[go: up one dir, main page]

CN112217835B - Message data processing method and device, server and terminal equipment - Google Patents

Message data processing method and device, server and terminal equipment Download PDF

Info

Publication number
CN112217835B
CN112217835B CN202011144928.9A CN202011144928A CN112217835B CN 112217835 B CN112217835 B CN 112217835B CN 202011144928 A CN202011144928 A CN 202011144928A CN 112217835 B CN112217835 B CN 112217835B
Authority
CN
China
Prior art keywords
secret key
request message
generation rule
data
encrypted
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN202011144928.9A
Other languages
Chinese (zh)
Other versions
CN112217835A (en
Inventor
朱熠
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Industrial and Commercial Bank of China Ltd ICBC
Original Assignee
Industrial and Commercial Bank of China Ltd ICBC
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Industrial and Commercial Bank of China Ltd ICBC filed Critical Industrial and Commercial Bank of China Ltd ICBC
Priority to CN202011144928.9A priority Critical patent/CN112217835B/en
Publication of CN112217835A publication Critical patent/CN112217835A/en
Application granted granted Critical
Publication of CN112217835B publication Critical patent/CN112217835B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0435—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
    • G06F21/6263—Protecting personal data, e.g. for financial or medical purposes during internet communication, e.g. revealing personal data from cookies
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/101—Access control lists [ACL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0643—Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3297—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving time stamps, e.g. generation of time stamps
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2151—Time stamp

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Software Systems (AREA)
  • Computing Systems (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Power Engineering (AREA)
  • Medical Informatics (AREA)
  • Databases & Information Systems (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

The specification provides a message data processing method, a message data processing device, a server and terminal equipment. Based on the method, the server sends Cookie data at least containing a generation rule of a first secret key and a generation rule of a second secret key to the terminal equipment in advance; therefore, the server and the terminal equipment can respectively generate the first secret key and the second secret key locally, the secret keys do not need to be interactively transmitted, and the risk of secret key leakage is reduced; before sending the request message, the terminal equipment encrypts the request message carrying the timestamp by using the first secret key and the second secret key; after receiving the encrypted request message, the server decrypts the request message by using the first secret key and the second secret key to obtain a timestamp; and then, whether the request message has the security risk is detected according to the time information indicated by the timestamp and the receiving time of the encrypted request message, so that the request message with the security risk can be accurately detected with lower processing cost, and the data security is protected.

Description

Message data processing method and device, server and terminal equipment
Technical Field
The present specification belongs to the field of internet technologies, and in particular, to a method, an apparatus, a server, and a terminal device for processing packet data.
Background
With the continuous development and popularization of information technology, the information security situation is increasingly severe and complex. System servers are often exposed to security risks such as hacking or information data theft.
Most of the existing methods firstly carry out professional and complicated security tests on the system to find out security vulnerabilities in the system; and repairing the security loophole in an intruding mode by modifying related codes in the system so as to protect the data security of the system server.
Therefore, based on the existing method, the technical problems of high processing cost, inaccuracy and easy omission often exist when the security risk of the message data is specifically processed.
In view of the above problems, no effective solution has been proposed.
Disclosure of Invention
The present specification provides a method and an apparatus for processing message data, a server, and a terminal device, which can accurately and efficiently detect whether a request message received by the server has a security risk with a low processing cost, thereby protecting the data security of the server.
An embodiment of the present specification provides a method for processing packet data, including:
receiving an encrypted request message sent by terminal equipment; the terminal equipment encrypts a timestamp of the request message by using a first secret key under the condition that the interaction mode is determined to be an encryption mode according to the Cookie data to obtain an encrypted timestamp; encrypting the request message carrying the encrypted timestamp by using a second secret key to obtain the encrypted request message; the first secret key is secret key data locally generated by the terminal equipment according to a generation rule of the first secret key; the second secret key is secret key data locally generated by the terminal equipment according to a generation rule of the second secret key; the Cookie data at least comprises a generation rule of a first secret key and a generation rule of a second secret key;
generating a second secret key locally at the server according to the generation rule of the second secret key, and decrypting the encrypted request message by using the second secret key to obtain the request message carrying the encrypted timestamp;
generating a first secret key locally at a server according to the generation rule of the first secret key, and decrypting the encrypted timestamp by using the first secret key to obtain a timestamp;
and detecting whether the request message has a first-class security risk or not according to the time information indicated by the timestamp and the receiving time of the encrypted request message.
In one embodiment, before receiving the encrypted request message sent by the terminal device, the method further includes:
receiving a login request sent by terminal equipment; the login request carries identity information and a login credential of a user;
under the condition that the identity information of the user and the login certificate are verified, generating a session ID associated with the identity information of the user, and determining a corresponding interaction mode;
under the condition that the corresponding interaction mode is determined to be the encryption mode, generating a generation rule of a first secret key and a generation rule of a second secret key;
storing the session ID, the generation rule of the first secret key and the generation rule of the second secret key in Cookie data;
and feeding back the Cookie data to the terminal equipment.
In one embodiment, determining the corresponding interaction pattern comprises:
inquiring a risk user blacklist according to the identity information of the user to obtain a corresponding inquiry result; the risk user blacklist stores identity information of risk users;
and according to the query result, determining that the corresponding interaction mode is an encryption mode under the condition that the user is determined to belong to the risk user.
In one embodiment, after saving the session ID, the generation rule of the first key, and the generation rule of the second key in Cookie data, the method further includes:
encrypting the Cookie data to obtain ciphertext data of the Cookie data;
and feeding back the ciphertext data of the Cookie data to the terminal equipment.
In one embodiment, locally generating the second secret key at the server according to a generation rule of the second secret key includes:
acquiring a current date character string and a session ID corresponding to the encrypted request message according to a generation rule of the second secret key;
splicing the current date character string and the session ID to obtain a second character string;
calculating a hash value of the second character string by using a second preset hash function to serve as a second hash value;
and according to a generation rule of the second secret key, extracting a value on a second preset data bit from the second hash value to generate the second secret key.
In one embodiment, the encrypted request packet further carries characteristic information of the terminal device; wherein the characteristic information includes at least one of: the version number of the browser logged in by the terminal equipment, the screen resolution of the terminal equipment and the system information of the terminal equipment.
In one embodiment, generating the first secret key locally at the server according to a generation rule of the first secret key includes:
acquiring characteristic information of the terminal equipment according to a generation rule of the first secret key;
generating a first character string according to the characteristic information of the terminal equipment;
calculating a hash value of the first character string by using a first preset hash function to serve as a first hash value;
and according to a generation rule of the first secret key, extracting a numerical value on a first preset data bit from the first hash value to generate the first secret key.
In one embodiment, detecting whether the request packet has a first type of security risk according to the time information indicated by the timestamp and the receiving time of the encrypted request packet includes:
calculating a time difference between the time information and the receiving time;
comparing the time difference value with a preset time threshold value to obtain a corresponding comparison result;
and according to the comparison result, determining that the first type of security risk exists in the request message under the condition that the time difference is larger than the preset time threshold.
In one embodiment, after determining that the request packet has the first type of security risk, the method further includes:
stopping processing the request message and generating risk prompt information;
sending the request message to a user classifier; the user classifier is used for generating a risk user blacklist according to the received request message with the first type of security risks.
In one embodiment, the method further comprises:
according to the comparison result, under the condition that the time difference value is determined to be smaller than or equal to the preset time threshold, obtaining and inquiring the log record of the system according to the identity information of the user so as to obtain the behavior statistical data of the user in a preset time period; wherein, the behavior statistical data of the user in the preset time period comprises: the total amount of message data sent by a user in a preset time period and/or the frequency of sending the message data;
and determining whether the first type of security risk exists in the request message according to the behavior statistical data of the user in the preset time period.
In one embodiment, in case it is determined that the time difference is less than or equal to the preset time threshold according to the comparison result, the method further comprises:
detecting whether the request message carries preset risk characters or not according to a preset payload dictionary; wherein the preset risk character comprises: risk characters related to SQL injection, risk characters related to XSS, risk characters related to XML external entities;
under the condition that the request message is determined to carry preset risk characters, marking the request message as a potential risk message;
and sending the potential risk message to a user classifier.
In one embodiment, in case it is determined that the time difference is less than or equal to the preset time threshold according to the comparison result, the method further comprises:
determining a target authority related to the request message according to the request message;
acquiring an authority table of a user according to the identity information of the user;
determining whether the request message has an unauthorized operation or not according to the authority table of the user and the target authority;
and under the condition that the request message is determined to have the unauthorized operation, determining that the request message has a first type of security risk.
