平安云|Ping An Cloud- Building Your Smart Future

Ping An Cloud can only verify your identity when a signature is sent with your HTTP request.

In terms of verification, the API mainly verifies whether the URL you request has been tampered with during transmission.

If the signature verification is passed, it is considered that the request has not been tampered with. The request is then forwarded to specific back-end services.
If the signature verification fails, it is considered that the request is insecure due to some reasons. For example, the URL requested by the user has been tampered with, or the request has expired. In such cases, back-end services are unavailable.

After you register a master account or create a sub-account, Ping An Cloud generates a pair of AccessKeys for you. A pair of AccessKeys consist of an AccessKeyId and an AccessKeySecret.

The AccessKeyId corresponds to the details of only one user in the backend.
The AccessKeySecret is used to sign requests. Make sure you keep the AccessKeySecret secret in a strict manner to prevent it from being stolen and used to impersonate you to sign requests.

Signature Steps

Constructing a canonical query string.

1. Sort the parameter names in ascending alphabetical order.

The sorting parameters include action parameters, public parameters, and business request parameters required to call the API. URL encode the name and value of each request parameter using the UTF-8 character set. In the encoded string, replace ‘+’ with ‘% 20’, ‘*’ with ‘% 2A’, ‘% 7E’ with ‘~’, and ‘:’ with ‘% 3A’. The corresponding java code is:

String encodedParamValue = URLEncoder.encode(paramValue, "UTF-8")
      .replace("+", "%20")
      .replace("*", "%2A")
      .replace("%7E", "~")
      .replace(":", "%3A");

2. Convert the parameter names (paramName) to lowercase. Convert the encoded parameter values (encodedParamValue) to lowercase. Sort the lowercase parameter names (paramName) in ascending order of characters. Concatenate these strings to generate the string to sign (stringToSign).

3. Calculate the HMAC signature using the string to sign (stringToSign). Note: The key used to calculate the signature is the AccessKeySecret. The hash algorithm used is SHA1, i.e. HmacSHA1 (stringToSign). Then encode the above HMAC value into a Base64 string to get the signature. Add the signature value to the request parameters as the signature parameter to finish the signing of the request.

4. Append all request parameters including the signature parameter to get a canonical query string. Submit the string to the server-side KMS for the API request.

Example (take Enablekey as an example):

If the value of the paramsString is:

accessKeyId=testId&action=EnableKey&keyId=keyId
      &signatureMethod=HMAC-SHA1&signatureNonce=1542333462075&signatureVersion=1.0
      ×tamp=1542333462075&version=2017-01-01

Then the value of the stringToSign is:

accesskeyid=testid&action=enablekey&keyid=keyid
      &signaturemethod=hmac-sha1&signaturenonce=1542333462075&signatureversion=1.0
      ×tamp=1542333462075&version=2017-01-01

If the AccessKeySecret paired with the AccessKeyId you use is testsecret, the calculated signature value is: caPjvsMXfd6oglEkahdq4Jo0yVA =

The request URL after signing is (note that the signature parameter is added):

https://kms-cn-shanghai.yun.pingan.com/?action=EnableKey
      &keyId=
      ×tamp=
      &signatureMethod=HMAC-SHA1
      &signatureNonce=
      &accessKeyId=
      &signatureVersion=1.0
      &signature=
      &version=2017-01-01

Did the above content solve your problem? Yes No