can be considered that the verification is successful this time, and the verification system 122 can send a verification success message to the push system 121; after the push system 121 receives the verification success message from the verification system 122, it can push the received message to be pushed this time to the installation music Message recipient 130 of application 131 and/or map application 132 .
- Step 414 if at least one group of data sources in the data source comparison is inconsistent, the current message push task is ended, and a verification failure message may be returned to the message provider 110 .
- the message pusher 120 may end the current message push task.
- the comparison between the music application data source and the server data source is inconsistent, and/or the comparison between the map application data source and the server data source is inconsistent, it may be considered that the data source comparison is inconsistent.
- the verification system 122 compares the above data sources, and it is determined that at least one group of data sources in the above data sources is inconsistent in comparison, for example, the music application data source is inconsistent with the server data source and/or the map application data If the source is inconsistent with the server data source, it can be considered that the verification fails.
- Authentication system 122 may send an authentication failure message to push system 121 . If the push system 121 receives the verification failure message from the verification system 122 , it can stop this message push task, and can return a verification failure message to the message provider 110 .
- the message pusher 120 performs verification according to the data source in the message push request to determine whether the data source of the application corresponding to the message to be pushed this time is consistent with the data source of the message provider, and further It is determined whether the message to be pushed can be sent to the application program corresponding to the application program identifier in the message push request, thereby avoiding message stringing and improving the security of message push.
- FIG. 6 is a schematic structural diagram of an embodiment of a message push apparatus of the present application.
- the above message push apparatus 60 may include: a creation module 61, a sending module 62, a receiving module 63, a verification module 64, and a push module 65;
- a creation module 61 is used to create a mapping relationship between the application identification and the preset key
- a sending module 62 configured to send the mapping relationship to the message provider
- the receiving module 63 is configured to receive the message to be pushed and the message push request sent by the message provider, wherein the message push request includes first information and a first digest for verification, and the first digest is used by the message provider using a preset password.
- the key pair is obtained by digesting the first information, and the first information at least includes the application identification;
- the verification module 64 is used to query whether there is a preset key corresponding to the application identifier in the message push request; if there is a preset key corresponding to the application identifier, use the preset key to verify the Extract the first information of the abstract to obtain the second abstract;
- the push module 65 is configured to compare the second abstract with the first abstract, and if the comparison is consistent, push the to-be-pushed message to the message recipient corresponding to the application identifier.
- the above-mentioned message pushing apparatus 60 may further include: a signature verification module 66;
- the signature verification module 66 is configured to authenticate the message push request according to the signature, so as to determine whether the identity of the message provider is legal.
- the above-mentioned verification module 64 may also be configured to terminate the push of the message to be pushed this time if there is no preset key corresponding to the application identifier.
- the first information includes multiple application identifiers
- the message push request includes multiple first digests corresponding to the application identifiers.
- the preset key corresponding to the identity identifier performs digest extraction on the first information in the message push request to obtain a plurality of second digests corresponding to the application identifier.
- the above push module 65 can also be used to compare the first digest and the second digest corresponding to the same application ID respectively; if the first digest and the second digest of all the application IDs If the two digests are consistent, the to-be-pushed message is pushed to the message receiver corresponding to the application ID.
- Fig. 7 is a schematic structural diagram of another embodiment of the message pushing device of the application, as shown in Fig. 7 , the above-mentioned message pushing device 70 may include: a receiving module 71, a verification module 72 and a pushing module 73;
- a receiving module 71 configured to receive a message to be pushed and a message push request sent by a message provider, wherein the message push request includes an application program identity and a message provider identity;
- a verification module 72 configured to query whether there is a first data source corresponding to the application program identity in the message push request and a second data source corresponding to the message provider identity in the message push request;
- the push module 73 is configured to compare the first data source with the second data source if the first data source and the second data source exist, and if the comparison is consistent, push the to-be-pushed message to the application ID The corresponding message recipient.
- the above-mentioned message pushing apparatus 70 further includes: a registration module 74;
- the registration module 74 is used to receive the identity registration request sent by the message provider, wherein the identity registration request includes the data source and the identity registration type, and the identity registration type includes the first type and the second type; if it is judged that the identity registration type is the first type , then the data source includes the first data source, assigns the message provider identity, associates the message provider identity with the first data source and stores it, and sends the message provider identity to the message provider; If the type is the second type, the data source includes the second data source, the application identifier is allocated, the application identifier is associated with the second data source and stored, and the application identifier is sent to the message provider.
- the identity registration request further includes the identity of the message provider, and the above-mentioned message pushing apparatus 70 further includes: a verification module 75;
- the verification module 75 is configured to perform a query based on the identity of the message provider to obtain the corresponding first data source; compare the first data source obtained by the query with the second data source in the identity registration request, and determine based on the comparison result Whether to assign an application identity.
- the message push request includes multiple application identifiers
- the above-mentioned push module 73 may also be configured to compare the first data source corresponding to the application identifier with the second data source respectively. Yes; if all the first data sources are consistent with the second data sources, push the to-be-pushed message to the message recipient corresponding to the application ID.
- each module of the message push device shown in FIG. 6 and FIG. 7 is only a division of logical functions, and may be fully or partially integrated into a physical entity in actual implementation, or may be physically separated.
- these modules can all be implemented in the form of software calling through processing elements; they can also all be implemented in hardware; some modules can also be implemented in the form of software calling through processing elements, and some modules can be implemented in hardware.
- the detection module may be a separately established processing element, or may be integrated in a certain chip of the electronic device.
- the implementation of other modules is similar.
- all or part of these modules can be integrated together, and can also be implemented independently.
- each step of the above-mentioned method or each of the above-mentioned modules can be completed by an integrated logic circuit of hardware in the processor element or an instruction in the form of software.
- the above modules may be one or more integrated circuits configured to implement the above methods, such as: one or more specific integrated circuits (Application Specific Integrated Circuit; hereinafter referred to as: ASIC), or, one or more microprocessors Digital Singnal Processor (hereinafter referred to as: DSP), or, one or more Field Programmable Gate Array (Field Programmable Gate Array; hereinafter referred to as: FPGA), etc.
- ASIC Application Specific Integrated Circuit
- DSP Digital Singnal Processor
- FPGA Field Programmable Gate Array
- these modules can be integrated together and implemented in the form of a system-on-a-chip (System-On-a-Chip; hereinafter referred to as: SOC).
- FIG. 8 is a schematic structural diagram of an embodiment of an electronic device of the present application, wherein the message pusher 120 may be the above-mentioned electronic device; as shown in FIG. 8 , the above-mentioned electronic device may be a data processing device, such as a server, or a built-in The circuit arrangement of the above data processing apparatus.
- the electronic device can be used to execute the functions/steps in the methods provided by the embodiments shown in FIG. 1 to FIG. 5 of the present application.
- electronic device 800 takes the form of a general-purpose computing device.
- the electronic device described above may include: one or more processors 810; a communication interface 820; a memory 830; a communication bus 840 connecting various system components (including the memory 830 and the processor 810), a database 850; and one or more computer programs.
- the above-mentioned one or more computer programs are stored in the above-mentioned memory, and the above-mentioned one or more computer programs include instructions, when the above-mentioned instructions are executed by the above-mentioned electronic equipment, so that the above-mentioned electronic equipment performs the following steps:
- the message push request includes first information and a first digest used for verification, and the first digest is performed by the message provider using a preset key for the first information.
- the first information at least includes the application identification;
- the second digest is compared with the first digest, and if the comparison is consistent, the to-be-pushed message is pushed to the message recipient corresponding to the application identifier.
- the message push request further includes the signature of the message provider, and when the instruction is executed by the electronic device, the electronic device executes the comparison between the second digest and the first digest before executing the The following steps:
- the message provider is authenticated according to the signature to determine whether the identity of the message provider is legitimate.
- the above-mentioned electronic device when executed by the above-mentioned electronic device, the above-mentioned electronic device further executes the following steps:
- the first information includes multiple application identifiers
- the message push request includes multiple first digests corresponding to the application identifiers
- the above-mentioned instruction is executed by the above-mentioned electronic device
- the step of performing digest extraction on the first information in the message push request by using the preset key, and obtaining the second digest includes:
- the first information in the message push request is digested by using the preset keys corresponding to the application IDs, respectively, to obtain a plurality of second digests corresponding to the application IDs.
- the above-mentioned electronic device executes to compare the second abstract with the first abstract, and if the comparison is consistent, pushes the to-be-pushed message to the application program
- the steps of the message receiver corresponding to the identity identification include:
- the message to be pushed is pushed to the message recipient corresponding to the application identifier.
- An embodiment of the present application further provides an electronic device, as shown in FIG. 8 , wherein the above one or more computer programs are stored in the above memory, and the above one or more computer programs include instructions, when the above instructions are executed by the above electronic device When executed, the above electronic device is made to perform the following steps:
- the message push request includes the application ID and the message provider ID;
- the first data source and the second data source exist, the first data source and the second data source are compared, and if the comparison is consistent, the to-be-pushed message is pushed to the message receiver corresponding to the application ID.
- the identity registration request includes a data source and an identity registration type
- the identity registration type includes a first type and a second type
- the data source includes the first data source, the message provider identity is allocated, the message provider identity is associated with the first data source and stored, and the message provider identity is sent. to the message provider;
- the data source includes the second data source
- the application identification is allocated, the application identification is associated with the second data source and stored, and the application identification is sent to the message provider square.
- the identity registration request further includes the identity of the message provider, and when the above-mentioned instruction is executed by the above-mentioned electronic device, the above-mentioned electronic device further performs the following steps:
- the first data source obtained by the query is compared with the second data source in the identity registration request, and whether to assign the application identity identifier is determined based on the comparison result.
- the message push request includes multiple application identifiers, and when the above instruction is executed by the electronic device, the electronic device executes the comparison between the first data source and the second data source. If yes, the steps of pushing the to-be-pushed message to the message recipient corresponding to the application ID include:
- the to-be-pushed message is pushed to the message receiver corresponding to the application identifier.
- Embodiments of the present application also provide a computer-readable storage medium, where a computer program is stored in the computer-readable storage medium, and when it runs on a computer, the computer causes the computer to execute the programs provided by the embodiments shown in FIG. 1 to FIG. 5 of the present application. method.
- each functional module can be divided corresponding to each function, or two or more functions can be integrated into one processing module.
- the above-mentioned integrated modules can be implemented in the form of hardware, and can also be implemented in the form of software function modules. It should be noted that, the division of modules in the embodiment of the present invention is schematic, and is only a logical function division, and there may be other division manners in actual implementation.
- Each functional unit in each of the embodiments of the embodiments of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
- the above-mentioned integrated units may be implemented in the form of hardware, or may be implemented in the form of software functional units.
- the integrated unit if implemented in the form of a software functional unit and sold or used as an independent product, may be stored in a computer-readable storage medium.
- a computer-readable storage medium includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) or a processor to execute all or part of the steps of the methods described in the various embodiments of the present application.
