1 [{\"domain\":\"clean_bot\",\"intent\":\"start_clean\",\"slots\":{\"location\":[{\"slot_type\":\"STRING\",\"text\":\"卧室\",\"value\":\"卧室\"}]}}]

1{
2  "memberId": 123456789, // 用户ID
3}

1{
2    "flag": 0, // 0: 正常播报(默认)，1：tts 不进行播报(content字段内容不生效)
3    "content":"tts text" // 用于tts播报的内容, 如果content为空，则会用百度侧的content进行播报
4}

1{
2  "mediaPlay": 0 // 0: 正常播报(默认),1：不进行播报
3}

1 "custom": "
2   {\"otherKey1\":\"otherValue1\",\"otherKey2\":\"otherValue2\"}
3". //整个内容是 string，百度透传结果，客户进行端云协同

1{
2   
3import javax.crypto.Mac;
4import javax.crypto.spec.SecretKeySpec;
5import java.nio.charset.StandardCharsets;
6import java.security.NoSuchAlgorithmException;
7import java.util.Base64;
8
9import java.security.InvalidKeyException;
10
11
12/**
13 * 验签工具类. 验证签名是否正确
14 * 实现方需要实现以下策略
15 * <p>
16 * 1.时间有效性判断(建议上下5分钟之内认为有效)
17 * 2.防重攻击.
18 * 3.签名有效性判断
19 **/
20public class CloudSignature {
21
22
23    /**
24     * ak参数.
25     */
26    public static final String ACCESS_KEY = "QRtM5Mqc3Knn6duZd9xTjjfbSSlIDwln";
27
28    /**
29     * sk参数.由双方云共同拥有. 不进行网络传输.请严格保密.
30     */
31    public static final String SECRET_KEY = "dEtj0KZebuj6gadtg5zNdVmXBWryNUmDzbFOM7fqcKzT3Excx8lyIgsyOUPceB5nS3NlJ5LJ9TqsElx8KyC8UD3izVL0eGw5tCm44YxuV8SDPfhms5X862PtnG6MPDlf";
32
33
34    /**
35     * 验证签名
36     *
37     * @param timestamp   系统时间戳-毫秒
38     * @param signature   签名
39     * @param requestBody 请求内容.HTTP请求和HTTPS请求里的最原始的Body String 字符串
40     * @return 是否合法
41     */
42    public static boolean authenticateRequest(String timestamp, String signature, String requestBody) {
43
44        // 时间戳判断-时间有效性判断(建议上下5分钟之内认为有效)
45        long now = System.currentTimeMillis();
46        long currentTime = Long.parseLong(timestamp);
47        // 绝对值小于5分钟之内认为有效
48        long timeDiff = Math.abs(now - currentTime);
49        System.out.println(timeDiff);
50        if (timeDiff > 5 * 50 * 1000) {
51            return false; // 时间不在5分钟之内认为无效
52        }
53
54        // 防重判断. 这里暂时不实现
55        // 可以利用 requestBody 里的 logId 作为防重key
56
57
58        // 签名校验
59        String calculatedSignature = calculateSignature(timestamp, ACCESS_KEY, requestBody); // 根据具体算法计算请求签名
60        // 如果请求签名不匹配，说明请求未经授权，拒绝鉴权
61        return calculatedSignature == null || calculatedSignature.equals(signature);
62
63        // 鉴权通过
64    }
65
66    /**
67     * 计算签名
68     *
69     * @param timestamp   时间戳
70     * @param accessKey   ak
71     * @param requestBody 请求内容.是HTTP请求和HTTPS请求里的最原始的Body String 字符串
72     * @return 签名
73     */
74    public static String calculateSignature(String timestamp, String accessKey, String requestBody) {
75        try {
76            // 使用HMAC-SHA256算法进行签名计算
77            Mac mac = Mac.getInstance("HmacSHA256");
78            SecretKeySpec secretKeySpec = new SecretKeySpec(SECRET_KEY.getBytes(StandardCharsets.UTF_8), "HmacSHA256");
79            mac.init(secretKeySpec);
80            String toBeSigned = accessKey + timestamp + requestBody; // 将请求内容body加入签名计算
81            byte[] signatureBytes = mac.doFinal(toBeSigned.getBytes(StandardCharsets.UTF_8));
82            // 将签名结果进行Base64编码
83            return Base64.getEncoder().encodeToString(signatureBytes);
84        } catch (NoSuchAlgorithmException | InvalidKeyException e) {
85            e.printStackTrace();
86            return null;
87        }
88    }
89
90}
91}

