AIOT云云推送鉴权

 [{\"domain\":\"clean_bot\",\"intent\":\"start_clean\",\"slots\":{\"location\":[{\"slot_type\":\"STRING\",\"text\":\"卧室\",\"value\":\"卧室\"}]}}]

{
  "memberId": 123456789, // 用户ID
}

{
    "flag": 0, // 0: 正常播报(默认)，1：tts 不进行播报(content字段内容不生效)
    "content":"tts text" // 用于tts播报的内容, 如果content为空，则会用百度侧的content进行播报
}

{
  "mediaPlay": 0 // 0: 正常播报(默认),1：不进行播报
}

 "custom": "
   {\"otherKey1\":\"otherValue1\",\"otherKey2\":\"otherValue2\"}
". //整个内容是 string，百度透传结果，客户进行端云协同

{
   
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.security.NoSuchAlgorithmException;
import java.util.Base64;

import java.security.InvalidKeyException;


/**
 * 验签工具类. 验证签名是否正确
 * 实现方需要实现以下策略
 * <p>
 * 1.时间有效性判断(建议上下5分钟之内认为有效)
 * 2.防重攻击.
 * 3.签名有效性判断
 **/
public class CloudSignature {


    /**
     * ak参数.
     */
    public static final String ACCESS_KEY = "QRtM5Mqc3Knn6duZd9xTjjfbSSlIDwln";

    /**
     * sk参数.由双方云共同拥有. 不进行网络传输.请严格保密.
     */
    public static final String SECRET_KEY = "dEtj0KZebuj6gadtg5zNdVmXBWryNUmDzbFOM7fqcKzT3Excx8lyIgsyOUPceB5nS3NlJ5LJ9TqsElx8KyC8UD3izVL0eGw5tCm44YxuV8SDPfhms5X862PtnG6MPDlf";


    /**
     * 验证签名
     *
     * @param timestamp   系统时间戳-毫秒
     * @param signature   签名
     * @param requestBody 请求内容.HTTP请求和HTTPS请求里的最原始的Body String 字符串
     * @return 是否合法
     */
    public static boolean authenticateRequest(String timestamp, String signature, String requestBody) {

        // 时间戳判断-时间有效性判断(建议上下5分钟之内认为有效)
        long now = System.currentTimeMillis();
        long currentTime = Long.parseLong(timestamp);
        // 绝对值小于5分钟之内认为有效
        long timeDiff = Math.abs(now - currentTime);
        System.out.println(timeDiff);
        if (timeDiff > 5 * 50 * 1000) {
            return false; // 时间不在5分钟之内认为无效
        }

        // 防重判断. 这里暂时不实现
        // 可以利用 requestBody 里的 logId 作为防重key


        // 签名校验
        String calculatedSignature = calculateSignature(timestamp, ACCESS_KEY, requestBody); // 根据具体算法计算请求签名
        // 如果请求签名不匹配，说明请求未经授权，拒绝鉴权
        return calculatedSignature == null || calculatedSignature.equals(signature);

        // 鉴权通过
    }

    /**
     * 计算签名
     *
     * @param timestamp   时间戳
     * @param accessKey   ak
     * @param requestBody 请求内容.是HTTP请求和HTTPS请求里的最原始的Body String 字符串
     * @return 签名
     */
    public static String calculateSignature(String timestamp, String accessKey, String requestBody) {
        try {
            // 使用HMAC-SHA256算法进行签名计算
            Mac mac = Mac.getInstance("HmacSHA256");
            SecretKeySpec secretKeySpec = new SecretKeySpec(SECRET_KEY.getBytes(StandardCharsets.UTF_8), "HmacSHA256");
            mac.init(secretKeySpec);
            String toBeSigned = accessKey + timestamp + requestBody; // 将请求内容body加入签名计算
            byte[] signatureBytes = mac.doFinal(toBeSigned.getBytes(StandardCharsets.UTF_8));
            // 将签名结果进行Base64编码
            return Base64.getEncoder().encodeToString(signatureBytes);
        } catch (NoSuchAlgorithmException | InvalidKeyException e) {
            e.printStackTrace();
            return null;
        }
    }

}
}

import org.junit.Assert;
import org.junit.Test;

public class CloudSignatureTest {

    @Test
    public void normalTest() {
        // 示例使用：
        String timestamp = System.currentTimeMillis() + ""; // 获取当前时间戳
        String accessKey = CloudSignature.ACCESS_KEY; // 替换为实际的Access Key
        String requestBody = "{\"logId\":\"123\",\"device\":{\"fc\":\"fc\",\"pk\":\"pk\",\"ak\":\"000000000019\"},\"query\":\"测试query\",\"nluInfos\":\"[{\\\"domain\\\":\\\"unknown\\\",\\\"intent\\\":\\\"unknown\\\",\\\"slots\\\":{}}]\"}"; // 替换为实际的请求内容body
        String signature = CloudSignature.calculateSignature(timestamp, accessKey, requestBody); // 计算请求签名
        // 将timestamp、accessKey、requestBody和signature kJcAI4FSIFvL6nY7uhjQ6A4THy+0sPLKd6LLcR90Ozk=
        System.out.println(signature);
        Assert.assertTrue(CloudSignature.authenticateRequest(timestamp, signature, requestBody));
    }


    @Test
    public void fakerSignatureTest() {
        // 示例使用：
        String timestamp = System.currentTimeMillis() + ""; // 获取当前时间戳

        String requestBody = "{\"logId\":\"123\",\"device\":{\"fc\":\"fc\",\"pk\":\"pk\",\"ak\":\"000000000019\"},\"query\":\"测试query\",\"nluInfos\":\"[{\\\"domain\\\":\\\"unknown\\\",\\\"intent\\\":\\\"unknown\\\",\\\"slots\\\":{}}]\"}"; // 替换为实际的请求内容body

        // 异常的ak
        String signature = CloudSignature.calculateSignature(timestamp, "faker_access_key", requestBody); // 计算请求签名
        // 将timestamp、accessKey、requestBody和signature kJcAI4FSIFvL6nY7uhjQ6A4THy+0sPLKd6LLcR90Ozk=
        System.out.println(signature);
        Assert.assertFalse(CloudSignature.authenticateRequest(timestamp, signature, requestBody));
    }


    @Test
    public void InvalidTimestampSignatureTest() {
        // 示例使用：
        String timestamp = (System.currentTimeMillis() + (60 * 1000 * 20)) + ""; // 获取当前时间戳
        String accessKey = CloudSignature.ACCESS_KEY; // 替换为实际的Access Key
        String requestBody = "{\"logId\":\"123\",\"device\":{\"fc\":\"fc\",\"pk\":\"pk\",\"ak\":\"000000000019\"},\"query\":\"测试query\",\"nluInfos\":\"[{\\\"domain\\\":\\\"unknown\\\",\\\"intent\\\":\\\"unknown\\\",\\\"slots\\\":{}}]\"}"; // 替换为实际的请求内容body
        String signature = CloudSignature.calculateSignature(timestamp, accessKey, requestBody); // 计算请求签名
        // 将timestamp、accessKey、requestBody和signature kJcAI4FSIFvL6nY7uhjQ6A4THy+0sPLKd6LLcR90Ozk=
        System.out.println(signature);
        Assert.assertFalse(CloudSignature.authenticateRequest(timestamp, signature, requestBody));
    }

}