- the aforementioned storage medium includes: flash memory, removable hard disk, read-only memory, random access memory, magnetic disk or optical disk and other media that can store program codes.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Information Transfer Between Computers (AREA)
Abstract
本申请实施例提供一种消息推送方法、电子设备及存储介质,涉及通信技术领域,包括:创建应用程序身份标识与预设密钥之间的映射关系;将所述映射关系发送至消息提供方;接收所述消息提供方发送的待推送消息及消息推送请求,所述消息推送请求包含第一信息及第一摘要;使用所述预设密钥对所述消息推送请求中的第一信息进行摘要提取,获得第二摘要;将所述第二摘要与所述第一摘要进行比对,若比对一致,则将所述待推送消息推送至与所述应用程序身份标识对应的消息接收方。本申请实施例提供的方法能够避免消息串网,提高消息推送的安全性。
Description
本申请要求于2020年09月24日提交中国专利局、申请号为202011013923.2、申请名称为“消息推送方法、电子设备及存储介质”的中国专利申请的优先权,其全部内容通过引用结合在本申请中。
本申请实施例涉及通信技术领域,尤其涉及一种消息推送方法、电子设备及存储介质。
目前,开放认证(Open Authorization,OAUTH)协议为用户资源的授权提供了一个安全的、开放而又简易的标准。与以往的授权方式不同之处是OAUTH协议的授权不会使第三方触及到用户的帐号信息(如用户名与密码),即第三方无需使用用户的用户名与密码就可以申请获得该用户资源的授权。其中,OAUTH协议还提供了一种基于网络校验码(Json Web Token,JWT)方式的服务器与服务器之间的鉴权方式。
然而,在推送层级中,存在消息提供方错将消息发送给错误的消息接收方(消息串网)的情况,进而引发安全事件,例如,消息提供方A只可以将消息发送给消息接收方A,但是可能将消息发送给消息接收方B或消息接收方C,由此会引起消息串网。
发明内容
本申请实施例提供了一种消息推送方法、电子设备及存储介质,通过在消息推送方处对消息提供方的消息推送请求进行验证,在验证通过后对待推送消息进行推送,由此可以避免消息串网,进而可以提高消息提供方消息推送的安全性。
第一方面,本申请实施例提供了一种消息推送方法,包括:
创建应用程序身份标识与预设密钥之间的映射关系;将映射关系发送至消息提供方;具体地,可以在消息推送方处预先创建应用程序身份标识与预设密钥之间的映射关系。其中,应用程序身份标识用于识别应用程序;该预设密钥可以采用本领域常用的对称或非对称密钥。
接收消息提供方发送的待推送消息及消息推送请求,其中,消息推送请求包括第一信息及用于进行验证的第一摘要,第一摘要由消息提供方使用预设密钥对第一信息进行摘要提取后获得,第一信息至少包括应用程序身份标识;具体地,该消息提供方可以是向消息接收方提供待推送消息的对象,其中,上述待推送消息可以包括与应用程序相关的公告消息、通知消息以及其他类型的待推送消息。该第一信息至少包括应用程序身份标识,此外,该第一信息也可以包括JWT签发者、签发时间、签发有效时间等声明信息,本申请实施例对此不作特殊限定。
查询是否存在与消息推送请求中的应用程序身份标识对应的预设密钥;若存在与应用程序身份标识对应的预设密钥,使用预设密钥对消息推送请求中的第一信息进行 摘要提取,获得第二摘要;具体地,可以根据应用程序身份标识与预设密钥之间的映射关系进行查找,以确定是否存在与消息推送请求中的应用程序身份标识对应的预设密钥。
将第二摘要与第一摘要进行比对,若比对一致,则将待推送消息推送至与应用程序身份标识对应的消息接收方。具体地,若第二摘要与第一摘要一致,则消息推送方可以将待推送消息进行推送,其中,推送的目标对象可以是与消息推送请求中的应用程序身份标识对应的消息接收方,例如,该消息接收方可以包括已安装与上述应用程序身份标识对应的应用程序的移动终端;若第二摘要与第一摘要不一致,则可以向消息提供方返回失败消息,并可以结束本次消息推送任务。
通过在消息推送请求中携带摘要信息及接收方信息,在消息推送方处基于该摘要信息进行比对,以完成本次消息推送请求的验证,并在验证通过后将待推送消息发送至与接收方信息对应的接收方,可以避免消息串网,进而提高消息推送的安全性。
其中一种可能的实现方式中,消息推送请求还包括消息提供方的签名,对将所述第二摘要与所述第一摘要进行比对之前,还包括:
根据签名对消息推送请求进行身份验证,以确定消息提供方的身份是否合法。
其中一种可能的实现方式中,上述方法还包括:
若不存在与应用程序身份标识对应的预设密钥,则终止本次待推送消息的推送。具体地,若判断查找不到预设密钥,则可以认为本次消息推送方为非法用户,也就是说,该消息推送方无权进行消息推送,因此,可以终止本次待推送消息的推送,由此可以提高***的效率,以及提高消息推送的安全性。
其中一种可能的实现方式中,第一信息包括多个应用程序身份标识,消息推送请求包括多个与应用程序身份标识对应的第一摘要,使用预设密钥对消息推送请求中的第一信息进行摘要提取,获得第二摘要包括:
分别使用与应用程序身份标识对应的预设密钥对消息推送请求中的第一信息进行摘要提取,获得多个与应用程序身份标识对应的第二摘要。具体地,第一信息可以包括多个应用程序身份标识,也就是说,待推送消息可以推送给多个接收方。因此,在消息推送方可以使用每个与应用程序身份标识对应的预设密钥对第一信息进行摘要提取,获得多个第二摘要。
其中一种可能的实现方式中,将第二摘要与第一摘要进行比对,若比对一致,则将待推送消息推送至与应用程序身份标识对应的消息接收方包括:
分别将对应同一个应用程序身份标识的第一摘要和第二摘要进行比对;若所有应用程序身份标识的第一摘要和第二摘要比对一致,则将待推送消息推送至与应用程序身份标识对应的消息接收方。具体地,分别将每个第一摘要与对应的第二摘要进行比对,若所有的第一摘要与对应的第二摘要均一致,则可以将待推送消息推送至与应用程序身份标识对应的消息接收方,由此可以在保证消息推送安全的基础上,实现多条待推送消息的推送。
本申请实施例还提供了一种消息推送方法,包括:
接收消息提供方发送的待推送消息及消息推送请求,其中,消息推送请求包括应 用程序身份标识及消息提供方身份标识;具体地,应用程序身份标识用于识别应用程序;消息提供方身份标识用于识别消息提供方。
查询是否存在与消息推送请求中的应用程序身份标识对应的第一数据源及与消息推送请求中的消息提供方身份标识对应的第二数据源;具体地,消息推送方处可以预先存储应用程序身份标识与第一数据源的映射关系,以及消息提供方身份标识与第二数据源的映射关系。基于应用程序身份标识及消息提供方身份标识可以查询是否存在对应的第一数据源和第二数据源。
若存在第一数据源及第二数据源,则将第一数据源与第二数据源进行比对,若比对一致,则将待推送消息推送至与应用程序身份标识对应的消息接收方。
通过消息推送请求中携带应用程序身份标识及消息提供方身份标识,基于应用程序身份标识及消息提供方身份标识查询获得对应的第一数据源及第二数据源,通过第一数据源与第二数据源的比对,以完成对消息推送请求的验证,由此可以避免消息串网,进而提高消息推送的安全性。
其中一种可能的实现方式中,接收消息提供方发送的待推送消息及消息推送请求之前,还包括:
接收消息提供方发送的身份注册请求,其中,身份注册请求包括数据源及身份注册类型,身份注册类型包括第一类型及第二类型;具体地,该数据源可以用于标识消息提供方存储数据的源地址,该身份注册类型可以用于标识消息提供方本次请求哪个对象的身份标识,示例性的,该第一类型可以对应消息提供方的身份标识,该第二类型可以对应应用程序的身份标识。
若判断身份注册类型为第一类型,则上述数据源包括第一数据源,分配消息提供方身份标识,将消息提供方身份标识与第一数据源进行关联后存储,并将消息提供方身份标识发送给消息提供方;若判断身份注册类型为第二类型,则上述数据源包括第二数据源,分配应用程序身份标识,将应用程序身份标识与第二数据源进行关联后存储,并将应用程序身份标识发送给消息提供方;具体地,可以由消息推送方基于身份注册类型分配消息提供方身份标识或应用程序身份标识,并可以由消息推送方分别将消息提供方身份标识与第一数据源进行关联或将应用程序身份标识与第二数据源进行关联后存储在本地。通过两次注册过程,可以分别完成消息提供方的注册及与该消息提供方对应的应用程序的注册。
其中一种可能的实现方式中,若判断身份注册类型为第二类型,则身份注册请求还包括消息提供方身份标识,上述方法还包括:
基于消息提供方身份标识进行查询,获得对应的第一数据源;将查询获得的第一数据源与身份注册请求中的第二数据源进行比对,基于比对结果确定是否分配应用程序身份标识。具体地,在应用程序注册时,身份注册请求中携带的第二数据源应与第一数据源一致,因此,通过判断第一数据源与第二数据源是否一致,以确定是否分配应用程序身份标识,由此可以提高应用程序注册的安全性。
其中一种可能的实现方式中,消息推送请求包括多个应用程序身份标识,将第一数据源与第二数据源进行比对,若比对一致,则将待推送消息推送至与应用程序身份标识对应的消息接收方包括:
分别将每个与应用程序身份标识对应的第一数据源与第二数据源进行比对;若所有的第一数据源与第二数据源均一致,则将待推送消息推送至与应用程序身份标识对应的消息接收方。具体地,可以将每个第一数据源分别与第二数据源进行比对,若每个第一数据源与第二数据源均一致,则可以将待推送消息推送至与应用程序身份标识对应的消息接收方,由此可以在保证消息推送安全的基础上,实现多条待推送消息的推送。
第二方面,本申请实施例提供一种消息推送装置,包括:
创建模块,用于创建应用程序身份标识与预设密钥之间的映射关系;
发送模块,用于将映射关系发送至消息提供方;
接收模块,用于接收消息提供方发送的待推送消息及消息推送请求,其中,消息推送请求包括第一信息及用于进行验证的第一摘要,第一摘要由消息提供方使用预设密钥对第一信息进行摘要提取后获得,第一信息至少包括应用程序身份标识。
验证模块,用于查询是否存在与消息推送请求中的应用程序身份标识对应的预设密钥;若存在与应用程序身份标识对应的预设密钥,使用预设密钥对消息推送请求中的第一信息进行摘要提取,获得第二摘要;
推送模块,用于将第二摘要与第一摘要进行比对,若比对一致,则将待推送消息推送至与应用程序身份标识对应的消息接收方。
其中一种可能的实现方式中,消息推送请求还包括消息提供方的签名,上述装置还包括:
验签模块,用于根据签名对消息推送请求进行身份验证,以确定消息提供方的身份是否合法。
其中一种可能的实现方式中,上述验证模块还用于若不存在与应用程序身份标识对应的预设密钥,则终止本次待推送消息的推送。其中一种可能的实现方式中,第一信息包括多个应用程序身份标识,消息推送请求包括多个与应用程序身份标识对应的第一摘要,上述验证模块还用于分别使用与应用程序身份标识对应的预设密钥对消息推送请求中的第一信息进行摘要提取,获得多个与应用程序身份标识对应的第二摘要。
其中一种可能的实现方式中,上述推送模块还用于分别将对应同一个应用程序身份标识的第一摘要和第二摘要进行比对;若所有应用程序身份标识的第一摘要和第二摘要比对一致,则将待推送消息推送至与应用程序身份标识对应的消息接收方。
本申请实施例还提供一种消息推送装置,包括:
接收模块,用于接收消息提供方发送的待推送消息及消息推送请求,其中,消息推送请求包括应用程序身份标识及消息提供方身份标识;
验证模块,用于查询是否存在与消息推送请求中的应用程序身份标识对应的第一数据源及与消息推送请求中的消息提供方身份标识对应的第二数据源;
推送模块,用于若存在第一数据源及第二数据源,则将第一数据源与第二数据源进行比对,若比对一致,则将待推送消息推送至与应用程序身份标识对应的消息接收方。
其中一种可能的实现方式中,上述装置还包括:
注册模块,用于接收消息提供方发送的身份注册请求,其中,身份注册请求包括数据源及身份注册类型,身份注册类型包括第一类型及第二类型;若判断身份注册类型为第一类型,则数据源包括第一数据源,分配消息提供方身份标识,将消息提供方身份标识与第一数据源进行关联后存储,并将消息提供方身份标识发送给消息提供方;若判断身份注册类型为第二类型,则数据源包括第二数据源,分配应用程序身份标识,将应用程序身份标识与第二数据源进行关联后存储,并将应用程序身份标识发送给消息提供方。
其中一种可能的实现方式中,若判断身份注册类型为第二类型,则身份注册请求还包括消息提供方身份标识,上述装置还包括:
核查模块,用于基于消息提供方身份标识进行查询,获得对应的第一数据源;将查询获得的第一数据源与身份注册请求中的第二数据源进行比对,基于比对结果确定是否分配应用程序身份标识。
其中一种可能的实现方式中,消息推送请求包括多个应用程序身份标识,上述推送模块还用于分别将每个与应用程序身份标识对应的第一数据源与第二数据源进行比对;若所有的第一数据源与第二数据源均一致,则将待推送消息推送至与应用程序身份标识对应的消息接收方。
第三方面,本申请实施例提供一种电子设备,包括:
处理器和存储器,该存储器用于存储计算机程序代码,该计算机程序代码包括指令,当该处理器从该存储器中读取指令时,以使得该电子设备执行以下步骤:创建应用程序身份标识与预设密钥之间的映射关系;
将映射关系发送至消息提供方;
接收消息提供方发送的待推送消息及消息推送请求,其中,消息推送请求包括第一信息及用于进行验证的第一摘要,第一摘要由消息提供方使用预设密钥对第一信息进行摘要提取后获得,第一信息至少包括应用程序身份标识;
查询是否存在与消息推送请求中的应用程序身份标识对应的预设密钥;
若存在与应用程序身份标识对应的预设密钥,使用预设密钥对消息推送请求中的第一信息进行摘要提取,获得第二摘要;
将第二摘要与第一摘要进行比对,若比对一致,则将待推送消息推送至与应用程序身份标识对应的消息接收方。
其中一种可能的实现方式中,上述消息推送请求还包括消息提供方的签名,上述指令被上述电子设备执行时,使得上述电子设备执行将第二摘要与第一摘要进行比对之前,还执行以下步骤:
根据签名对消息提供方进行身份验证,以确定消息提供方的身份是否合法。
其中一种可能的实现方式中,上述指令被上述电子设备执行时,使得上述电子设备还执行以下步骤:
若不存在与应用程序身份标识对应的预设密钥,则终止本次待推送消息的推送。。
其中一种可能的实现方式中,第一信息包括多个应用程序身份标识,消息推送请 求包括多个与应用程序身份标识对应的第一摘要,上述指令被上述电子设备执行时,使得上述电子设备执行使用预设密钥对消息推送请求中的第一信息进行摘要提取,获得第二摘要的步骤包括:
分别使用与应用程序身份标识对应的预设密钥对消息推送请求中的第一信息进行摘要提取,获得多个与应用程序身份标识对应的第二摘要。
其中一种可能的实现方式中,上述指令被上述电子设备执行时,使得上述电子设备执行将第二摘要与第一摘要进行比对,若比对一致,则将待推送消息推送至与应用程序身份标识对应的消息接收方的步骤包括:
分别将对应同一个应用程序身份标识的第一摘要和第二摘要进行比对;
若所有应用程序身份标识的第一摘要和第二摘要比对一致,则将待推送消息推送至与应用程序身份标识对应的消息接收方。
本申请实施例还提供一种电子设备,包括:
处理器和存储器,该存储器用于存储计算机程序代码,该计算机程序代码包括指令,当该处理器从该存储器中读取指令时,以使得该电子设备执行以下步骤:
接收消息提供方发送的待推送消息及消息推送请求,其中,消息推送请求包括应用程序身份标识及消息提供方身份标识;
查询是否存在与消息推送请求中的应用程序身份标识对应的第一数据源及与消息推送请求中的消息提供方身份标识对应的第二数据源;
若存在第一数据源及第二数据源,则将第一数据源与第二数据源进行比对,若比对一致,则将待推送消息推送至与应用程序身份标识对应的消息接收方。
其中一种可能的实现方式中,上述指令被上述电子设备执行时,使得上述电子设备执行接收消息提供方发送的待推送消息及消息推送请求的步骤之前,还执行以下步骤:
接收消息提供方发送的身份注册请求,其中,身份注册请求包括数据源及身份注册类型,身份注册类型包括第一类型及第二类型;
若判断身份注册类型为第一类型,则数据源包括第一数据源,分配消息提供方身份标识,将消息提供方身份标识与第一数据源进行关联后存储,并将消息提供方身份标识发送给消息提供方;
若判断身份注册类型为第二类型,则数据源包括第二数据源,分配应用程序身份标识,将应用程序身份标识与第二数据源进行关联后存储,并将应用程序身份标识发送给消息提供方。
其中一种可能的实现方式中,若判断身份注册类型为第二类型,则身份注册请求还包括消息提供方身份标识,上述指令被上述电子设备执行时,使得上述电子设备还执行以下步骤:
基于消息提供方身份标识进行查询,获得对应的第一数据源;
将查询获得的第一数据源与身份注册请求中的第二数据源进行比对,基于比对结果确定是否分配应用程序身份标识。
其中一种可能的实现方式中,消息推送请求包括多个应用程序身份标识,上述指 令被上述电子设备执行时,使得上述电子设备执行将第一数据源与第二数据源进行比对,若比对一致,则将待推送消息推送至与应用程序身份标识对应的消息接收方的步骤包括:
分别将每个与应用程序身份标识对应的第一数据源与第二数据源进行比对;
若所有的第一数据源与第二数据源均一致,则将待推送消息推送至与应用程序身份标识对应的消息接收方。
第四方面,本申请实施例提供一种计算机可读存储介质,该计算机可读存储介质中存储有计算机程序,当其在计算机上运行时,使得计算机执行如第一方面所述的方法。
第五方面,本申请实施例提供一种计算机程序,当上述计算机程序被计算机执行时,用于执行如第一方面所述的方法。
在一种可能的设计中,第五方面中的程序可以全部或者部分存储在与处理器封装在一起的存储介质上,也可以部分或者全部存储在不与处理器封装在一起的存储器上。
图1为本申请实施例提供的消息推送方法的应用场景示意图;
图2为本申请提供的消息推送方法一个实施例的交互流程示意图;
图3A为本申请提供的JWT格式的消息推送请求一个实施例的的结构示意图;
图3B为本申请提供的JWT格式的消息推送请求另一个实施例的的结构示意图;
图4为本申请提供的消息推送请求方法另一个实施例的交互流程示意图;
图5为本申请提供的JWT格式的消息推送请求再一个实施例的的结构示意图;
图6为本申请提供的消息推送装置一个实施例的结构示意图;
图7为本申请提供的消息推送装置另一个实施例的结构示意图;
图8为本申请实施例提供的电子设备的结构示意图。
下面将结合本申请实施例中的附图,对本申请实施例中的技术方案进行描述。其中,在本申请实施例的描述中,除非另有说明,“/”表示或的意思,例如,A/B可以表示A或B;本文中的“和/或”仅仅是一种描述关联对象的关联关系,表示可以存在三种关系,例如,A和/或B,可以表示:单独存在A,同时存在A和B,单独存在B这三种情况。
以下,术语“第一”、“第二”仅用于描述目的,而不能理解为指示或暗示相对重要性或者隐含指明所指示的技术特征的数量。由此,限定有“第一”、“第二”的特征可以明示或者隐含地包括一个或者更多个该特征。在本申请实施例的描述中,除非另有说明,“多个”的含义是两个或两个以上。
JWT是为了在网络应用环境间传递声明而执行的一种基于Json的开放标准,该JWT被设计为紧凑且安全的,特别适用于分布式站点的单点登录,且该JWT的声明一 般被用来在身份提供者和服务提供者间传递被认证的用户身份信息,以便于从资源服务器获取资源,也可以增加一些额外的其它业务逻辑说必须的声明信息。此外,该JWT也可直接被用于认证,也可被加密。其中,该JWT可以由三部分组成,第一部分为头部,第二部分为载荷,第三部分是签名。
该JWT可以用于签名鉴权,例如,消息提供方可以将消息推送请求通过JWT的方式发送给消息推送方。消息推送方对该消息推送请求进行签名鉴权后,确定消息提供方的身份是否合法,也就是说,确定消息提供方是否可以将待推送消息推送给消息接收方。但是,目前的签名鉴权方式无法确定将待推送消息推送至哪些消息接收方,有可能发生将发送给消息接收方A的待推送消息发送给了消息接收方B。因此,上述签名鉴权方式无法解决消息串网的问题,由此给消息提供方的数据推送带来安全隐患。
基于上述问题,本申请实施例提供了一种消息推送方法。
本申请实施例提供的消息推送方法可运用于数据处理设备,该数据处理设备可以是服务器,本申请对执行该技术方案的数据处理设备的具体形式不做特殊限制。
本申请实施例应用的场景如图1所示,该应用场景包括消息提供方110、消息推送方120及消息接收方130,其中,该消息提供方110用于向消息推送方120发送待推送消息及消息推送请求,使得消息推送方120在对消息推送请求进行验证后,对该待推送消息进行推送。示例性的,该待推送消息可以包括与应用程序相关的公告消息、通知消息以及其他类型的消息,例如,该待推送消息可以是“凌晨1点升级服务的公告信息”。该待推送消息也可以是其它类型的消息,本申请实施例对此不作特殊限定。
消息推送方120用于接收消息提供方110发送的待推送消息及消息推送请求,对消息推送请求进行验证,并将该待推送消息推送给正确的消息接收方130。其中,该消息推送方120包括推送***121及验证***122,验证***122用于对消息推送请求进行验证,推送***121用于在消息推送请求验证通过后将待推送消息推送给消息接收方130。
需要说明的是,消息提供方110发送的待推送消息是基于应用程序的,因此,消息推送方120可以将待推送消息推送给消息接收方130(例如,移动终端)上已安装的对应的应用程序。例如,当消息推送方120推送与音乐应用131对应的公告消息时,若消息接收方130上安装了音乐应用131,则可以接收该公告消息。
该消息接收方130用于接收消息推送方120推送的消息。其中,该消息接收方130可以是安装了应用程序(例如,音乐应用131、地图应用132等)的移动终端,也可以是安装了上述应用程序的其他类型的终端,本申请对此不作特殊限定。
现结合图2-图5,以消息提供方110发送分别与音乐应用131和地图应用132对应的两条待推送消息为例,对本申请实施例提供的消息推送方法进行说明,如图2所示为本申请消息推送方法一个实施例的交互流程图,包括:
步骤201,消息推送方120创建与应用程序对应的应用密钥。
具体地,消息推送方120可以预先设置多个应用程序(例如,音乐应用、地图应用、点餐应用等)的身份标识,例如,可以给音乐应用131设置音乐应用ID,也可以给地图应用132设置地图应用ID。可以理解的是,应用程序的身份标识用于识别应用 程序。可选地,应用程序的身份标识也可以由消息提供方110预先发送给消息推送方120,本申请对此不作特殊限定。
当消息推送方120获取到应用程序的身份标识后,可以对每个应用程序创建对应的应用密钥,例如,可以给音乐应用131创建对应的应用密钥(以下简称为音乐应用密钥),可以给地图应用132创建对应的应用密钥(以下简称为地图应用密钥)。其中,该应用密钥可以采用本领域常用的对称或非对称密钥,本申请实施例对此不作特殊限定。
步骤202,消息推送方120将应用程序与应用密钥之间的映射关系发送给消息提供方110。
具体地,在消息推送方120中可以建立应用程序与应用密钥之间的一对一的映射关系,并可以将该映射关系存储在本地数据库中。接着,消息推送方120可以将该映射关系发送给消息提供方110。在具体实现时,该本地数据库可以设置在消息推送方120中的验证***122中。
步骤203,消息提供方110获取声明信息、音乐应用131身份标识及地图应用132身份标识,并使用音乐应用密钥对该声明信息、音乐应用131身份标识及地图应用132身份标识进行摘要提取,生成对应的摘要(以下简称音乐应用摘要),使用地图应用密钥对该声明信息、音乐应用131身份标识及地图应用132身份标识进行摘要提取,生成对应的摘要(以下简称地图应用摘要)。
具体地,该声明信息可以包括与本次消息推送请求相关的信息,其中,该消息推送请求用于消息提供方100向消息推送方200请求推送上述待推送消息。该消息推送请求可以通过JWT的方式发送,因此,该声明信息可以包含JWT在标准协议中注册的声明信息,示例性的,该声明信息可以包括签发者(例如,签发该JWT的服务器)、签发时间(例如,签发该JWT的时刻)和签发有效时间(例如,该JWT的有效时间段)等相关信息,具体可以参考协议RFC7523,在此不再赘述。此外,该声明信息也可以包括其他相关信息,本申请实施例对该声明信息的具体内容和形式不作特殊限定。