1import org.junit.Assert;
2import org.junit.Test;
3
4public class CloudSignatureTest {
5
6    @Test
7    public void normalTest() {
8        // 示例使用：
9        String timestamp = System.currentTimeMillis() + ""; // 获取当前时间戳
10        String accessKey = CloudSignature.ACCESS_KEY; // 替换为实际的Access Key
11        String requestBody = "{\"logId\":\"123\",\"device\":{\"fc\":\"fc\",\"pk\":\"pk\",\"ak\":\"000000000019\"},\"query\":\"测试query\",\"nluInfos\":\"[{\\\"domain\\\":\\\"unknown\\\",\\\"intent\\\":\\\"unknown\\\",\\\"slots\\\":{}}]\"}"; // 替换为实际的请求内容body
12        String signature = CloudSignature.calculateSignature(timestamp, accessKey, requestBody); // 计算请求签名
13        // 将timestamp、accessKey、requestBody和signature kJcAI4FSIFvL6nY7uhjQ6A4THy+0sPLKd6LLcR90Ozk=
14        System.out.println(signature);
15        Assert.assertTrue(CloudSignature.authenticateRequest(timestamp, signature, requestBody));
16    }
17
18
19    @Test
20    public void fakerSignatureTest() {
21        // 示例使用：
22        String timestamp = System.currentTimeMillis() + ""; // 获取当前时间戳
23
24        String requestBody = "{\"logId\":\"123\",\"device\":{\"fc\":\"fc\",\"pk\":\"pk\",\"ak\":\"000000000019\"},\"query\":\"测试query\",\"nluInfos\":\"[{\\\"domain\\\":\\\"unknown\\\",\\\"intent\\\":\\\"unknown\\\",\\\"slots\\\":{}}]\"}"; // 替换为实际的请求内容body
25
26        // 异常的ak
27        String signature = CloudSignature.calculateSignature(timestamp, "faker_access_key", requestBody); // 计算请求签名
28        // 将timestamp、accessKey、requestBody和signature kJcAI4FSIFvL6nY7uhjQ6A4THy+0sPLKd6LLcR90Ozk=
29        System.out.println(signature);
30        Assert.assertFalse(CloudSignature.authenticateRequest(timestamp, signature, requestBody));
31    }
32
33
34    @Test
35    public void InvalidTimestampSignatureTest() {
36        // 示例使用：
37        String timestamp = (System.currentTimeMillis() + (60 * 1000 * 20)) + ""; // 获取当前时间戳
38        String accessKey = CloudSignature.ACCESS_KEY; // 替换为实际的Access Key
39        String requestBody = "{\"logId\":\"123\",\"device\":{\"fc\":\"fc\",\"pk\":\"pk\",\"ak\":\"000000000019\"},\"query\":\"测试query\",\"nluInfos\":\"[{\\\"domain\\\":\\\"unknown\\\",\\\"intent\\\":\\\"unknown\\\",\\\"slots\\\":{}}]\"}"; // 替换为实际的请求内容body
40        String signature = CloudSignature.calculateSignature(timestamp, accessKey, requestBody); // 计算请求签名
41        // 将timestamp、accessKey、requestBody和signature kJcAI4FSIFvL6nY7uhjQ6A4THy+0sPLKd6LLcR90Ozk=
42        System.out.println(signature);
43        Assert.assertFalse(CloudSignature.authenticateRequest(timestamp, signature, requestBody));
44    }
45
46}