In one embodiment, in a case that it is determined that the request packet does not have the first type of security risk, the method further includes:
responding to the request message, and performing corresponding data processing to obtain a corresponding reply message;
and sending the reply message to the terminal equipment.
In one embodiment, before sending the reply message to the terminal device, the method further includes:
detecting whether the reply message carries a keyword related to sensitive information or not according to the preset fault-tolerant dictionary;
and under the condition that the reply message is determined to carry the key words related to the sensitive information, determining that the request message has a second type of security risk.
In one embodiment, in a case where it is determined that the request packet has the second type of security risk, the method further includes:
acquiring misleading data; wherein the misleading data comprises honeypot server information;
and replacing the reply message with the misleading data, and feeding back the misleading data to the terminal equipment.
In one embodiment, in a case that it is determined that the request packet does not have the second type of security risk, the method further includes:
generating a second key locally at the server according to a generation rule of the second key;
encrypting the reply message by using a second secret key to obtain an encrypted reply message;
and sending the encrypted reply message to the terminal equipment.
An embodiment of the present specification further provides a method for processing packet data, including:
determining an interaction mode with a server according to the Cookie data; the Cookie data at least comprises a generation rule of a first secret key and a generation rule of a second secret key;
under the condition that the interaction mode is determined to be the encryption mode, acquiring a generation rule of a first secret key and a generation rule of a second secret key from the Cookie data;
according to the generation rule of the first secret key, the first secret key is locally generated in the terminal equipment, the timestamp of the request message is encrypted by the first secret key, and the request message carrying the encrypted timestamp is obtained;
according to the generation rule of the second secret key, the second secret key is locally generated in the terminal equipment, and the request message carrying the encrypted timestamp is encrypted by using the second secret key to obtain the encrypted request message;
and sending the encrypted request message to a server.
In one embodiment, before determining the interaction pattern with the server from the Cookie data, the method further comprises:
sending a login request to a server; the login request carries identity information and a login credential of a user;
receiving Cookie data fed back by a server; the server generates and sends corresponding Cookie data to the terminal device under the condition that the identity information and the login credentials of the user are verified, wherein the Cookie data at least comprise: a session ID associated with the identity information of the user, a generation rule of a first key, and a generation rule of a second key.
In one embodiment, the Cookie data further includes a mode identifier, and correspondingly, determining an interaction mode with the server according to the Cookie data includes:
extracting the pattern identification from the Cookie data;
and determining an interaction mode with the server according to the mode identification.
In one embodiment, locally generating the first secret key at the terminal device according to a generation rule of the first secret key includes:
acquiring characteristic information of the terminal equipment according to a generation rule of the first secret key;
generating a first character string according to the characteristic information of the terminal equipment;
calculating a hash value of the first character string by using a first preset hash function to serve as a first hash value;
and according to the generation rule of the first secret key, extracting the value on the first preset data bit from the first hash value to generate the first secret key.
In one embodiment, locally generating the second secret key at the terminal device according to a generation rule of the second secret key includes:
acquiring a current date character string and a session ID according to a generation rule of the second secret key;
splicing the current date character string and the session ID to obtain a second character string;
calculating a hash value of the second character string by using a second preset hash function to serve as a second hash value;
and according to a generation rule of the second secret key, extracting a numerical value on a second preset data bit from the second hash value to generate the second secret key.
An embodiment of the present specification further provides a device for processing packet data, including:
the receiving module is used for receiving the encrypted request message sent by the terminal equipment; the terminal equipment encrypts a timestamp of the request message by using a first secret key under the condition that the interaction mode is determined to be an encryption mode according to the Cookie data to obtain an encrypted timestamp; encrypting the request message carrying the encrypted timestamp by using a second secret key to obtain the encrypted request message; the first secret key is secret key data locally generated by the terminal equipment according to a generation rule of the first secret key; the second secret key is secret key data locally generated by the terminal equipment according to a generation rule of the second secret key; the Cookie data at least comprises a generation rule of a first secret key and a generation rule of a second secret key;
the processing module is used for locally generating a second secret key at the server according to the generation rule of the second secret key, and decrypting the encrypted request message by using the second secret key to obtain the request message carrying the encrypted timestamp;
the processing module is further configured to locally generate a first secret key at the server according to a generation rule of the first secret key, and decrypt the encrypted timestamp by using the first secret key to obtain a timestamp;
and the detection module is used for detecting whether the request message has the first type of security risk or not according to the time information indicated by the timestamp and the receiving time of the encrypted request message.
An embodiment of the present specification further provides a device for processing packet data, including:
the determining module is used for determining an interaction mode with the server according to the Cookie data; the Cookie data at least comprises a generation rule of a first secret key and a generation rule of a second secret key;
the acquisition module is used for acquiring a generation rule of a first secret key and a generation rule of a second secret key from the Cookie data under the condition that the interaction mode is determined to be the encryption mode;
the processing module is used for locally generating a first secret key at the terminal equipment according to the generation rule of the first secret key, and encrypting the timestamp of the request message by using the first secret key to obtain the request message carrying the encrypted timestamp;
the processing module is further configured to locally generate a second secret key at the terminal device according to a generation rule of the second secret key, and encrypt the request packet carrying the encrypted timestamp by using the second secret key to obtain an encrypted request packet;
and the sending module is used for sending the encrypted request message to a server.
The embodiment of the present specification further provides a server, including a processor and a memory for storing an executable instruction of the processor, where the processor implements receiving an encrypted request packet sent by a terminal device when executing the instruction; the terminal equipment encrypts a timestamp of the request message by using a first secret key under the condition that the interaction mode is determined to be an encryption mode according to the Cookie data to obtain an encrypted timestamp; encrypting the request message carrying the encrypted timestamp by using a second secret key to obtain the encrypted request message; the first secret key is secret key data locally generated by the terminal equipment according to a generation rule of the first secret key; the second secret key is secret key data locally generated by the terminal equipment according to a generation rule of the second secret key; the Cookie data at least comprises a generation rule of a first secret key and a generation rule of a second secret key; generating a second secret key locally at the server according to the generation rule of the second secret key, and decrypting the encrypted request message by using the second secret key to obtain the request message carrying the encrypted timestamp; generating a first secret key locally at a server according to the generation rule of the first secret key, and decrypting the encrypted timestamp by using the first secret key to obtain a timestamp; and detecting whether the request message has a first-class security risk or not according to the time information indicated by the timestamp and the receiving time of the encrypted request message.
The embodiment of the specification further provides terminal equipment, which comprises a processor and a memory, wherein the memory is used for storing the executable instruction of the processor, and when the processor executes the instruction, the interaction mode with the server is determined according to Cookie data; the Cookie data at least comprises a generation rule of a first secret key and a generation rule of a second secret key; under the condition that the interaction mode is determined to be the encryption mode, acquiring a generation rule of a first secret key and a generation rule of a second secret key from the Cookie data; generating a first secret key locally at the terminal equipment according to the generation rule of the first secret key, and encrypting the timestamp of the request message by using the first secret key to obtain a request message carrying the encrypted timestamp; generating a second secret key locally at the terminal equipment according to the generation rule of the second secret key, and encrypting the request message carrying the encrypted timestamp by using the second secret key to obtain an encrypted request message; and sending the encrypted request message to a server.
The embodiment of the present specification further provides a computer-readable storage medium, on which computer instructions are stored, and when the instructions are executed, the method for processing the message data is implemented.
The method, the device, the server and the terminal device for processing the message data provided by the specification generate and send Cookie data at least containing a generation rule of a first secret key and a generation rule of a second secret key to the terminal device in advance by using the server; therefore, the server and the terminal equipment can respectively generate the required first secret key and the second secret key locally without mutually transmitting related secret key data, so that the risk of leakage of the secret key data is effectively reduced, and the data security in the message data processing process is protected; further, before sending the request message, the terminal equipment encrypts the request message carrying the timestamp by using a first secret key and a second secret key which are locally generated; after receiving the encrypted request message, the server decrypts the request message by using a first secret key and a second secret key which are locally generated to obtain a timestamp of the request message; and detecting whether the request message has the first-class security risk or not according to the time information indicated by the timestamp and the receiving time of the encrypted request message. By the method, the data interactively transmitted between the server and the terminal equipment can be effectively prevented from being tampered and leaked, whether the security risk exists in the request message received by the server can be accurately and efficiently detected with low processing cost, the data security of the system server in the message data processing process is protected, and the technical problems that the processing cost is high, the accuracy is high and the omission is easy to occur when the security risk of the message data is detected based on the existing method are solved.