进一步地,因为在消息提供方110的本地数据库中保存有应用程序与应用密钥的映射关系,当消息提供方110获取到上述声明信息、音乐应用131身份标识及地图应用132身份标识后,可以利用该映射关系,根据音乐应用131身份标识查询获得对应的音乐应用密钥,根据地图应用132身份标识查询获得对应的地图应用密钥。并使用音乐应用密钥对该声明信息、音乐应用131身份标识及地图应用132身份标识进行摘要提取,由此可以得到与音乐应用131身份标识对应的音乐应用摘要。同样地,消息提供方110还可以使用地图应用密钥对该声明信息、音乐应用131身份标识及地图应用132身份标识进行摘要提取,由此可以得到与地图应用132身份标识对应的地图应用摘要。其中,摘要提取的方式可以是通过HASHMAC512方式,也可以通过其他摘要提取的方式,本申请实施例对此不作特殊限定。
需要说明的是,消息提供方110进行摘要提取时,也可以不对声明信息进行摘要提取。示例性的,消息提供方110可以对音乐应用131身份标识及地图应用132身份 标识进行摘要提取,由此可以得到与音乐应用131身份标识对应的音乐应用摘要,以及对音乐应用131身份标识及地图应用132身份标识进行摘要提取,由此可以得到与地图应用132身份标识对应的地图应用摘要。也就是说,声明信息为消息提供方110进行摘要提取时的可选信息。
步骤204,消息提供方110向消息推送方120发送待推送消息及消息推送请求,其中,消息推送请求包含声明信息、音乐应用131身份标识、地图应用132身份标识、音乐应用摘要及地图应用摘要。
具体地,当消息提供方110获取到音乐应用摘要及地图应用摘要之后,可以根据该声明信息、音乐应用131身份标识、地图应用132身份标识、音乐应用摘要及地图应用摘要生成消息推送请求;其中,该消息推送请求可用于消息提供方100向消息推送方120请求推送提供方110发送的待推送消息,该消息推送请求的形式可以是JWT的形式。
现结合图3A和图3B进行说明,如图3A所示为现有的JWT格式的消息推送请求数据包300,数据包300包括头部、载荷及签名。数据包300的头部包含应用程序身份标识字段(sub)及第一字段(aa),该sub字段用于指示应用程序的身份标识在载荷中的位置,该aa字段用于标识声明信息在载荷中的位置;数据包300的载荷可以包含声明信息及与sub字段对应的信息(例如,应用程序的身份标识);数据包300的签名用于消息提供方的身份的合法性,例如,消息推送方120可以对消息提供方110的身份进行验证,以确定该消息提供方110的身份的合法性;其中,该签名可以用于标识消息提供方110的身份。也就是说,通过对该签名的验证可以对该消息提供方110本次的消息推送请求进行验证,以确定该消息推送请求是否合法。由上述数据包300可知,数据包300只包含应用程序身份标识字段,消息推送方200收到该数据包300后,无法验证消息提供方110与消息接收方130之间的对应关系,因此,消息推送方200直接将待推送消息推送至与载荷信息中应用程序身份标识对应的消息接收方130,由此可能造成消息串网,带来数据安全问题。
如图3B所示为本申请的JWT格式的消息推送请求数据包310,数据包310可以包括头部、载荷及签名;该数据包310的头部除应用程序身份标识字段(sub)及第一字段(aa)之外,还可以包括摘要字段(vfs),也可以包括其他字段,本申请实施例对此不作限定。其中,该vfs字段用于标识摘要信息在载荷中的位置;该数据包310的载荷可以包括声明信息、应用程序身份标识信息以及摘要信息。其中,应用程序身份标识信息与sub字段对应,摘要信息与vfs字段对应,声明信息与aa字段对应。应用程序身份标识信息包含音乐应用131身份标识及地图应用132身份标识。摘要信息包含音乐应用摘要及地图应用摘要。该数据包310的签名与数据包300的签名的作用相同,在此不再赘述。数据包310携带了摘要信息(例如,音乐应用摘要和地图应用摘要),因此,消息推送方200可以根据该摘要信息进行验证,以确定是否可以将本次的待推送消息发送至已安装音乐应用和地图应用的移动终端,由此可以避免消息串网,保证数据安全。
进一步地,当消息提供方110生成上述消息推送请求之后,可以随同本次待推送 的待推送消息一起发送给消息推送方120,使得该消息推送方120可以将该待推送的待推送消息推送至与上述音乐应用131身份标识和/或地图应用132身份标识对应的消息接收方130(例如,已安装音乐应用131和/或地图应用132的移动终端)。
步骤205,消息推送方120读取该消息推送请求。
具体地,消息推送方120收到消息提供方110的消息推送请求后,可以对该消息推送请求进行读取,以获得该消息推送请求中的声明信息、音乐应用131身份标识、地图应用132身份标识、音乐应用摘要及地图应用摘要。
在具体实现时,可以通过消息推送方120中的推送***121对上述消息推送请求进行读取,由此可以得到声明信息、音乐应用131身份标识、地图应用132身份标识、音乐应用摘要及地图应用摘要,并可以将上述声明信息、音乐应用131身份标识、地图应用132身份标识、音乐应用摘要及地图应用摘要发送至消息推送方120中的验证***122,使得该验证***122可以根据上述声明信息、音乐应用131身份标识、地图应用132身份标识、音乐应用摘要及地图应用摘要进行验证。
可选地,在消息推送方120对该消息推送请求进行验证之前,还可以根据该消息推送请求中的签名信息进行身份验证,其中,该签名信息可以用于验证该消息提供方110的身份的合法性,如果该签名验证通过,说明该消息提供方110的身份合法,可以进一步进行验证,以确定消息提供方110可以向哪些消息接收方130推送待推送消息,如果签名验证失败,则消息推送方120可以直接结束本次验证,并可以返回失败消息给消息提供方110,用于告知该消息提供方110本次消息推送任务失败。
需要说明的是,该JWT还可以应用在其他场景,因此在本申请实施例的应用场景下,可以在消息提供方110与消息推送方120之间添加与该JWT对应的验证接口,例如,第一接口,该第一接口可以用于传输该JWT,代码示例如下:
POST/token.oauth2 HTTP/1.1
Host:as.example.com
Content-Type:application/x-www-form-urlencoded
grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer-with-vfs
&assertion=eyJhbGciOiJFUzI1NiIsImtpZCI6IjE2In0.eyJpc3Mi[…with-vfs].J9l-ZhwP
[...omitted for brevity...]。
步骤206,消息推送方120根据音乐应用131身份标识及地图应用132身份标识进行查询,得到与音乐应用131身份标识对应的音乐应用密钥及与地图应用132身份标识对应的地图应用密钥。
具体地,因为在消息推送方120的本地数据库中保存有应用程序与应用密钥的映射关系,当消息推送方120通过读取获取到上述音乐应用131身份标识及地图应用132身份标识后,可以根据该音乐应用131身份标识及地图应用132身份标识在消息推送方120的本地数据库中进行查询该映射关系,由此可以得到与音乐应用131身份标识对应的音乐应用密钥及与地图应用132身份标识对应的地图应用密钥。
在具体实现时,该本地数据库可以设置在消息推送方120中的验证***122中, 因此,当该验证***122收到推送***121发送的音乐应用131身份标识及地图应用132身份标识后,可以根据音乐应用131身份标识及地图应用132身份标识在上述验证***122的本地数据库中进行查询,由此可以得到与音乐应用131身份标识对应的音乐应用密钥及与地图应用132身份标识对应的地图应用密钥。
需要说明的是,若通过上述验证***122的查询,没有查询到与音乐应用131身份标识对应的音乐应用密钥和与地图应用132身份标识对应的地图应用密钥中的任一个应用密钥,则可以认为本次消息推送请求非法,因此,验证***122可以向推送***121发送验证失败消息,推送***121收到上述验证失败消息后,可以结束本次验证,并向消息提供方110反馈失败消息,用于通知消息提供方110本次消息推送任务失败。
步骤207,消息推送方120使用音乐应用密钥对声明信息、音乐应用131身份标识及地图应用132身份标识进行摘要提取,生成音乐应用摘要,并使用地图密钥对声明信息、音乐应用131身份标识及地图应用132身份标识进行摘要提取,生成地图应用摘要。
具体地,当消息推送方120通过查询获取到音乐应用密钥和地图应用密钥后,可以使用音乐应用密钥对上述声明信息、音乐应用131身份标识及地图应用132身份标识进行摘要提取,以生成对应的音乐应用摘要,并使用地图应用密钥对上述声明信息、音乐应用131身份标识及地图应用132身份标识进行摘要提取,以生成对应的地图应用摘要。其中,摘要提取的方式可以同步骤203中的方式,例如,HASHMAC512方式,在此不再赘述。
步骤208,消息推送方120将在消息推送方120处生成的音乐应用摘要与消息推送请求中的音乐应用摘要进行比对,以及将在消息推送方120处生成的地图应用摘要与消息推送请求中的地图应用摘要进行比对。
具体地,消息推送方120生成音乐应用摘要和地图应用摘要后,可以将生成的音乐应用摘要与消息推送请求中的音乐应用摘要进行比对,以及将生成的地图应用摘要与消息推送请求中的地图应用摘要进行比对,以完成对消息推送请求的验证。
步骤209,若音乐应用摘要比对和地图应用摘要比对都通过,则消息推送方120将待推送消息推送送给安装音乐应用131和/或地图应用132的消息接收方130。
具体地,若音乐应用摘要比对和地图应用摘要比对都通过,例如,消息推送方120生成的音乐应用摘要与消息推送请求中的音乐应用摘要一致,以及消息推送方120生成的地图应用摘要与消息推送请求中的地图应用摘要一致,则可以认为对消息推送请求的验证通过,消息推送方120可以将待推送消息推送给安装音乐应用131和/或地图应用132的消息接收方130。
步骤210,若音乐应用摘要比对和地图应用摘要比对中有任一个比对不通过,则消息推送方120向消息提供方110返回验证失败消息。
具体地,若音乐应用摘要比对和地图应用摘要比对中有任一个比对不通过,则可以认为对消息推送请求的验证失败。消息推送方120可以发送验证失败消息给消息提供方110,用于通知消息提供方110本次消息推送任务失败,并结束本次消息推送。
本实施例中,通过在消息推送方120处根据消息推送请求中的摘要信息进行验证,以确定消息推送请求中的摘要信息与消息推送方120生成的摘要信息是否一致,并进一步可以确定待推送消息是否可以发送至消息推送请求中应用程序身份标识对应的应用程序,由此可以避免消息串网,进而可以提高消息推送的安全性。
上述图2和图3以消息提供方110发送分别与音乐应用131和地图应用132对应的两条待推送消息,并通过摘要比对为例进行了说明,可以理解的是,消息提供方110也可以只给一个、或多于两个的应用推送消息,其原理都类似,在此不再赘述。
下面以消息提供方110分别发送与音乐应用131和地图应用132对应的两条待推送消息,并通过数据源比对为例进行说明另一种消息推送方法。
如图4所示为本申请消息推送方法另一个实施例的交互流程图,包括:
步骤401,消息提供方110向消息推送方120发送身份注册请求,以获得消息提供方110的身份标识。
具体地,该身份注册请求可以用于消息提供方110向消息推送方120请求获得消息提供方110的身份标识。需要说明的是,消息提供方110本身具有身份标识,该本身的身份标识用于在网络中对消息提供方110进行识别,但是不同于消息提供方本身的身份标识,该请求获得的身份标识用于后续在消息推送方120处对消息推送请求进行验证,其中,该请求获得的身份标识可以用数字来表征。为了表述方便,以下提及的消息提供方110的身份标识指代消息提供方110请求获得或者消息推送方120为消息提供方110分配的身份标识。
其中,该身份注册请求可以包括身份注册类型,该身份注册类型用于消息推送方120识别消息提供方110本次注册的目标对象,通过身份注册类型可以识别本次是给应用程序注册身份标识,还是给消息提供方110注册身份标识。示例性的,身份注册类型可以包括应用类型和服务方类型,若消息推送方120识别出是应用类型,则可以为应用程序注册身份标识,以完成应用程序在消息推送方120上的身份注册;若消息推送方120识别出是服务方类型,则可以为消息提供方110注册一个身份标识,以完成消息提供方110在消息推送方120上的身份注册。
