一种网盘认证协议的分析与验证

发布时间：2019-06-12 06:11

【摘要】：现今,各大网盘服务商都为开发者提供OAuth协议的接口,第三方应用可以利用官方提供的API方便地访问用户的资源。但在嵌入式环境下,要想利用有限的硬件资源支Web持完整的Web浏览器比较困难,需要支持的文件类型以及协议都比较庞大,故提出一种利用较小资源实现OAuth协议与网盘进行交互的方案。首先在Android平台上使用新浪微盘提供的API实现了具有上传下载微盘文件功能的应用程序,并使用Burp Suite抓取HTTPS数据包的功能,获取了用户授权Android应用程序访问新浪微盘的认证过程及应用程序上传下载文件过程的流量。其次,通过抓取的数据包分析其详细的认证流程,以及上传下载文件的流程。最后,利用C语言在Linux环境下验证其认证协议,取得token并实现上传下载文件以及获取文件列表的功能。
[Abstract]:Nowadays, the major network disk service providers provide developers with the interface of OAuth protocol, and third-party applications can easily access users' resources by using the official API. However, in embedded environment, it is difficult to use limited hardware resources to support Web to hold a complete Web browser, and the file types and protocols that need to be supported are relatively large. Therefore, a scheme of using smaller resources to realize the interaction between OAuth protocol and disk is proposed. Firstly, the application program with the function of uploading and downloading microdisk files is realized by using API provided by Sina microdisk on Android platform, and the function of crawling HTTPS packets with Burp Suite is used to obtain the authentication process of user authorized Android application to access Sina microdisk and the flow of the application program to upload and download files. Secondly, the detailed authentication process and the process of uploading and downloading files are analyzed by crawling packets. Finally, C language is used to verify its authentication protocol in Linux environment, token is obtained and the function of uploading and downloading files and obtaining file list is realized.
【作者单位】：北京理工大学计算机学院;
【基金】：国家自然科学基金资助项目(61370063)
【分类号】：TP309;TP333

【参考文献】