Drawings
In order to more clearly illustrate the embodiments of the present specification, the drawings needed to be used in the embodiments will be briefly described below, and the drawings in the following description are only some of the embodiments described in the present specification, and it is obvious to those skilled in the art that other drawings can be obtained according to the drawings without any creative effort.
Fig. 1 is a schematic diagram of an embodiment of a structural composition of a system to which a method for processing message data provided by an embodiment of the present specification is applied;
fig. 2 is a flowchart illustrating a message data processing method according to an embodiment of the present disclosure;
fig. 3 is a flowchart illustrating a message data processing method according to an embodiment of the present specification;
FIG. 4 is a schematic structural component diagram of a server provided in an embodiment of the present description;
fig. 5 is a schematic structural component diagram of a message data processing apparatus according to an embodiment of the present disclosure;
fig. 6 is a schematic diagram of an embodiment of a method for processing packet data according to an embodiment of the present disclosure, in a scenario example;
fig. 7 is a schematic diagram of an embodiment of a method for processing packet data according to an embodiment of the present disclosure, in a scenario example;
fig. 8 is a schematic diagram of an embodiment of a method for processing packet data according to an embodiment of the present disclosure, in a scenario example;
fig. 9 is a schematic diagram of an embodiment of a method for processing packet data according to an embodiment of the present specification, in a scenario example;
fig. 10 is a schematic diagram of an embodiment of a method for processing packet data according to an embodiment of the present specification, in an example scenario;
fig. 11 is a schematic diagram of an embodiment of a method for processing packet data according to an embodiment of the present specification, in a scenario example;
fig. 12 is a schematic diagram of an embodiment of a method for processing packet data according to an embodiment of the present disclosure, in a scenario example;
fig. 13 is a schematic diagram of an embodiment of a method for processing packet data according to an embodiment of the present disclosure, in a scenario example;
fig. 14 is a schematic diagram of an embodiment of a method for processing packet data according to an embodiment of the present disclosure, in a scenario example;
fig. 15 is a schematic diagram of an embodiment of a method for processing packet data according to an embodiment of the present specification, in an example scenario;
fig. 16 is a schematic diagram of an embodiment of a method for processing packet data according to an embodiment of the present disclosure, in a scenario example;
fig. 17 is a schematic diagram of an embodiment of a method for processing packet data according to an embodiment of the present disclosure, in a scenario example;
fig. 18 is a schematic diagram of an embodiment of a method for processing packet data according to an embodiment of the present specification, in a scenario example.
Detailed Description
In order to make those skilled in the art better understand the technical solutions in the present specification, the technical solutions in the embodiments of the present specification will be clearly and completely described below with reference to the drawings in the embodiments of the present specification, and it is obvious that the described embodiments are only a part of the embodiments of the present specification, and not all of the embodiments. All other embodiments obtained by a person skilled in the art based on the embodiments in the present specification without any inventive step should fall within the scope of protection of the present specification.
Considering that when the existing method is used for solving the problem of security risk, a large amount of cost is always consumed to firstly carry out relatively professional and complicated security tests on a system server so as to find out security vulnerabilities existing in the system; and repairing the found security loophole in an intruding mode by modifying related codes in the system so as to protect the data security of the system server. However, the above methods often require high processing cost, are easy to miss, and are not accurate enough in implementation.
In view of the above-mentioned fundamental reasons, the present specification considers that a mode of finding out a bug repair bug through a security test in the existing method may be abandoned, a corresponding security detection framework is arranged on one side of a system server, and based on the security detection framework, a request message with a security risk is identified in time by performing corresponding detection on the request message received by the server through a corresponding detector, and is correspondingly processed, so that an effect of protecting data security of the system server can be achieved with a relatively low processing cost. Further, in order to ensure that a message transmitted between the server and the terminal device is not tampered, the server may send Cookie data, which at least includes a generation rule of the first key and a generation rule of the second key, to the terminal device in advance; therefore, the server and the terminal device can respectively generate the first secret key and the second secret key locally without interactively transmitting secret key data, and the risk that the secret key data is leaked in the interactive transmission process is reduced. Before sending the request message, the terminal equipment encrypts the request message carrying the timestamp by using the first secret key and the second secret key; after receiving the encrypted request message, the server decrypts the request message by using the first secret key and the second secret key to obtain a timestamp; and then, whether the first type of security risk exists in the request message is detected according to the time information indicated by the timestamp and the receiving time of the encrypted request message, so that the data security of the system server can be better protected, and the technical problems of high processing cost, inaccuracy and easiness in omission in detecting the security risk of the message data based on the conventional method are solved.
The embodiment of the specification provides a message data processing method. The message data processing method can be particularly applied to a data processing system comprising a server and terminal equipment. As can be seen in figure 1. The server and the terminal device in the system may be connected in a wired or wireless manner to perform data interaction.
In this embodiment, the data processing system may be a message data processing system of a bank, or a transaction data processing system of a shopping website. Of course, the above-listed data processing systems are merely illustrative. In specific implementation, the data processing system may also be applied to other types of data processing systems in other application scenarios according to specific situations and processing requirements. The present specification is not limited to these.
In specific implementation, the terminal device can determine an interaction mode with the server according to the Cookie data; the Cookie data at least comprises a generation rule of a first secret key and a generation rule of a second secret key; under the condition that the interaction mode is determined to be the encryption mode, acquiring a generation rule of a first secret key and a generation rule of a second secret key from the Cookie data; according to the generation rule of the first secret key, the first secret key is locally generated in the terminal equipment, the timestamp of the request message is encrypted by the first secret key, and the request message carrying the encrypted timestamp is obtained; generating a second secret key locally at the terminal equipment according to the generation rule of the second secret key, and encrypting the request message carrying the encrypted timestamp by using the second secret key to obtain an encrypted request message; and sending the encrypted request message to a server.
The server can receive the encrypted request message sent by the terminal equipment; the terminal equipment encrypts a timestamp of the request message by using a first secret key under the condition that the interaction mode is determined to be an encryption mode according to the Cookie data to obtain an encrypted timestamp; encrypting the request message carrying the encrypted timestamp by using a second secret key to obtain the encrypted request message; the first secret key is secret key data locally generated by the terminal equipment according to a generation rule of the first secret key; the second secret key is secret key data locally generated by the terminal equipment according to a generation rule of the second secret key; the Cookie data at least comprises a generation rule of a first secret key and a generation rule of a second secret key; generating a second secret key locally at the server according to the generation rule of the second secret key, and decrypting the encrypted request message by using the second secret key to obtain the request message carrying the encrypted timestamp; generating a first secret key locally at a server according to the generation rule of the first secret key, and decrypting the encrypted timestamp by using the first secret key to obtain a timestamp; and detecting whether the request message has a first-class security risk or not according to the time information indicated by the timestamp and the receiving time of the encrypted request message.
The server can respond to the request message to perform corresponding data processing to obtain a corresponding reply message under the condition that the first type of security risk does not exist in the request message; and then feeding back the reply message to the terminal equipment.
In this embodiment, the server may specifically include a background server capable of implementing functions such as data transmission and data processing. Specifically, the server may be, for example, an electronic device having data operation, storage functions, and network interaction functions. Alternatively, the server may be a software program running in the electronic device and providing support for data processing, storage and network interaction. In the present embodiment, the number of servers is not particularly limited. The server may specifically be one server, or may also be several servers, or a server cluster formed by several servers.
In this embodiment, the terminal device may specifically include a front-end electronic device that is disposed on a user side and is capable of implementing functions such as data acquisition and data transmission. Specifically, the terminal device may be, for example, a desktop computer, a tablet computer, a notebook computer, a smart phone, and the like. Alternatively, the terminal device may also be a software application that can run in the electronic device. For example, it may be some browser APP running on a smartphone, etc.
Referring to fig. 2, an embodiment of the present disclosure provides a method for processing message data. The method can be applied to the server side. When implemented, the following may be included.