此外,该身份注册请求还可以包括数据源,该数据源可以用于表征消息提供方110提供的各项服务的数据的源地址,该数据源可以和该消息提供方110对应,示例性的,该数据源可以是该消息提供方110存储业务数据的目标服务器地址,例如,假设消息提供方110可以提供订餐服务、音乐服务和地图服务,则提供上述订餐服务、音乐服务和地图服务的服务器地址可以是同一个地址,也就是说,与消息提供方110对应的数据源与属于同一个消息提供方110的所有应用程序(例如,订餐应用、音乐应用、地图应用等)的数据源应相同,即数据源为同一个,而用户可以通过移动终端上的订餐应用接收订餐服务、通过移动终端上的音乐应用131接收音乐服务,以及通过移动终端上的地图应用132接收地图服务。在具体实现时,该数据源可以通过唯一的IP地 址进行表征,也可以通过唯一的ID号进行表征,本申请实施例对此不作限定。
在具体实现时,可以在该身份注册请求中携带两个字段,例如,数据源(source)字段及类型(evidence)字段,其中,该source字段可以用于标识与消息提供方110对应的数据源,该evidence字段可以用于标识本次注册的身份注册类型。其中,该evidence字段可以包括两种数值类型,例如,字符类型和数字类型。示例性的,若evidence字段取值为字符串NEW_APP,也就是说,evidence字段的数值类型为字符类型,由此可以使得消息推送方根据该身份注册请求确定本次身份注册类型为服务方类型,也就是说,本次是给消息提供方110注册身份标识,
进一步地,消息提供方110和消息推送方120之间还可以建立注册接口,以便消息提供方110可以调用该注册接口,用于传输该身份注册请求,完成该身份注册过程,代码示例如下:
POST/register HTTP/1.1
Content-Type:application/json
Accept:application/json
Host:server.example.com
{
"redirect_uris":[
"https://client.example.org/callback",
"https://client.example.org/callback2"],
"client_name":"My Example Client",
"client_name#ja-Jpan-JP":"\u30AF\u30E9\u30A4\u30A2\u30F3\u30C8\u540D",
"token_endpoint_auth_method":"client_secret_basic",
"logo_uri":"https://client.example.org/logo.png",
"jwks_uri":"https://client.example.org/my_public_keys.jwks",
"example_extension_parameter":"example_value",
"source":"example_source",
"evidence":"example_evidence"
}。
步骤402,消息推送方120读取身份注册请求,得到身份注册请求中的身份注册类型。
步骤403,判断本次身份注册类型为服务方类型,则消息推送方120分配消息提供方110的身份标识,将该消息提供方110的身份标识与身份注册请求中的数据源进行关联后存储。
具体地,当消息推送方120收到该身份注册请求后,对该身份注册请求进行读取,得到身份注册请求中的数据源及身份注册类型。若经过读取后确定身份注册类型为服 务方类型,则可以为消息提供方110分配身份标识,并可以将该消息提供方110的身份标识与身份注册请求中的数据源进行关联后存储,然后可以将该消息提供方110的身份标识发送给消息提供方110。其中,与该消息提供方110的身份标识关联存储的数据源可以认为是服务方数据源。
在具体实现时,消息提供方110的身份注册请求可以直接发送给消息推送方120的验证***122,验证***122收到该身份注册请求后,可以首先读取该身份注册请求中的evidence字段,若evidence字段取值为字符串,示例性的,可以是NEW_APP,则可以认为本次是分配消息提供方110的身份标识,该验证***122可以分配一个身份标识,该分配的身份标识作为该消息提供方110后续用于验证的身份标识,其中,该消息提供方110的身份标识可以是数字。接着验证***122可以将该消息提供方110的身份标识与身份注册请求中的source字段信息进行关联后存储在验证***122中的本地数据库中,并可以将该消息提供方110的身份标识返回给消息提供方110,由此消息提供方110完成了消息提供方110身份标识在消息推送方120上的注册任务。
其中,在验证***122解析出evidence字段信息后,还可以进一步读取source字段信息,并可以在验证***122的本地数据库中查询是否已存在与该source字段信息对应的数据源,若已存在与该source字段信息对应的数据源,则可以认为该数据源已被注册,即可以结束本次注册请求,并可以向消息提供方110返回失败消息,用于通知消息提供方本次注册失败。若不存在与该source字段信息对应的数据源,则可以分配消息提供方110的身份标识。
步骤404,消息推送方120将该分配的消息提供方110的身份标识发送给消息提供方110。
步骤405,消息提供方110向消息推送方120发送身份注册请求,以获得应用程序的身份标识。
类似地,该应用程序的身份标识不同于本身的身份标识,是请求分配的、后续用于消息推送请求验证的身份标识。为了表述方便,以下提及的应用程序的身份标识指代消息提供方110为应用程序请求获得或者消息推送方120为应用程序分配的身份标识。
具体地,消息提供方110在消息推送方120上完成注册之后,也就是说,消息提供方110获得由消息推送方120分配的身份标识之后,还可以通过身份注册请求对与消息提供方110对应的应用程序注册身份标识。示例性的,若消息提供方110包含订餐应用、音乐应用及地图应用,则消息提供方110可以为订餐应用、音乐应用及地图应用进行注册,以获得与订餐应用、音乐应用及地图应用对应的身份标识。需要说明的是,消息提供方110可以通过一个身份注册请求为一个应用程序注册身份标识,消息提供方110也可以通过一个身份注册请求分别为多个应用程序注册身份标识,本申请实施例对此不作特殊限定。
在具体实现时,如前所述,因为为消息提供方110分配的身份标识可以用数字表征,那么就可以将evidence字段的取值设为消息提供方110的身份标识,也就是说, 一来,evidence字段的数值类型为消息提供方110的身份标识表征的数字类型,由此可以使得消息推送方120可以根据该身份注册请求确定本次身份注册类型为应用类型,也就是说,表明本次是给消息提供方110中对应的应用程序注册身份标识,二来,也可以同时表明本次注册的应用程序与evidence字段的数值所对应的消息提供方110相关联。例如,假设evidence字段的取值对应的消息提供方为AA,则可以给消息提供方AA所属的音乐应用131注册身份标识,或给消息提供方AA所属的地图应用132注册身份标识,或给消息提供方AA所属的其他应用程序(订餐应用)注册身份标识。
步骤406,消息推送方120读取身份注册请求,得到身份注册请求中的身份注册类型。
步骤407,判断本次身份注册类型为应用类型,则消息推送方120分配应用程序的身份标识,将该应用程序的身份标识与数据源进行关联后存储。
具体地,若消息推送方120通过对身份注册请求的读取,确定身份注册类型为应用类型,则可以分配应用程序的身份标识,并可以将该应用程序的身份标识与身份注册请求中的数据源进行关联后存储,然后可以将该应用程序的身份标识发送给消息提供方110。其中,与应用程序关联存储的数据源可以认为是应用数据源,例如,与音乐应用关联存储的数据源可以认为是音乐应用数据源,与地图应用关联存储的数据源可以认为是地图应用数据源,与订餐应用关联存储的数据源可以认为是订餐应用数据源等。
在具体实现时,消息提供方110的身份注册请求可以直接发送给消息推送方120的验证***122,验证***122收到该身份注册请求后,可以首先读取该身份注册请求中的evidence字段,若evidence字段取值为数字,则可以认为本次是分配应用程序的身份标识。如前所述,该evidence字段的取值可以为消息提供方110的身份标识,一来可以确定是为应用程序分配身份标识,二来还可以知道本次注册的应用程序是与evidence字段中的数字取值对应的消息提供方110对应的应用程序。接着可以根据该evidence字段中的该消息提供方110的身份标识在验证***122中的本地数据库中进行查询,以得到与该消息提供方110的身份标识对应的服务方数据源,并可以将查询获得的数据源与身份注册请求中的source字段信息对应的数据源进行比对,若查询获得的服务方数据源与身份注册请求中的source字段信息对应的数据源不一致,则可以结束本次注册请求,并可以向消息提供方110返回失败消息,用于通知消息提供方本次注册失败。若查询获得的服务方数据源与身份注册请求中的source字段信息对应的数据源一致,则可以分配应用程序的身份标识,将该应用程序的身份标识与身份注册请求中的source字段信息对应的数据源进行关联后存储,并将该应用程序的身份标识发送给消息提供方110,由此消息提供方110完成了应用程序的身份标识在消息推送方120上的注册任务。
步骤408,消息推送方120将该分配的应用程序的身份标识发送给消息提供方110。
步骤409,消息提供方110将消息推送请求及待推送消息发送给消息推送方120。
具体地,消息提供方110完成上述身份注册任务后,可以将消息推送请求及待推送消息发送给消息推送方120。示例性的,该消息推送请求可以包括消息提供方110的身份标识、音乐应用131的身份标识及地图应用132的身份标识,该消息推送请求的形式可以是JWT的形式。
现结合图5进行说明,如图5所示,该JWT可以包括头部、载荷及签名。该JWT头部可以包括多个字段,示例性的,该JWT头部可以包括应用程序身份标识字段(sub)及消息提供方身份标识字段(aud),其中,该sub字段用于标识应用程序身份标识在载荷中的位置,该aud字段用于标识消息提供方身份标识在载荷中的位置。该载荷可以包括与字段信息对应的数据信息,示例性的,该数据信息可以包括与sub字段对应的应用程序身份标识信息(例如,音乐应用131的身份标识及地图应用132的身份标识)及与aud字段对应的消息提供方110的身份标识信息。
步骤410,消息推送方120读取消息推送请求,得到消息提供方110的身份标识、音乐应用131的身份标识及地图应用132的身份标识。
具体地,消息推送方120收到消息推送请求后,可以对该消息推送请求进行读取,由此可以得到消息推送请求中的应用程序身份标识(例如,音乐应用131的身份标识及地图应用132的身份标识)及消息提供方110的身份标识。
在具体实现时,消息提供方110可以将消息推送请求发送给消息推送方120的推送***121,因此,消息提供方110与推送***121之间还可以建立第二接口,用于传输上述消息推送请求;代码示例如下:
POST/token.oauth2 HTTP/1.1
Host:as.example.com
Content-Type:application/x-www-form-urlencoded
grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer-with-source
&assertion=eyJhbGciOiJFUzI1NiIsImtpZCI6IjE2In0.eyJpc3Mi[...omitted for brevity...].J9l-ZhwP[...omitted for brevity...]。
步骤411,消息推送方120根据该音乐应用131的身份标识、地图应用132的身份标识及消息提供方110的身份标识进行查询,得到与音乐应用131的身份标识对应的音乐数据源、与地图应用132的身份标识对应的地图数据源及与消息提供方110的身份标识对应的服务方数据源。
