加密方法有很多，以下是其中一种简单的签名模式
1、首先客户端通过webapi按照IP地址，时间戳，随机数生成签名，并传递序列号
private Result_Sign Valid()
{
string ServerIP = "192.168.1.6";// HttpContext.Request.ServerVariables.Get("Local_Addr").ToString(); //地址
string timestamp = DateTimeToStamp(DateTime.Now); //时间戳
string nonce = ST.WEB.App_Start.Common.CreateValidateCode(6);//随机数
string SignStr = SignatureString(ServerIP, timestamp, nonce);//生成签名
string appseq = ConfigurationManager.AppSettings["DPSeq"]; //产品序列号
string Url = string.Format("http://www.abc.com:89/api/Valid?signature={0}×tamp={1}&nonce={2}&appseq={3}", SignStr, timestamp, nonce, appseq);//POST发送URL
string resStr = ST.WEB.App_Start.Common.Get_Http(Url, 12000);
Result_Sign resJson = new Result_Sign()
{
code = "-1",
message = ""
};
if (resStr.Substring(0, 2) != "错误")
{
resJson = JsonConvert.DeserializeObject<Result_Sign>(resStr);
}
return resJson;
}
// DateTime时间格式转换为Unix时间戳格式
private string DateTimeToStamp(DateTime time)
{
System.DateTime startTime = TimeZone.CurrentTimeZone.ToLocalTime(new System.DateTime(1970, 1, 1));
return ((int)(time - startTime).TotalSeconds).ToString();
}
//生成签名串
private string SignatureString(string appIP, string timestamp, string nonce)
{
string[] ArrTmp = { appIP, timestamp, nonce };
Array.Sort(ArrTmp);
string tmpStr = string.Join("", ArrTmp);
tmpStr = FormsAuthentication.HashPasswordForStoringInConfigFile(tmpStr, "SHA1");
return tmpStr.ToLower();
}
//生成随机数
public static string CreateValidateCode(int length)
{
int[] randMembers = new int[length];
int[] validateNums = new int[length];
string validateNumberStr = "";
//生成起始序列值
int seekSeek = unchecked((int)DateTime.Now.Ticks);
Random seekRand = new Random(seekSeek);
int beginSeek = (int)seekRand.Next(0, Int32.MaxValue - length * 10000);
int[] seeks = new int[length];
for (int i = 0; i < length; i++)
{
beginSeek += 10000;
seeks[i] = beginSeek;
}
//生成随机数字
for (int i = 0; i < length; i++)
{
Random rand = new Random(seeks[i]);
int pownum = 1 * (int)Math.Pow(10, length);
randMembers[i] = rand.Next(pownum, Int32.MaxValue);
}
//抽取随机数字
for (int i = 0; i < length; i++)
{
string numStr = randMembers[i].ToString();
int numLength = numStr.Length;
Random rand = new Random();
int numPosition = rand.Next(0, numLength - 1);
validateNums[i] = Int32.Parse(numStr.Substring(numPosition, 1));
}
for (int i = 0; i < length; i++)
{
validateNumberStr += validateNums[i].ToString();
}
return validateNumberStr;
}
/// <summary>
/// 获取远程服务器ATN结果
/// </summary>
/// <param name="strUrl">指定URL路径地址</param>
/// <param name="timeout">超时时间设置</param>
/// <returns>服务器ATN结果</returns>
public static string Get_Http(string strUrl, int timeout)
{
string strResult;
try
{
HttpWebRequest myReq = (HttpWebRequest)HttpWebRequest.Create(strUrl);
myReq.Timeout = timeout;
HttpWebResponse HttpWResp = (HttpWebResponse)myReq.GetResponse();
Stream myStream = HttpWResp.GetResponseStream();
StreamReader sr = new StreamReader(myStream, Encoding.Default);
StringBuilder strBuilder = new StringBuilder();
while (-1 != sr.Peek())
{
strBuilder.Append(sr.ReadLine());
}
strResult = strBuilder.ToString();
}
catch (Exception exp)
{
strResult = "错误：" + exp.Message;
}
return strResult;
}
2、服务器端获取数据并验证返回结果
[HttpGet]
public Result_Sign Sign(string signature, string timestamp, string nonce, string appseq)
{
Result_Sign sign = new Result_Sign()
{
code="0",
message="fault"
};
if (Tool.ValidateSignature(signature, timestamp, nonce, appseq))
{
sign.code = "1";
sign.message = "success";
}
return sign;
}
/// <summary>
/// 检查应用接入的数据完整性
/// </summary>
/// <param name="signature">加密签名内容</param>
/// <param name="timestamp">时间戳</param>
/// <param name="nonce">随机字符串</param>
/// <param name="appseq">序列号</param>
/// <returns></returns>
public static bool ValidateSignature(string signature, string timestamp, string nonce, string appseq)
{
bool result = false;
Register item = Cache.GetBySeq(appseq);//获取序列号相关信息
if (item != null)
{
if (DateTime.Parse(item.ExpireDT) < DateTime.Now.Date) //是否过期
{
return result;
}
#region 校验签名参数的来源是否正确
string[] ArrTmp = { item.IP, timestamp, nonce };
Array.Sort(ArrTmp);
string tmpStr = string.Join("", ArrTmp);
tmpStr = FormsAuthentication.HashPasswordForStoringInConfigFile(tmpStr, "SHA1");
tmpStr = tmpStr.ToLower();
if (tmpStr == signature && isNumberic(timestamp))
{ //验证成功
DateTime dtTime = StampToDateTime(timestamp);
double minutes = DateTime.Now.Subtract(dtTime).TotalMinutes;
if (minutes < 5) //时间不能大于5分钟
{
result = true;
}
}
#endregion
}
return result;
}
/// <summary>
/// 时间戳转时间
/// </summary>
/// <param name="timeStamp"></param>
/// <returns></returns>
private static DateTime StampToDateTime(string timeStamp)
{
DateTime dateTimeStart = TimeZone.CurrentTimeZone.ToLocalTime(new DateTime(1970, 1, 1));
long lTime = long.Parse(timeStamp + "0000000");
TimeSpan toNow = new TimeSpan(lTime);
return dateTimeStart.Add(toNow);
}
/// <summary>
/// 是否为数字
/// </summary>
/// <param name="message"></param>
/// <returns></returns>
protected static bool isNumberic(string message)
{
System.Text.RegularExpressions.Regex rex =
new System.Text.RegularExpressions.Regex(@"^\d+$");
if (rex.IsMatch(message))
{
return true;
}
else
return false;
}
public class Result_Sign
{
public string code { set; get; }
public string message { set; get; }
}