S201: receiving an encrypted request message sent by terminal equipment; the terminal equipment encrypts a timestamp of the request message by using a first secret key under the condition that the interaction mode is determined to be an encryption mode according to the Cookie data to obtain an encrypted timestamp; encrypting the request message carrying the encrypted timestamp by using a second secret key to obtain the encrypted request message; the first secret key is secret key data locally generated by the terminal equipment according to a generation rule of the first secret key; the second secret key is secret key data locally generated by the terminal equipment according to a generation rule of the second secret key; the Cookie data at least comprises a generation rule of a first secret key and a generation rule of a second secret key.
S202: and locally generating a second secret key at the server according to the generation rule of the second secret key, and decrypting the encrypted request message by using the second secret key to obtain the request message carrying the encrypted timestamp.
S203: and generating a first secret key locally at the server according to the generation rule of the first secret key, and decrypting the encrypted timestamp by using the first secret key to obtain the timestamp.
S204: and detecting whether the request message has a first-class security risk or not according to the time information indicated by the timestamp and the receiving time of the encrypted request message. The first type of security risk may be specifically understood as a security risk detected before a corresponding reply packet is obtained by responding and processing a request packet.
In one embodiment, when a user wants to interact with the system server to perform specific data processing, a corresponding request message (e.g., a request message) may be generated by the terminal device to request the server to perform corresponding data processing, and a corresponding reply message (e.g., a response message) may be fed back.
Specifically, for example, when a user wants to interact with a bank system server and complete data processing of a certain transfer service, a corresponding request message for requesting data processing for transferring money may be generated by the terminal device.
After the terminal device generates the request message, the terminal device does not directly send the request message to the server. Instead, it may be determined whether the interaction mode with the server related to the request packet is an encryption mode according to Cookie data locally stored in the terminal device. Under the condition that the interactive mode is determined to be the encryption mode, the terminal device can perform corresponding encryption processing on the request message according to the Cookie data to obtain an encrypted request message, and then sends the encrypted request message to the server. Therefore, the risk that the request message is leaked in the interactive transmission process can be effectively reduced.
The Cookie data may be specifically understood as file data stored locally on the terminal device of the user. Generally, the Cookie data may be a small text file.
In one embodiment, the Cookie data may include at least a generation rule of the first key and a generation rule of the second key. Furthermore, the Cookie data may also include other data such as a pattern identifier (which may also be referred to as an encryption switch). The mode identifier may specifically include: a mode identification for indicating an encryption mode, and/or a mode identification for indicating an non-encryption mode.
In an embodiment, the Cookie data may be specifically generated by a server and provided to the terminal device. The server sends Cookie data at least including a first key generation rule and a second key generation rule to the terminal device in advance, and the server locally stores the same first key generation rule and second key generation rule. Therefore, in the data interaction process of the encryption mode, the server and the terminal equipment can locally generate corresponding key data by using the generation rule of the first secret key and the generation rule of the second secret key respectively, and interact after data processing by using the key data without mutual transmission of the key data, so that the risk of leakage of the used key data in the transmission process can be reduced, and the security of data processing is further improved.
In one embodiment, before the user generates and sends the request message to the server through the terminal device, the user may also perform a login operation through the terminal device.
Specifically, for example, the user may input own identity information and login credentials in an account login interface presented by the terminal device. And the terminal equipment receives and sends a corresponding login request to the server according to the identity information of the user and the login credential so as to request to login the account of the user, so that the user can generate and send a request message to the server through the terminal equipment logged in the account in the following process.
The login request may specifically carry identity information of the user and a login credential of the user.
In an embodiment, the identity information of the user may specifically include an account name of the user, an identification number of the user, a registered mobile phone number of the user, and the like. The login credentials may specifically include a login password of the user, a facial image of the user, fingerprint data of the user, and the like. Of course, the identity information of the user and the login credentials of the user listed above are only an illustrative example. In specific implementation, the identity information and the login credentials of the user may further include other types of data according to a specific application scenario. The present specification is not limited thereto.
In an embodiment, before receiving the encrypted request message sent by the terminal device, when the method is implemented, the following may also be included.
S1: receiving a login request sent by terminal equipment; the login request carries identity information and a login credential of a user;
s2: under the condition that the identity information of the user and the login certificate are verified, generating a session ID associated with the identity information of the user, and determining a corresponding interaction mode;
s3: generating a generation rule of a first secret key and a generation rule of a second secret key under the condition that the corresponding interaction mode is determined to be the encryption mode;
s4: storing the session ID, the generation rule of the first secret key and the generation rule of the second secret key in Cookie data;
s5: and feeding the Cookie data back to the terminal equipment.
In one embodiment, after receiving the login request, the server may extract the identity information (e.g., user ID) and login credentials of the user from the login request; then, inquiring a user information database of a system according to the identity information of the user to find one or more certificate data matched with the identity information of the user; and then, according to the matched certificate data, verifying the login certificate. And if the login credential is determined to be the same as one credential data in the matched credential data, the verification is passed, and the login is successful.
In one embodiment, in case of passing the verification and successfully logging in, the server may establish a session temporary table with the terminal device that logged in the account of the user, generate a corresponding session (a data for tracking the session of the user), and store the session in the memory of the server. Meanwhile, the server can also generate a session ID associated with the identity information of the user aiming at the session, and write the session ID into Cookie data to be fed back to the terminal equipment.
In one embodiment, the server may further determine an interaction mode with the terminal device. For example, it is determined whether the interaction mode is an encryption mode or a non-encryption mode. And further, a corresponding pattern identifier can be generated and written into the Cookie data.
In one embodiment, when the interaction mode is specifically determined, the server may query a risk user blacklist according to the identity information of the user to obtain a corresponding query result; the risk user blacklist stores identity information of risk users; and according to the query result, determining that the corresponding interaction mode is an encryption mode under the condition that the user is determined to belong to the risk user. Therefore, the encryption mode can be adopted in the process of carrying out data interaction with the terminal equipment of the risk user in a subsequent pointed manner, so that the leakage of some more important data information of the server in the data interaction process can be avoided.
In an embodiment, when the interaction mode is specifically determined, the server may further determine a current service processing scenario, and further determine whether the interaction mode is an encryption mode or a non-encryption mode according to a security level of the service processing scenario. For example, for some service processing scenarios with lower security level and not involving sensitive information interaction, it may be determined that the corresponding interaction mode is a non-encryption mode. For some service processing scenes with higher security level and related to sensitive information interaction, the corresponding interaction mode can be determined to be an encryption mode.
In one embodiment, in a case where it is determined that the corresponding interaction mode is the encryption mode, the server may generate a generation rule of the first key and a generation rule of the second key. The generation rule of the first secret key is used for limiting a specific generation mode of the first secret key, and the generation rule of the second secret key is used for limiting a specific generation mode of the second secret key.
In a specific implementation, the server may store the generation rule of the first secret key and the generation rule of the second secret key locally in the server in a manner of writing the generation rule of the first secret key and the generation rule of the second secret key into a configuration file of the server.
In an embodiment, the server may write the generation rule of the first secret key and the generation rule of the second secret key into Cookie data, and feed the Cookie data at least including the generation rule of the first secret key and the generation rule of the second secret key back to the terminal device. Correspondingly, the terminal device receives the Cookie data and stores the Cookie data in a local terminal device (for example, a memory of the terminal device).
In an embodiment, after the server stores the session ID, the generation rule of the first key, and the generation rule of the second key in the Cookie data, when the method is implemented, the method may further include the following steps: encrypting the Cookie data to obtain ciphertext data of the Cookie data; and feeding the ciphertext data of the Cookie data back to the terminal equipment.
In the embodiment, the Cookie data is encrypted firstly, and then the ciphertext data of the Cookie data is sent to the terminal equipment, so that the risk of leakage of the Cookie data can be reduced, and the data security is further protected.
In one embodiment, in the case that the verification fails and the login fails, the server may generate and feed back prompt information of the login failure to the terminal device. The terminal equipment can receive and respond to the prompt message of the login failure and jump back to the previous account login interface, so that the user can input the identity information and the login credentials again through the interface.
In an embodiment, after generating the request message and before sending the request message, the terminal device may first obtain the pattern identifier from the Cookie data stored locally. And determining whether the interaction mode is an encryption mode or not according to the mode tag. Under the condition that the interaction mode is determined to be the encryption mode, a first secret key can be generated locally at the terminal equipment according to a generation rule of the first secret key; and the first secret key is used for encrypting the timestamp carried by the request message to obtain the request message carrying the encrypted timestamp. Further, the second key may be generated locally at the terminal device according to a generation rule of the second key; encrypting the request message carrying the encrypted timestamp by using a second secret key to obtain an encrypted request message; and then sending the encrypted request message to a server. Therefore, the time stamp in the request message can be protected in a double encryption mode, the time stamp is prevented from being tampered, and data safety is protected.