具体地,消息推送方120获取到消息推送请求中的消息提供方110的身份标识、音乐应用131的身份标识及地图应用132的身份标识后,可以通过查询获得与上述音乐应用131的身份标识及地图应用132的身份标识对应的应用数据源(例如,与音乐应用131的身份标识对应的音乐应用数据源及与地图应用132的身份标识对应的地图应用数据源),以及与消息提供方110的身份标识对应的服务方数据源。
在具体实现时,消息推送方120的推送***121通过读取得到音乐应用131的身份标识、地图应用132的身份标识及消息提供方110的身份标识后,可以将该音乐应用131的身份标识、地图应用132的身份标识及消息提供方110的身份标识发送给验证***122,验证***122收到上述音乐应用131的身份标识、地图应用132的身份标识及消息提供方110的身份标识后,可以在验证***122中的本地数据库中进行查询,可以分别得到与上述音乐应用131的身份标识、地图应用132的身份标识及消息提供方110的身份标识对应的音乐应用数据源、地图应用数据源及服务方数据源。
进一步地,当验证***122通过查询,如果音乐应用数据源、地图应用数据源及服务方数据源中至少有一个数据源不存在,则可以认为当前的音乐应用131的身份标识、地图应用132的身份标识及消息提供方110的身份标识中存在仿冒者,因此可以结束本次验证,并可以向推送***121返回验证失败消息,当推送***121收到上述验证失败消息后,可以停止本次消息推送任务,并可以向消息提供方110返回失败消息。
步骤412,消息推送方120将音乐应用数据源、地图应用数据源及服务方数据源进行比对。
具体地,上述数据源比对可以包括分别将音乐应用数据源及地图应用数据源与服务方数据源进行比对。在具体实现时,当消息推送方120的验证***122查询得到上述音乐应用数据源、地图应用数据源和服务方数据源后,可以分别将该音乐应用数据源、地图应用数据源与服务方数据源进行比对。示例性的,可以先将音乐应用数据源与服务方数据源进行比对,然后将地图应用数据源与服务方数据源进行比对;也可以先将地图应用数据源与服务方数据源进行比对,然后将音乐应用数据源与服务方数据源进行比对;也可以同时将音乐应用数据源与服务方数据源进行比对,以及将地图应用数据源与服务方数据源进行比对,本申请实施例对此不作特殊限定。
步骤413,若上述数据源比对均一致,则将消息提供方110发送的待推送消息推送给安装音乐应用131和/或地图应用132的消息接收方130。
具体地,若上述数据源比对均一致,则消息推送方120可以将消息提供方110发送的的待推送消息推送给安装音乐应用131和/或地图应用132的消息接收方130。示例性的,若音乐应用数据源与服务方数据源比对一致,且地图应用数据源与服务方数据源比对一致,则可以认为数据源比对均一致。
在具体实现时,在验证***122中对上述数据源进行比对,确定上述数据源均一致,例如,音乐应用数据源与服务方数据源一致,且地图应用数据源与服务方数据源一致,则可以认为本次验证成功,验证***122可以向推送***121发送验证成功消息;推送***121收到验证***122的验证成功消息后,则可以将本次接收到的待推送消息推送给安装音乐应用131和/或地图应用132的消息接收方130。
步骤414,若上述数据源比对中至少有一组数据源比对不一致,则结束本次消息推送任务,并可以向消息提供方110返回验证失败消息。
具体地,若上述数据源比对中至少有一组数据源比对不一致,则可以认为验证失败,消息推送方120可以结束本次消息推送任务。示例性的,若音乐应用数据源与服务方数据源比对不一致,和/或地图应用数据源与服务方数据源比对不一致,则可以认为数据源比对不一致。
在具体实现时,在验证***122中对上述数据源进行比对,确定上述数据源中至少有一组数据源比对不一致,例如,音乐应用数据源与服务方数据源不一致和/或地图应用数据源与服务方数据源不一致,则可以认为本次验证失败。验证***122可以向推送***121发送验证失败消息。若推送***121收到验证***122的验证失败消息,可以停止本次消息推送任务,并可以向消息提供方110返回验证失败消息。
本实施例中,通过在消息推送方120处根据消息推送请求中的数据源进行验证,以确定本次待推送消息对应的应用程序的数据源与消息提供方的数据源是否一致,并进一步可以确定待推送消息是否可以发送至与消息推送请求中应用程序身份标识对应的应用程序,由此可以避免消息串网,进而可以提高消息推送的安全性。
图6为本申请消息推送装置一个实施例的结构示意图,如图6所示,上述消息推送装置60可以包括:创建模块61、发送模块62、接收模块63、验证模块64及推送模块65;
创建模块61,用于创建应用程序身份标识与预设密钥之间的映射关系;
发送模块62,用于将映射关系发送至消息提供方;
接收模块63,用于接收消息提供方发送的待推送消息及消息推送请求,其中,消息推送请求包括第一信息及用于进行验证的第一摘要,第一摘要由消息提供方使用预设密钥对第一信息进行摘要提取后获得,第一信息至少包括应用程序身份标识;
验证模块64,用于查询是否存在与消息推送请求中的应用程序身份标识对应的预设密钥;若存在与应用程序身份标识对应的预设密钥,使用预设密钥对消息推送请求中的第一信息进行摘要提取,获得第二摘要;
推送模块65,用于将第二摘要与第一摘要进行比对,若比对一致,则将待推送消息推送至与应用程序身份标识对应的消息接收方。
在一种可能的实现方式中,上述消息推送装置60还可以包括:验签模块66;
验签模块66,用于根据签名对消息推送请求进行身份验证,以确定消息提供方的身份是否合法。
在一种可能的实现方式中,上述验证模块64还可以用于若不存在与应用程序身份标识对应的预设密钥,则终止本次待推送消息的推送。
在一种可能的实现方式中,第一信息包括多个应用程序身份标识,消息推送请求包括多个与应用程序身份标识对应的第一摘要,上述验证模块64还可以用于分别使用与应用程序身份标识对应的预设密钥对消息推送请求中的第一信息进行摘要提取,获得多个与应用程序身份标识对应的第二摘要。
在一种可能的实现方式中,上述推送模块65还可以用于分别将对应同一个应用程序身份标识的第一摘要和第二摘要进行比对;若所有应用程序身份标识的第一摘要和第二摘要比对一致,则将待推送消息推送至与应用程序身份标识对应的消息接收方。
图7为本申请消息推送装置另一个实施例的结构示意图,如图7所示,上述消息 推送装置70可以包括:接收模块71、验证模块72及推送模块73;
接收模块71,用于接收消息提供方发送的待推送消息及消息推送请求,其中,消息推送请求包括应用程序身份标识及消息提供方身份标识;
验证模块72,用于查询是否存在与消息推送请求中的应用程序身份标识对应的第一数据源及与消息推送请求中的消息提供方身份标识对应的第二数据源;
推送模块73,用于若存在第一数据源及第二数据源,则将第一数据源与第二数据源进行比对,若比对一致,则将待推送消息推送至与应用程序身份标识对应的消息接收方。
在一种可能的实现方式中,上述消息推送装置70还包括:注册模块74;
注册模块74,用于接收消息提供方发送的身份注册请求,其中,身份注册请求包括数据源及身份注册类型,身份注册类型包括第一类型及第二类型;若判断身份注册类型为第一类型,则数据源包括第一数据源,分配消息提供方身份标识,将消息提供方身份标识与第一数据源进行关联后存储,并将消息提供方身份标识发送给消息提供方;若判断身份注册类型为第二类型,则数据源包括第二数据源,分配应用程序身份标识,将应用程序身份标识与第二数据源进行关联后存储,并将应用程序身份标识发送给消息提供方。
在一种可能的实现方式中,若判断身份注册类型为第二类型,则身份注册请求还包括消息提供方身份标识,上述消息推送装置70还包括:核查模块75;
核查模块75,用于基于消息提供方身份标识进行查询,获得对应的第一数据源;将查询获得的第一数据源与身份注册请求中的第二数据源进行比对,基于比对结果确定是否分配应用程序身份标识。
在一种可能的实现方式中,消息推送请求包括多个应用程序身份标识,上述推送模块73还可以用于分别将每个与应用程序身份标识对应的第一数据源与第二数据源进行比对;若所有的第一数据源与第二数据源均一致,则将待推送消息推送至与应用程序身份标识对应的消息接收方。
应理解以上图6和图7所示的消息推送装置的各个模块的划分仅仅是一种逻辑功能的划分,实际实现时可以全部或部分集成到一个物理实体上,也可以物理上分开。且这些模块可以全部以软件通过处理元件调用的形式实现;也可以全部以硬件的形式实现;还可以部分模块以软件通过处理元件调用的形式实现,部分模块通过硬件的形式实现。例如,检测模块可以为单独设立的处理元件,也可以集成在电子设备的某一个芯片中实现。其它模块的实现与之类似。此外这些模块全部或部分可以集成在一起,也可以独立实现。在实现过程中,上述方法的各步骤或以上各个模块可以通过处理器元件中的硬件的集成逻辑电路或者软件形式的指令完成。
例如,以上这些模块可以是被配置成实施以上方法的一个或多个集成电路,例如:一个或多个特定集成电路(Application Specific Integrated Circuit;以下简称:ASIC),或,一个或多个微处理器(Digital Singnal Processor;以下简称:DSP),或,一个或者多个现场可编程门阵列(Field Programmable Gate Array;以下简称:FPGA)等。再如,这些模块可以集成在一起,以片上***(System-On-a-Chip;以下简称:SOC)的形式实现。
图8为本申请电子设备一个实施例的结构示意图,其中,消息推送方120可以是上述电子设备;如图8所示,上述电子设备可以是数据处理设备,例如,服务器,也可以是内置于上述数据处理设备的电路设备。该电子设备可以用于执行本申请图1-图5所示实施例提供的方法中的功能/步骤。
如图8所示,电子设备800以通用计算设备的形式表现。
上述电子设备可以包括:一个或多个处理器810;通信接口820;存储器830;连接不同***组件(包括存储器830和处理器810)的通信总线840,数据库850;以及一个或多个计算机程序。
其中,上述一个或多个计算机程序被存储在上述存储器中,上述一个或多个计算机程序包括指令,当上述指令被上述电子设备执行时,使得上述电子设备执行以下步骤:
创建应用程序身份标识与预设密钥之间的映射关系;
将映射关系发送至消息提供方;
接收消息提供方发送的待推送消息及消息推送请求,其中,消息推送请求包括第一信息及用于进行验证的第一摘要,第一摘要由消息提供方使用预设密钥对第一信息进行摘要提取后获得,第一信息至少包括应用程序身份标识;
查询是否存在与消息推送请求中的应用程序身份标识对应的预设密钥;
若存在与应用程序身份标识对应的预设密钥,使用预设密钥对消息推送请求中的第一信息进行摘要提取,获得第二摘要;
将第二摘要与第一摘要进行比对,若比对一致,则将待推送消息推送至与应用程序身份标识对应的消息接收方。
其中一种可能的实现方式中,上述消息推送请求还包括消息提供方的签名,上述指令被上述电子设备执行时,使得上述电子设备执行将第二摘要与第一摘要进行比对之前,还执行以下步骤:
根据签名对消息提供方进行身份验证,以确定消息提供方的身份是否合法。
其中一种可能的实现方式中,上述指令被上述电子设备执行时,使得上述电子设备还执行以下步骤:
若不存在与应用程序身份标识对应的预设密钥,则终止本次待推送消息的推送。
其中一种可能的实现方式中,第一信息包括多个应用程序身份标识,消息推送请求包括多个与应用程序身份标识对应的第一摘要,上述指令被上述电子设备执行时,使得上述电子设备执行使用预设密钥对消息推送请求中的第一信息进行摘要提取,获得第二摘要的步骤包括:
分别使用与应用程序身份标识对应的预设密钥对消息推送请求中的第一信息进行摘要提取,获得多个与应用程序身份标识对应的第二摘要。
其中一种可能的实现方式中,上述指令被上述电子设备执行时,使得上述电子设备执行将第二摘要与第一摘要进行比对,若比对一致,则将待推送消息推送至与应用程序身份标识对应的消息接收方的步骤包括:
分别将对应同一个应用程序身份标识的第一摘要和第二摘要进行比对;
若所有应用程序身份标识的第一摘要和第二摘要比对一致,则将待推送消息推送 至与应用程序身份标识对应的消息接收方。
本申请实施例还提供一种电子设备,如图8所示,其中,上述一个或多个计算机程序被存储在上述存储器中,上述一个或多个计算机程序包括指令,当上述指令被上述电子设备执行时,使得上述电子设备执行以下步骤:
接收消息提供方发送的待推送消息及消息推送请求,其中,消息推送请求包括应用程序身份标识及消息提供方身份标识;
查询是否存在与消息推送请求中的应用程序身份标识对应的第一数据源及与消息推送请求中的消息提供方身份标识对应的第二数据源;
若存在第一数据源及第二数据源,则将第一数据源与第二数据源进行比对,若比对一致,则将待推送消息推送至与应用程序身份标识对应的消息接收方。
其中一种可能的实现方式中,上述指令被上述电子设备执行时,使得上述电子设备执行接收消息提供方发送的待推送消息及消息推送请求的步骤之前,还执行以下步骤:
接收消息提供方发送的身份注册请求,其中,身份注册请求包括数据源及身份注册类型,身份注册类型包括第一类型及第二类型;
若判断身份注册类型为第一类型,则数据源包括第一数据源,分配消息提供方身份标识,将消息提供方身份标识与第一数据源进行关联后存储,并将消息提供方身份标识发送给消息提供方;
若判断身份注册类型为第二类型,则数据源包括第二数据源,分配应用程序身份标识,将应用程序身份标识与第二数据源进行关联后存储,并将应用程序身份标识发送给消息提供方。
其中一种可能的实现方式中,若判断身份注册类型为第二类型,则身份注册请求还包括消息提供方身份标识,上述指令被上述电子设备执行时,使得上述电子设备还执行以下步骤:
基于消息提供方身份标识进行查询,获得对应的第一数据源;
将查询获得的第一数据源与身份注册请求中的第二数据源进行比对,基于比对结果确定是否分配应用程序身份标识。
其中一种可能的实现方式中,消息推送请求包括多个应用程序身份标识,上述指令被上述电子设备执行时,使得上述电子设备执行将第一数据源与第二数据源进行比对,若比对一致,则将待推送消息推送至与应用程序身份标识对应的消息接收方的步骤包括:
分别将每个与应用程序身份标识对应的第一数据源与第二数据源进行比对;
若所有的第一数据源与第二数据源均一致,则将待推送消息推送至与应用程序身份标识对应的消息接收方。
本申请实施例还提供一种计算机可读存储介质,该计算机可读存储介质中存储有计算机程序,当其在计算机上运行时,使得计算机执行本申请图1-图5所示实施例提供的方法。
本申请实施例可以根据上述方法示例对上述设备等进行功能模块的划分,例如, 可以对应各个功能划分各个功能模块,也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现,也可以采用软件功能模块的形式实现。需要说明的是,本发明实施例中对模块的划分是示意性的,仅仅为一种逻辑功能划分,实际实现时可以有另外的划分方式。
通过以上的实施方式的描述,所属领域的技术人员可以清楚地了解到,为描述的方便和简洁,仅以上述各功能模块的划分进行举例说明,实际应用中,可以根据需要而将上述功能分配由不同的功能模块完成,即将装置的内部结构划分成不同的功能模块,以完成以上描述的全部或者部分功能。上述描述的***,装置和单元的具体工作过程,可以参考前述方法实施例中的对应过程,在此不再赘述。
在本申请实施例各个实施例中的各功能单元可以集成在一个处理单元中,也可以是各个单元单独物理存在,也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现,也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时,可以存储在一个计算机可读取存储介质中。基于这样的理解,本申请实施例的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来,该计算机软件产品存储在一个存储介质中,包括若干指令用以使得一台计算机设备(可以是个人计算机,服务器,或者网络设备等)或处理器执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括:快闪存储器、移动硬盘、只读存储器、随机存取存储器、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述,仅为本申请的具体实施方式,但本申请的保护范围并不局限于此,任何在本申请揭露的技术范围内的变化或替换,都应涵盖在本申请的保护范围之内。因此,本申请的保护范围应以所述权利要求的保护范围为准。
Claims (20)
- 一种消息推送方法,其特征在于,包括:创建应用程序身份标识与预设密钥之间的映射关系;将所述映射关系发送至消息提供方;接收所述消息提供方发送的待推送消息及消息推送请求,其中,所述消息推送请求包括第一信息及用于进行验证的第一摘要,所述第一摘要由所述消息提供方使用所述预设密钥对所述第一信息进行摘要提取后获得,所述第一信息至少包括所述应用程序身份标识;查询是否存在与所述消息推送请求中的应用程序身份标识对应的预设密钥;若存在与所述应用程序身份标识对应的预设密钥,使用所述预设密钥对所述消息推送请求中的第一信息进行摘要提取,获得第二摘要;将所述第二摘要与所述第一摘要进行比对,若比对一致,则将所述待推送消息推送至与所述应用程序身份标识对应的消息接收方。
- 根据权利要求1所述的方法,其特征在于,所述消息推送请求还包括所述消息提供方的签名,所述将所述第二摘要与所述第一摘要进行比对之前,还包括:根据所述签名对所述消息提供方进行身份验证,以确定所述消息提供方的身份是否合法。
- 根据权利要求1所述的方法,其特征在于,所述方法还包括:若不存在与所述应用程序身份标识对应的预设密钥,则终止本次待推送消息的推送。
- 根据权利要求1所述的方法,其特征在于,所述第一信息包括多个所述应用程序身份标识,所述消息推送请求包括多个与所述应用程序身份标识对应的第一摘要,所述使用所述预设密钥对所述消息推送请求中的第一信息进行摘要提取,获得第二摘要包括:分别使用与所述应用程序身份标识对应的预设密钥对所述消息推送请求中的第一信息进行摘要提取,获得多个与所述应用程序身份标识对应的第二摘要。
- 根据权利要求4所述的方法,其特征在于,所述将所述第二摘要与所述第一摘要进行比对,若比对一致,则将所述待推送消息推送至与所述应用程序身份标识对应的消息接收方包括:分别将对应同一个应用程序身份标识的第一摘要和第二摘要进行比对;若所有应用程序身份标识的第一摘要和第二摘要比对一致,则将所述待推送消息推送至与所述应用程序身份标识对应的消息接收方。
- 一种消息推送方法,其特征在于,包括:接收消息提供方发送的待推送消息及消息推送请求,其中,所述消息推送请求包括应用程序身份标识及消息提供方身份标识;查询是否存在与所述消息推送请求中的应用程序身份标识对应的第一数据源及与所述消息推送请求中的消息提供方身份标识对应的第二数据源;若存在所述第一数据源及所述第二数据源,则将所述第一数据源与所述第二数据源进行比对,若比对一致,则将所述待推送消息推送至与所述应用程序身份标识对应 的消息接收方。
- 根据权利要求6所述的方法,其特征在于,所述接收消息提供方发送的待推送消息及消息推送请求之前,还包括:接收所述消息提供方发送的身份注册请求,其中,所述身份注册请求包括数据源及身份注册类型,所述身份注册类型包括第一类型及第二类型;若判断所述身份注册类型为所述第一类型,则所述数据源包括第一数据源,分配消息提供方身份标识,将所述消息提供方身份标识与所述第一数据源进行关联后存储,并将所述消息提供方身份标识发送给所述消息提供方;若判断所述身份注册类型为所述第二类型,则所述数据源包括第二数据源,分配应用程序身份标识,将所述应用程序身份标识与所述第二数据源进行关联后存储,并将所述应用程序身份标识发送给所述消息提供方。
- 根据权利要求7所述的方法,其特征在于,若判断所述身份注册类型为所述第二类型,则所述身份注册请求还包括消息提供方身份标识,所述方法还包括:基于所述消息提供方身份标识进行查询,获得对应的第一数据源;将所述查询获得的第一数据源与所述身份注册请求中的第二数据源进行比对,基于比对结果确定是否分配应用程序身份标识。
- 根据权利要求6所述的方法,其特征在于,所述消息推送请求包括多个应用程序身份标识,所述将所述第一数据源与所述第二数据源进行比对,若比对一致,则将所述待推送消息推送至与所述应用程序身份标识对应的消息接收方包括:分别将每个与所述应用程序身份标识对应的第一数据源与所述第二数据源进行比对;若所有的第一数据源与所述第二数据源均一致,则将所述待推送消息推送至与所述应用程序身份标识对应的消息接收方。
- 一种电子设备,其特征在于,包括:处理器和存储器,所述存储器用于存储计算机程序代码,所述计算机程序代码包括指令,当所述处理器从所述存储器中读取所述指令时,以使得所述电子设备执行以下步骤:创建应用程序身份标识与预设密钥之间的映射关系;将所述映射关系发送至消息提供方;接收所述消息提供方发送的待推送消息及消息推送请求,其中,所述消息推送请求包括第一信息及用于进行验证的第一摘要,所述第一摘要由所述消息提供方使用所述预设密钥对所述第一信息进行摘要提取后获得,所述第一信息至少包括所述应用程序身份标识;查询是否存在与所述消息推送请求中的应用程序身份标识对应的预设密钥;若存在与所述应用程序身份标识对应的预设密钥,使用所述预设密钥对所述消息推送请求中的第一信息进行摘要提取,获得第二摘要;将所述第二摘要与所述第一摘要进行比对,若比对一致,则将所述待推送消息推送至与所述应用程序身份标识对应的消息接收方。
- 根据权利要求10所述的电子设备,其特征在于,所述消息推送请求还包括所述消息提供方的签名,所述指令被所述电子设备执行时,使得所述电子设备执行将所 述第二摘要与所述第一摘要进行比对之前,还执行以下步骤:根据所述签名对所述消息提供方进行身份验证,以确定所述消息提供方的身份是否合法。
- 根据权利要求10所述的电子设备,其特征在于,所述指令被所述电子设备执行时,使得所述电子设备还执行以下步骤:若不存在与所述应用程序身份标识对应的预设密钥,则终止本次待推送消息的推送。
- 根据权利要求10所述的设电子备,其特征在于,第一信息包括多个所述应用程序身份标识,所述消息推送请求包括多个与所述应用程序身份标识对应的第一摘要,所述指令被所述电子设备执行时,使得所述电子设备执行使用所述预设密钥对所述消息推送请求中的第一信息进行摘要提取,获得第二摘要的步骤包括:分别使用与所述应用程序身份标识对应的预设密钥对所述消息推送请求中的第一信息进行摘要提取,获得多个与所述应用程序身份标识对应的第二摘要。
- 根据权利要求13所述的电子设备,其特征在于,所述指令被所述电子设备执行时,使得所述电子设备执行将所述第二摘要与所述第一摘要进行比对,若比对一致,则将所述待推送消息推送至与所述应用程序身份标识对应的消息接收方的步骤包括:分别将对应同一个应用程序身份标识的第一摘要和第二摘要进行比对;若所有应用程序身份标识的第一摘要和第二摘要比对一致,则将所述待推送消息推送至与所述应用程序身份标识对应的消息接收方。
- 一种电子设备,其特征在于,包括:处理器和存储器,所述存储器用于存储计算机程序代码,所述计算机程序代码包括指令,当所述处理器从所述存储器中读取所述指令时,以使得所述电子设备执行以下步骤:接收消息提供方发送的待推送消息及消息推送请求,其中,所述消息推送请求包括应用程序身份标识及消息提供方身份标识;查询是否存在与所述消息推送请求中的应用程序身份标识对应的第一数据源及与所述消息推送请求中的消息提供方身份标识对应的第二数据源;若存在所述第一数据源及所述第二数据源,则将所述第一数据源与所述第二数据源进行比对,若比对一致,则将所述待推送消息推送至与所述应用程序身份标识对应的消息接收方。
- 根据权利要求15所述的电子设备,其特征在于,所述指令被所述电子设备执行时,使得所述电子设备执行接收消息提供方发送的待推送消息及消息推送请求之前,还执行以下步骤:接收所述消息提供方发送的身份注册请求,其中,所述身份注册请求包括数据源及身份注册类型,所述身份注册类型包括第一类型及第二类型;若判断所述身份注册类型为所述第一类型,则所述数据源包括第一数据源,分配消息提供方身份标识,将所述消息提供方身份标识与所述第一数据源进行关联后存储,并将所述消息提供方身份标识发送给所述消息提供方;若判断所述身份注册类型为所述第二类型,则所述数据源包括第二数据源,分配应用程序身份标识,将所述应用程序身份标识与所述第二数据源进行关联后存储,并 将所述应用程序身份标识发送给所述消息提供方。