In an embodiment, the encrypted request packet sent by the terminal device may also carry a corresponding session ID.
In an embodiment, after receiving the encrypted request message, the server may extract the session ID from the encrypted request message; and the validity of the session ID is checked by combining the session stored in the memory. If the check is passed and it is determined that the session ID is valid, the server may obtain relevant data (e.g., a generation rule of the first key and a generation rule of the second key, etc.) from a local location (e.g., a configuration file of the server) to perform subsequent processing on the encrypted request packet.
On the contrary, when the check fails and the session ID is determined to be invalid, the server may generate corresponding error information and suspend the subsequent processing of the request packet.
In one embodiment, the server may locally generate the second key for decryption in the same generation manner as the terminal device generates the second key according to a generation rule of the second key in the related data.
In an embodiment, the generating of the second key locally at the server according to the generating rule of the second key may include the following steps: acquiring a current date character string and a session ID corresponding to the encrypted request message according to a generation rule of the second secret key; splicing the current date character string and the session ID to obtain a second character string; calculating a hash value of the second character string by using a second preset hash function to serve as a second hash value; and according to a generation rule of the second secret key, extracting a value on a second preset data bit from the second hash value to generate the second secret key.
Further, the server may decrypt the encrypted request packet using the second secret key to obtain the request packet carrying the encrypted timestamp.
In one embodiment, the server may locally generate the first key for decryption in the same generation manner as the terminal device generates the first key according to a generation rule of the first key in the relevant data.
In one embodiment, the encrypted request packet further carries characteristic information of the terminal device; wherein the characteristic information includes at least one of: the version number of the browser logged in by the terminal device, the screen resolution of the terminal device, the system information of the terminal device, and the like. Of course, the above characteristic information is only an illustrative description. In specific implementation, other types of characteristic information related to the terminal device may also be introduced according to specific application scenarios. Such as the processor model of the terminal device, the physical address of the terminal device, etc. The present specification is not limited to these.
In an embodiment, the generating of the first key locally at the server according to the generating rule of the first key may be implemented as follows: according to a generation rule of the first secret key, acquiring characteristic information of the terminal equipment (from the encrypted request message); generating a first character string according to the characteristic information of the terminal equipment; calculating a hash value of the first character string by using a first preset hash function to serve as a first hash value; and according to the generation rule of the first secret key, extracting the value on the first preset data bit from the first hash value to generate the first secret key.
In one embodiment, in specific implementation, according to a generation rule of a first key, feature information of a device may be acquired to generate a corresponding first character string; the characteristic information of multiple devices can also be acquired, and the corresponding first character strings can be generated after the characteristic information of the multiple devices is spliced.
Of course, the generation method of generating the first key according to the generation rule of the first key and the generation method of generating the second key according to the generation rule of the second key listed above are only exemplary.
By generating the first secret key and the second secret key in the generating manner, a third party without a generating rule of the first secret key or a generating rule of the second secret key can hardly accurately generate the first secret key and the second secret key, so that the security effect of the first secret key and the second secret key can be improved, and the data security is further protected.
In an embodiment, the detecting, according to the time information indicated by the timestamp and the receiving time of the encrypted request packet, whether the first type of security risk exists in the request packet may include the following steps: calculating a time difference between the time information and the receiving time; comparing the time difference value with a preset time threshold value to obtain a corresponding comparison result; and according to the comparison result, determining that the first type of security risk exists in the request message under the condition that the time difference is larger than the preset time threshold.
In this embodiment, when the server receives the encrypted ciphertext data, the server records the time of receiving the encrypted ciphertext data as the receiving time.
The server can determine the time information indicated by the time stamp according to the time stamp. The time information indicated by the timestamp may be time when the terminal device generates the request packet.
Furthermore, the server may determine a time interval from the generation of the request message by the terminal device to the reception of the request message by the server by calculating a time difference between the time information and the reception time. And comparing the time interval with a preset time threshold.
If the time interval is longer and is greater than the preset time threshold, it can be judged that the probability that the request message is tampered midway is relatively higher, an aggressive behavior aiming at the system server is more likely to exist, and a first-class security risk exists.
If the time interval is shorter and is less than or equal to the preset time threshold, it can be judged that the probability that the request message is tampered midway is smaller, and the first-class security risk does not exist.
The preset time threshold value can be flexibly set according to the transmission time of the request message, the current state of the transmission network, the security requirement of the system and other factors. The specific value of the preset time threshold is not limited in the present specification.
Through the comparison and judgment aiming at the timestamp, the request message which is tampered with higher probability and is possible to have aggressive behavior to the system server can be effectively identified, and the first type of security risk of the request message is determined.
In this embodiment, the comparison and determination process for the timestamp may be specifically implemented by a tamper-proof verifier configured in the server.
In an embodiment, after determining that the request packet has the first type of security risk, when the method is implemented, the method may further include the following steps: stopping processing the request message and generating risk prompt information; sending the request message to a user classifier; the user classifier is used for generating a risk user blacklist according to the received request message with the first type of security risk.
In this embodiment, after determining that the request packet has the first type of security risk, the server may stop processing the request packet in a normal response in order to protect data security of the system server. And corresponding risk prompt information can be generated and fed back to the terminal equipment to inform the user that the processing is refused because the transmitted request message has a security risk.
In one embodiment, the server may further send the request message with the first type of security risk to a user classifier configured in the server. Furthermore, in specific implementation, the server may perform statistical processing on the received request packets with the first type of security risk by using the user classifier, and taking the identity information of the user corresponding to each request packet as a statistical dimension, to obtain a corresponding statistical result. The statistical result may be a statistical number of request messages corresponding to the identity information of each user and having the first type of security risk in a period of time.
Further, according to the statistical result, the statistical number of the corresponding request messages with the first type of security risks is advanced, or the identity information of the user with the number greater than the preset number threshold is added to the risk user blacklist, so that the user corresponding to the identity information of the user can be determined as the risk user.
In an embodiment, according to the comparison result, in the case that it is determined that the time difference is smaller than or equal to the preset time threshold, it may be determined that the request packet has a higher probability of not having the first-class security risk, and the server may perform corresponding data processing in response to the request packet; and generating and feeding back a corresponding reply message to the terminal device according to the specific data processing result.
In an embodiment, after it is determined that the time difference is smaller than or equal to the preset time threshold according to the comparison result, further detection and determination may be performed on the security risk of the request packet, so as to more accurately identify and determine whether the request packet has the security risk.
In an embodiment, when the method is implemented, the following may be further included:
s1: according to the comparison result, under the condition that the time difference value is determined to be smaller than or equal to the preset time threshold, obtaining and inquiring the log record of the system according to the identity information of the user so as to obtain the behavior statistical data of the user in a preset time period; wherein, the behavior statistical data of the user in the preset time period comprises: the total amount of message data sent by a user in a preset time period and/or the frequency of sending the message data;
s2: and determining whether the first type of security risk exists in the request message according to the behavior statistical data of the user in the preset time period.
The log record of the system may record the receiving time of the request message received by each server in the system in history and the identity information of the user corresponding to the request message.
In this embodiment, after comparing and determining the timestamp of the request packet, it may further obtain and determine whether the request packet has an aggressive behavior and a security risk from a behavior level of the user according to the behavior statistical data of the user corresponding to the request packet.
Specifically, the server may determine, according to the identity information of the user requesting the message, by querying a log record of the system, a total amount of message data sent by the user within a preset time period (for example, the current day, or the last week, etc.), and/or behavior statistical data such as a frequency of sending the message data. And further, whether the behavior of the user for sending the message data is abnormal can be judged according to one or more of the listed behavior statistical data.
For example, the total amount of message data sent by a user every day is normally within 100. The total amount of the message data sent by a certain user on the same day is extremely large, reaches tens of thousands, and is far larger than the normal range of the total amount of the message data sent by a user every day. This is clearly anomalous. It is highly likely that a hacker or the like attacks the system server by sending a large amount of message data for a certain period of time using the identity information of the user. In this case, it can be determined that the request packet corresponding to the identity information of the user, which is currently received by the system server, has a high probability and also has an aggressive behavior, and it can be determined that the request packet also has a first-class security risk.
At this time, the server can stop processing the request message and generate risk prompt information; and simultaneously, sending the request message to a user classifier.
The above-mentioned detection and determination process for the behavior statistic data of the user sending the request message may be specifically performed by a transaction frequency limiter configured on the server.
In one embodiment, a security-risky request packet considering that there is usually an aggressive behavior will often also carry some relevant risk characters. Therefore, in order to more accurately identify the request message with the first type of security risk and avoid omission, whether the request message has the first type of security risk or not can be further detected and judged by detecting characters in the request message.
In an embodiment, when the method is implemented in a case where it is determined that the time difference is smaller than or equal to the preset time threshold according to the comparison result, the method may further include: detecting whether the request message carries preset risk characters or not according to a preset payload dictionary; wherein the preset risk character comprises: risk characters related to SQL injection, risk characters related to XSS, risk characters related to XML external entities; under the condition that the request message is determined to carry preset risk characters, marking the request message as a potential risk message; and sending the potential risk message to a user classifier.
In this embodiment, the preset payload dictionary may be specifically understood as a dictionary table storing preset risk characters related to multiple risks. During specific implementation, the latest vulnerability information can be obtained, and the payload dictionary can be updated in time according to the latest vulnerability information.
In an embodiment, in a scenario with relatively high and strict security requirements, under the condition that it is determined that the request packet carries preset risk characters, the request packet may be directly determined as a request packet with a first type of security risk, and the request packet is sent to a user classifier.
In an embodiment, in other scenarios with relatively low security requirements, under the condition that the request packet is determined to carry preset risk characters, the request packet may not be directly determined as a request packet with a first type of security risk, and then the request packet may be determined as a packet with a potential risk and marked accordingly. For example, the request message is marked as a potential risk message. And sending the marked potential risk message to a user classifier for processing.
Furthermore, the server can also filter preset risk characters carried in the request message, and then further detect and judge the filtered request message. By the filtering, the interference of the preset risk characters on subsequent detection and judgment can be avoided, and whether the request message has a security risk or not can be accurately determined from other layers.
The process of detecting the predetermined risk characters in the filtering request message may be performed by a payload filter configured in the server.
In an embodiment, when it is determined that the time difference is smaller than or equal to the preset time threshold according to the comparison result, the method may further include the following steps: determining a target authority related to the request message according to the request message; acquiring an authority table of the user according to the identity information of the user; determining whether the request message has an unauthorized operation or not according to the authority table of the user and the target authority; and under the condition that the request message is determined to have the unauthorized operation, determining that the first type of security risk exists in the request message.
In this embodiment, whether the request packet has a security risk may be further more finely determined from the authority level of the user by detecting whether the target authority involved in the request packet is unauthorized.
In one embodiment, the server may determine the data processing requested by the request message according to the specific message content of the request message; further, the function authority concerned can be determined as the target authority concerned by the request message according to the data processing. Further, the server can obtain the authority table of the user by inquiring the user authority database of the system according to the identity information of the user. And then, whether the target authority is matched with at least one authority in the authority table can be determined according to the authority table. And determining that the request message has unauthorized operation when the target authority is determined to be not matched with all the authorities in the authority table. At this time, it can be judged that the request message is abnormal and has a high probability of having an aggressive behavior, and it can be further determined that the request message has a first-class security risk. And sends the request message to the user classifier for processing.
The process of detecting the target permission related to the request message may be specifically performed by a functional permission verifier configured in the server.
It should be noted that, according to specific situations and security requirements, the above listed detection modes for detecting whether the request message has the first type of security risk may be flexibly configured and combined, so that whether the currently received request message has the first type of security risk may be precisely and accurately identified and determined.
In an embodiment, when the method is implemented in detail under the condition that it is determined that the request packet does not have the first type of security risk, the method may further include the following steps: responding to the request message, and performing corresponding data processing to obtain a corresponding reply message; and sending the reply message to the terminal equipment.
Specifically, for example, the server may respond to the request message when it is determined that the request message does not have the first type of security risk, complete data processing of the transfer service requested by the user, generate a corresponding reply message according to a processing result, and send the reply message to the terminal device to feed back to the user.
In one embodiment, it is considered that many service scenarios may also have a risk behavior of, for example, sending a request message that appears to be normal to pick up a reply message carrying sensitive information fed back by a server. The sensitive information may be specifically understood as data information that should not be leaked by the system server. Through the risk behaviors, leakage of system server data can be caused, and damage is caused to data security of the system.
Therefore, in order to avoid data leakage of the system server caused by the risk behavior, so as to further protect data security of the system, after the corresponding reply message is generated and before the reply message is sent to the terminal device, the server may further determine whether some sensitive information may be leaked from the reply message by detecting and judging information carried by the reply message, and may further return to judge whether the corresponding request message has a second type of security risk. The second type of security risk may be specifically understood as a security risk detected after the request message is responded and processed to obtain a corresponding reply message.
In an embodiment, before sending the reply message to the terminal device, when the method is implemented, the following may be further included: detecting whether the reply message carries a keyword related to sensitive information or not according to the preset fault-tolerant dictionary; and under the condition that the reply message is determined to carry the key words related to the sensitive information, determining that the request message has a second type of security risk.
In this embodiment, the preset fault-tolerant dictionary may be dictionary data storing keywords related to sensitive information.
In an embodiment, when detecting that a reply message carries one or more keywords related to sensitive information stored in a fault-tolerant dictionary, a server may determine that the reply request may reveal data information of a system server, and may further determine that a request message corresponding to the reply message has sensitive information with a higher probability in the system server, so that it may be determined that the request message has a second type of security risk.
In an embodiment, when the method is implemented specifically under the condition that it is determined that the request packet has the second type of security risk, the method may further include the following steps: acquiring misleading data; wherein the misleading data comprises honeypot server information; and replacing the reply message with the misleading data, and feeding back the misleading data to the terminal equipment.
The misleading data may be specifically understood as data that is different from data information carried in the original reply message and includes error information.
Specifically, the misleading data may specifically include honeypot server information, such as an irrational address of the honeypot server, system information of the honeypot server, and the like. The honeypot server is understood to be a bait server for misleading. Of course, the above listed honeypot server information is only a schematic illustration. In specific implementation, other types of error data may also be used as the misleading data according to specific situations.
In this embodiment, by sending misleading data instead of a reply message, fault-tolerant processing is performed, and the misleading data is fed back to the terminal device, which may cause interference to a third party such as a hacker who wants to collect sensitive information of the system server, and affect the judgment of the third party, thereby preventing the data information of the system server from being leaked, and protecting the data security of the system server.
The process of detecting the second type of security risk and performing the corresponding processing may be specifically performed by a solution processor configured in the server.
In an embodiment, when the method is implemented in a specific manner under the condition that it is determined that the request packet does not have the second type of security risk, the method may further include the following steps: generating a second key locally at the server according to a generation rule of the second key; encrypting the reply message by using a second secret key to obtain an encrypted reply message; and sending the encrypted reply message to the terminal equipment.
Therefore, data leakage caused by third interception of data information carried by the reply message in the interactive transmission process can be effectively avoided. Thereby the data security of the system can be better protected.
Correspondingly, after receiving the encrypted reply message, the terminal device may generate the same second key locally at the terminal device according to a generation rule of the second key; and the encrypted reply message is decrypted by using the second secret key to obtain plaintext data of the reply message.
In one embodiment, in each of the above processing procedures, the server may also submit the relevant information of the message data obtained in the processing procedure, the specific processing operation, and the like to the log recorder for recording, so as to establish a processing log of the server on the message data. Subsequently, the server can perform backtracking check on each processing process of the message data according to the processing log, so that the data security of the system can be better protected.
As can be seen from the above, in the method for processing message data provided in this specification, cookie data including at least a generation rule of a first key and a generation rule of a second key is sent to a terminal device through a server in advance; therefore, the server and the terminal equipment can respectively generate the first secret key and the second secret key locally without interactively transmitting related secret key data, so that the risk of revealing and intercepting the secret key data is reduced, and the data security is protected; further, before sending the request message, the terminal equipment encrypts the request message carrying the timestamp by using a first secret key and a second secret key which are locally generated; after receiving the encrypted request message, the server decrypts the request message by using a first secret key and a second secret key which are locally generated to obtain a timestamp of the request message; and detecting whether the request message has the first-class security risk or not according to the time information indicated by the timestamp and the receiving time of the encrypted request message. By the method, the data transmitted interactively can be effectively prevented from being tampered, whether the security risk exists in the request message received by the server can be accurately and efficiently detected with low processing cost, the data security of the server is protected, and the technical problems that the processing cost is high, the accuracy is high and the omission is easy to occur when the security risk of the message data is detected based on the existing method are solved. Furthermore, whether the first type of security risk exists in the request message is detected by adopting various different detection modes in a matching and combining manner; after determining that the request message has no first-class security risk, responding and processing the request message to obtain a corresponding reply message, before feeding back the reply message to the terminal device, determining whether the request message has a second-class security risk by detecting the reply message to avoid revealing data information of the system server, so that message data with the security risk can be detected more accurately and comprehensively, and the data security of the system server is better protected.