- 根据权利要求16所述的电子设备,其特征在于,若判断所述身份注册类型为所述第二类型,则所述身份注册请求还包括消息提供方身份标识,所述指令被所述电子设备执行时,使得所述电子设备还执行以下步骤:基于所述消息提供方身份标识进行查询,获得对应的第一数据源;将所述查询获得的第一数据源与所述身份注册请求中的第二数据源进行比对,基于比对结果确定是否分配应用程序身份标识。
- 根据权利要求15所述的电子设备,其特征在于,所述消息推送请求包括多个应用程序身份标识,所述指令被所述电子设备执行时,使得所述电子设备执行将所述第一数据源与所述第二数据源进行比对,若比对一致,则将所述待推送消息推送至与所述应用程序身份标识对应的消息接收方的步骤包括:分别将每个与所述应用程序身份标识对应的第一数据源与所述第二数据源进行比对;若所有的第一数据源与所述第二数据源均一致,则将所述待推送消息推送至与所述应用程序身份标识对应的消息接收方。
- 一种计算机可读存储介质,其特征在于,包括计算机指令,当所述计算机指令在所述设备上运行时,使得所述设备机执行如权利要求1-9中任一项所述消息推送的方法。
- 一种计算机程序产品,其特征在于,当所述计算机程序产品在计算机上运行时,使得所述计算机执行如权利要求1-9中任一项所述消息推送的方法。
Priority Applications (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US18/028,040 US20230344644A1 (en) | 2020-09-24 | 2021-08-04 | Message Push Method, Electronic Device, and Storage Medium |
EP21871065.5A EP4203438A4 (en) | 2020-09-24 | 2021-08-04 | MESSAGE ISSUE METHOD AND ELECTRONIC DEVICE AND STORAGE MEDIUM |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202011013923.2A CN114338788B (zh) | 2020-09-24 | 2020-09-24 | 消息推送方法、电子设备及存储介质 |
CN202011013923.2 | 2020-09-24 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2022062688A1 true WO2022062688A1 (zh) | 2022-03-31 |
Family
ID=80844824
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/CN2021/110461 WO2022062688A1 (zh) | 2020-09-24 | 2021-08-04 | 消息推送方法、电子设备及存储介质 |
Country Status (4)
Country | Link |
---|---|
US (1) | US20230344644A1 (zh) |
EP (1) | EP4203438A4 (zh) |
CN (1) | CN114338788B (zh) |
WO (1) | WO2022062688A1 (zh) |
Families Citing this family (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN115454671A (zh) * | 2022-09-07 | 2022-12-09 | 中国建设银行股份有限公司 | 消息处理方法、装置、设备及存储介质 |
Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN102006567A (zh) * | 2010-11-15 | 2011-04-06 | 中国联合网络通信集团有限公司 | 推消息处理方法、用于实现推消息处理方法的***及设备 |
CN104767746A (zh) * | 2015-03-26 | 2015-07-08 | 上海大唐移动通信设备有限公司 | 推送消息接收方法、消息推送方法、客户端及服务器 |
CN106385491A (zh) * | 2016-09-05 | 2017-02-08 | 努比亚技术有限公司 | 一种控制推送消息的***、方法、移动终端和推送服务器 |
US10187486B1 (en) * | 2016-03-17 | 2019-01-22 | Google Llc | Systems and methods for automatic extension of information from a first network to a second network |
Family Cites Families (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN105141763A (zh) * | 2015-08-11 | 2015-12-09 | 北京思特奇信息技术股份有限公司 | 一种通过智能手机app进行消息群发的方法及*** |
CN109286646B (zh) * | 2017-07-21 | 2022-04-05 | 阿里巴巴集团控股有限公司 | 消息推送方法、装置及*** |
KR102398502B1 (ko) * | 2017-09-14 | 2022-05-17 | 삼성전자주식회사 | 메시지를 처리하기 위한 전자 장치 및 그의 동작 방법 |
KR101861507B1 (ko) * | 2018-02-05 | 2018-05-25 | 구중완 | 푸시 메시지의 수신 확인 방법 및 장치 |
CN109657152B (zh) * | 2018-12-27 | 2021-02-19 | 北京顺丰同城科技有限公司 | 推送消息发送方法、装置、电子设备及可读存储介质 |
-
2020
- 2020-09-24 CN CN202011013923.2A patent/CN114338788B/zh active Active
-
2021
- 2021-08-04 WO PCT/CN2021/110461 patent/WO2022062688A1/zh unknown
- 2021-08-04 EP EP21871065.5A patent/EP4203438A4/en active Pending
- 2021-08-04 US US18/028,040 patent/US20230344644A1/en active Pending
Patent Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN102006567A (zh) * | 2010-11-15 | 2011-04-06 | 中国联合网络通信集团有限公司 | 推消息处理方法、用于实现推消息处理方法的***及设备 |
CN104767746A (zh) * | 2015-03-26 | 2015-07-08 | 上海大唐移动通信设备有限公司 | 推送消息接收方法、消息推送方法、客户端及服务器 |
US10187486B1 (en) * | 2016-03-17 | 2019-01-22 | Google Llc | Systems and methods for automatic extension of information from a first network to a second network |
CN106385491A (zh) * | 2016-09-05 | 2017-02-08 | 努比亚技术有限公司 | 一种控制推送消息的***、方法、移动终端和推送服务器 |
Non-Patent Citations (1)
Title |
---|
See also references of EP4203438A4 |
Also Published As
Publication number | Publication date |
---|---|
EP4203438A4 (en) | 2023-09-06 |
US20230344644A1 (en) | 2023-10-26 |
EP4203438A1 (en) | 2023-06-28 |
CN114338788A (zh) | 2022-04-12 |
CN114338788B (zh) | 2024-03-15 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US10642969B2 (en) | Automating internet of things security provisioning | |
CN108200050B (zh) | 单点登录服务器、方法及计算机可读存储介质 | |
US9430302B2 (en) | Method, device and system for using and invoking Oauth API | |
JP5658745B2 (ja) | Httpベースの認証 | |
US8973118B2 (en) | Token based security protocol for managing access to web services | |
CN110798466B (zh) | 一种虚拟机场景下软件license的验证方法及*** | |
US20140006781A1 (en) | Encapsulating the complexity of cryptographic authentication in black-boxes | |
CN102904865B (zh) | 一种基于移动终端的多个数字证书的管理方法、***和设备 | |
WO2013056674A1 (zh) | 第三方应用的集中式安全管理方法和***及相应通信*** | |
CN106105154B (zh) | 数据上载的方法、装置及*** | |
CN110958119A (zh) | 身份验证方法和装置 | |
TWI632798B (zh) | 伺服器、行動終端機、網路實名認證系統及方法 | |
US11218464B2 (en) | Information registration and authentication method and device | |
CN110943840B (zh) | 一种签名验证方法 | |
CN114157434A (zh) | 登录验证方法、装置、电子设备及存储介质 | |
WO2022062688A1 (zh) | 消息推送方法、电子设备及存储介质 | |
CN105577606B (zh) | 一种实现认证器注册的方法和装置 | |
CN103559430B (zh) | 基于安卓***的应用账号管理方法和装置 | |
WO2023160299A1 (zh) | 一种设备物理身份认证方法、***、装置及第一平台 | |
CN114579951A (zh) | 业务访问方法、电子设备及存储介质 | |
WO2015096483A1 (zh) | 一种终端应用的注册方法、装置和*** | |
CN109460647B (zh) | 一种多设备安全登录的方法 | |
CN114826719B (zh) | 基于区块链的可信终端认证方法、***、设备和存储介质 | |
CN115766056A (zh) | 接口安全防护的处理方法及装置 | |
CN113536367B (zh) | 一种注册方法、隐私服务器、业务信息服务器及注册*** |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
ENP | Entry into the national phase |
Ref document number: 2021871065 Country of ref document: EP Effective date: 20230324 |
|
NENP | Non-entry into the national phase |
Ref country code: DE |