Referring to fig. 3, an embodiment of the present specification further provides a method for processing message data, where the method may be specifically applied to a side of a terminal device. The method may be embodied as follows.
S301: determining an interaction mode with a server according to the Cookie data; the Cookie data at least comprises a generation rule of a first secret key and a generation rule of a second secret key;
s302: under the condition that the interaction mode is determined to be the encryption mode, acquiring a generation rule of a first secret key and a generation rule of a second secret key from the Cookie data;
s303: generating a first secret key locally at the terminal equipment according to the generation rule of the first secret key, and encrypting the timestamp of the request message by using the first secret key to obtain a request message carrying the encrypted timestamp;
s304: generating a second secret key locally at the terminal equipment according to the generation rule of the second secret key, and encrypting the request message carrying the encrypted timestamp by using the second secret key to obtain an encrypted request message;
s305: and sending the encrypted request message to a server.
In an embodiment, before determining the interaction mode with the server according to the Cookie data, when the method is implemented, the method may further include: sending a login request to a server; the login request carries identity information and a login credential of a user; receiving Cookie data fed back by a server; the server generates and sends corresponding Cookie data to the terminal device under the condition that the identity information and the login credentials of the user are verified, wherein the Cookie data at least comprise: a session ID associated with the identity information of the user, a generation rule of the first key, and a generation rule of the second key.
In an embodiment, the Cookie data may further include a pattern identifier, and correspondingly, the determining the interaction pattern with the server according to the Cookie data may include, in a specific implementation,: and extracting the mode identification from the Cookie data, and determining an interaction mode with the server according to the mode identification.
In an embodiment, the generating, according to the generating rule of the first key, the first key locally generated at the terminal device may include: acquiring characteristic information of the terminal equipment according to a generation rule of the first secret key; generating a first character string according to the characteristic information of the terminal equipment; calculating a hash value of the first character string by using a first preset hash function to serve as a first hash value; and according to the generation rule of the first secret key, extracting the value on the first preset data bit from the first hash value to generate the first secret key.
In an embodiment, the generating, according to the rule of generating the second key, the second key locally generated at the terminal device may include: acquiring a current date character string and a session ID according to a generation rule of the second secret key; splicing the current date character string and the session ID to obtain a second character string; calculating a hash value of the second character string by using a second preset hash function to serve as a second hash value; and according to a generation rule of the second secret key, extracting a value on a second preset data bit from the second hash value to generate the second secret key.
Embodiments of the present specification further provide a server, including a processor and a memory for storing processor-executable instructions, where the processor, when implemented, may perform the following steps according to the instructions: receiving an encrypted request message sent by terminal equipment; the terminal equipment encrypts a timestamp of the request message by using a first secret key under the condition that the interaction mode is determined to be an encryption mode according to the Cookie data to obtain an encrypted timestamp; encrypting the request message carrying the encrypted timestamp by using a second secret key to obtain the encrypted request message; the first secret key is secret key data locally generated by the terminal equipment according to a generation rule of the first secret key; the second secret key is secret key data locally generated by the terminal equipment according to a generation rule of the second secret key; the Cookie data at least comprises a generation rule of a first secret key and a generation rule of a second secret key; generating a second secret key locally at the server according to the generation rule of the second secret key, and decrypting the encrypted request message by using the second secret key to obtain the request message carrying the encrypted timestamp; generating a first secret key locally at a server according to the generation rule of the first secret key, and decrypting the encrypted timestamp by using the first secret key to obtain a timestamp; and detecting whether the request message has a first-class security risk or not according to the time information indicated by the timestamp and the receiving time of the encrypted request message.
In order to more accurately complete the above instructions, referring to fig. 4, another specific server is provided in the embodiments of the present specification, wherein the server includes a network communication port 401, a processor 402, and a memory 403, and the above structures are connected by an internal cable, so that the structures may perform specific data interaction.
The network communication port 401 may be specifically configured to receive an encrypted request packet sent by a terminal device; the terminal equipment encrypts a timestamp of the request message by using a first secret key under the condition that the interaction mode is determined to be an encryption mode according to the Cookie data to obtain an encrypted timestamp; encrypting the request message carrying the encrypted timestamp by using a second secret key to obtain the encrypted request message; the first secret key is secret key data locally generated by the terminal equipment according to a generation rule of the first secret key; the second secret key is secret key data locally generated by the terminal equipment according to a generation rule of the second secret key; the Cookie data at least comprises a generation rule of a first secret key and a generation rule of a second secret key.
The processor 402 may be specifically configured to locally generate a second secret key at the server according to a generation rule of the second secret key, and decrypt the encrypted request packet by using the second secret key to obtain a request packet carrying an encrypted timestamp; generating a first secret key locally at a server according to the generation rule of the first secret key, and decrypting the encrypted timestamp by using the first secret key to obtain a timestamp; and detecting whether the request message has a first-class security risk or not according to the time information indicated by the timestamp and the receiving time of the encrypted request message.
The memory 403 may be specifically configured to store a corresponding instruction program.
In this embodiment, the network communication port 401 may be a virtual port that is bound to different communication protocols, so that different data can be sent or received. For example, the network communication port may be a port responsible for web data communication, a port responsible for FTP data communication, or a port responsible for mail data communication. In addition, the network communication port can also be a communication interface or a communication chip of an entity. For example, it may be a wireless mobile network communication chip, such as GSM, CDMA, etc.; it can also be a Wifi chip; it may also be a bluetooth chip.
In this embodiment, the processor 402 may be implemented in any suitable manner. For example, the processor may take the form of, for example, a microprocessor or processor and a computer-readable medium that stores computer-readable program code (e.g., software or firmware) executable by the (micro) processor, logic gates, switches, an Application Specific Integrated Circuit (ASIC), a programmable logic controller and embedded microcontroller, and so forth. The description is not intended to be limiting.
In this embodiment, the memory 403 may include multiple layers, and in a digital system, the memory may be any memory as long as binary data can be stored; in an integrated circuit, a circuit without a physical form and with a storage function is also called a memory, such as a RAM, a FIFO and the like; in the system, the storage device in physical form is also called a memory, such as a memory bank, a TF card and the like.
An embodiment of the present specification further provides a terminal device, including a processor and a memory for storing processor-executable instructions, where the processor, when implemented specifically, may perform the following steps according to the instructions: determining an interaction mode with a server according to the Cookie data; the Cookie data at least comprises a generation rule of a first secret key and a generation rule of a second secret key; under the condition that the interaction mode is determined to be the encryption mode, acquiring a generation rule of a first secret key and a generation rule of a second secret key from the Cookie data; according to the generation rule of the first secret key, the first secret key is locally generated in the terminal equipment, the timestamp of the request message is encrypted by the first secret key, and the request message carrying the encrypted timestamp is obtained; generating a second secret key locally at the terminal equipment according to the generation rule of the second secret key, and encrypting the request message carrying the encrypted timestamp by using the second secret key to obtain an encrypted request message; and sending the encrypted request message to a server.
An embodiment of the present specification further provides a computer storage medium based on the above message data processing method, where the computer storage medium stores computer program instructions, and when the computer program instructions are executed, the computer storage medium implements: receiving an encrypted request message sent by terminal equipment; the terminal equipment encrypts a timestamp of the request message by using a first secret key under the condition that the interaction mode is determined to be an encryption mode according to the Cookie data to obtain an encrypted timestamp; encrypting the request message carrying the encrypted timestamp by using a second secret key to obtain the encrypted request message; the first secret key is secret key data locally generated by the terminal equipment according to a generation rule of the first secret key; the second secret key is secret key data locally generated by the terminal equipment according to a generation rule of the second secret key; the Cookie data at least comprises a generation rule of a first secret key and a generation rule of a second secret key; generating a second secret key locally at the server according to the generation rule of the second secret key, and decrypting the encrypted request message by using the second secret key to obtain the request message carrying the encrypted timestamp; generating a first secret key locally at a server according to the generation rule of the first secret key, and decrypting the encrypted timestamp by using the first secret key to obtain a timestamp; and detecting whether the request message has a first-class security risk or not according to the time information indicated by the timestamp and the receiving time of the encrypted request message.
In this embodiment, the storage medium includes, but is not limited to, a Random Access Memory (RAM), a Read-Only Memory (ROM), a Cache (Cache), a Hard Disk Drive (HDD), or a Memory Card (Memory Card). The memory may be used to store computer program instructions. The network communication unit may be an interface for performing network connection communication, which is set in accordance with a standard prescribed by a communication protocol.
In this embodiment, the functions and effects specifically realized by the program instructions stored in the computer storage medium can be explained by comparing with other embodiments, and are not described herein again.
Referring to fig. 5, in a software layer, an embodiment of the present specification further provides a device for processing packet data, where the device may specifically include the following structural modules.
The receiving module 501 may be specifically configured to receive an encrypted request packet sent by a terminal device; the terminal equipment encrypts a timestamp of the request message by using a first secret key under the condition that the interaction mode is determined to be an encryption mode according to the Cookie data to obtain an encrypted timestamp; encrypting the request message carrying the encrypted timestamp by using a second secret key to obtain the encrypted request message; the first secret key is secret key data locally generated by the terminal equipment according to a generation rule of the first secret key; the second secret key is secret key data locally generated by the terminal equipment according to a generation rule of the second secret key; the Cookie data at least comprises a generation rule of a first secret key and a generation rule of a second secret key;
the processing module 502 may be specifically configured to locally generate a second secret key at the server according to a generation rule of the second secret key, and decrypt the encrypted request packet using the second secret key to obtain a request packet carrying an encrypted timestamp;
the processing module 502 may be further specifically configured to locally generate a first secret key at the server according to a generation rule of the first secret key, and decrypt the encrypted timestamp by using the first secret key to obtain a timestamp;
the detecting module 503 may be specifically configured to detect whether the request packet has a first type of security risk according to the time information indicated by the timestamp and the receiving time of the encrypted request packet.
It should be noted that, the units, devices, modules, etc. illustrated in the above embodiments may be implemented by a computer chip or an entity, or implemented by a product with certain functions. For convenience of description, the above devices are described as being divided into various modules by functions, and are described separately. It is to be understood that, in implementing the present specification, functions of each module may be implemented in one or more pieces of software and/or hardware, or a module that implements the same function may be implemented by a combination of a plurality of sub-modules or sub-units, or the like. The above-described embodiments of the apparatus are merely illustrative, and for example, the division of the units is only one type of logical functional division, and other divisions may be realized in practice, for example, multiple units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, devices or units, and may be in an electrical, mechanical or other form.
An embodiment of the present specification further provides another device for processing packet data, including: the determining module is specifically used for determining an interaction mode with the server according to the Cookie data; the Cookie data at least comprises a generation rule of a first secret key and a generation rule of a second secret key; the obtaining module is specifically configured to obtain a generation rule of a first secret key and a generation rule of a second secret key from the Cookie data when the interaction mode is determined to be the encryption mode; the processing module may be specifically configured to locally generate a first secret key at the terminal device according to a generation rule of the first secret key, and encrypt a timestamp of the request packet using the first secret key to obtain a request packet carrying the encrypted timestamp; the processing module may be further specifically configured to locally generate a second secret key at the terminal device according to a generation rule of the second secret key, and encrypt the request packet carrying the encrypted timestamp by using the second secret key to obtain an encrypted request packet; the sending module may be specifically configured to send the encrypted request packet to a server.
Therefore, the message data processing device provided in the embodiments of the present specification can effectively prevent data in interactive transmission from being tampered, can accurately and efficiently detect whether there is a security risk in a request message received by a server with a low processing cost, and protects data security of the server.
In a specific scenario example, the message data processing method provided in this specification may be applied to process message data received by a business data processing system of a bank. The following can be referred to as a specific implementation process.
Specifically, referring to fig. 6, based on the above message data processing method, a non-invasive modular application system security reinforcing framework including modules responsible for various types of detection (e.g., a tamper-proof checker, a transaction frequency limiter, a Payload filter, a functional authority checker, a fault-tolerant processor), a log recorder, and a user classifier is introduced at the side of the system server. And then the security reinforced framework can be used for detecting the security risk of the received message data and carrying out corresponding processing. The specific implementation process can comprise the following steps.
Step 1, a user operates at a client (namely terminal equipment), and the client generates a plaintext request message.
And 2, the client encrypts a plaintext request message according to an encryption switch (namely a mode identifier) in the Cookie (namely Cookie data), a timestamp key generation mode (namely a generation rule of a first secret key) and a message key generation mode (namely a generation rule of a second secret key), and sends a ciphertext (namely the encrypted request message) to the server.
And step 3, decrypting the ciphertext according to the encryption switch, the timestamp key generation mode and the message key generation mode which are currently configured at the server side to obtain a plaintext request message, and sending the plaintext request message to the tamper-proof checker in the step 4 and the log recorder in the step 15 for recording.
And 4, judging according to the decrypted timestamp in the message: if the server time (e.g., the time of receipt) minus the timestamp time is greater than a configured threshold (e.g., a preset time threshold), the request is determined to be a tamper message (it may be determined that there is a first type of security risk). At this point, the request is not further processed, and the message is submitted to the user classifier in step 13, and an error is returned. And if the time of the server minus the time of the timestamp is less than or equal to the configured threshold value, judging the request as a non-tampering message and submitting the non-tampering message to the transaction frequency limiter in the step 5.
Step 5, recording the user ID (for example, the identity information of the user) and the timestamp to a background and judging: 1) Whether the user's daily transaction amount exceeds a threshold; 2) Whether the user's current transaction frequency exceeds a threshold. If any one item exceeds the threshold value, the transaction is determined to be over-limit, at this time, the request is not further processed (it can be determined that the first type of security risk exists), and the message is submitted to the user classifier in step 13, and meanwhile, an error is returned. If neither item exceeds the threshold, the request is judged as a non-overrun message and submitted to the payload filter in step 6.
And 6, searching whether the request contains the payload (for example, the preset risk character) according to the payload dictionary (namely, the preset payload dictionary) configured by the server side. If yes, submitting the message to the user classifier in the step 13, simultaneously eliminating payload, submitting the eliminated message to the log recorder in the step 15, and submitting the eliminated message to the function authority verifier in the step 7; if not, the message is directly submitted to the function authority checker in the step 7.
And 7, after the user ID is matched according to the session ID in the message, inquiring the background permission table and inquiring to obtain the functional permission of the user, and checking whether the transaction submitted by the request accords with the functional permission of the user. If not (it can be determined that there is an override operation), the request is not further processed, and the message is submitted to the user classifier in step 13, and an error is returned.
And 8, basically eliminating the malicious attack behaviors existing in the user through the steps 4-7. This step calls the corresponding function handler to generate a plaintext response message (i.e., reply message), and at this time, this response message is submitted to the fault-tolerant processor of step 9 and to the log recorder of step 15.
And 9, receiving the plaintext response message, reading the fault-tolerant keyword dictionary (namely, a preset fault-tolerant dictionary), and searching whether the request contains the fault-tolerant keywords. If yes, reading error report information of the honeypots configured at the server side and returning the error report information as a response message to disturb judgment of hackers and submitting the fault-tolerant processed message to the log recorder in the step 15; if not, the message is submitted to step 10 to encrypt the response message by the server.
And step 10, the server side encrypts the response message according to the encryption switch and the key information and submits the message to the step 11, and the client side decrypts the response message.
And step 11, the client decrypts the response message according to the encryption switch and the key information in the Cookie, obtains a plaintext response message and submits the plaintext response message to step 12.
And step 12, the client analyzes the plaintext response, and the message interaction process is finished.
Step 13, the user classifier receives various request messages which are verified by the security component and are judged to be suspicious, records the messages and related data into a suspicious transaction table, counts the number of suspicious transactions in batches according to the user granularity, and records the users exceeding the limit into a blacklist user table (namely, a risk user blacklist).
Step 14, the blacklist user table can be used as a basis for judging whether the transaction message of a certain user needs to be encrypted in an intelligent encryption scene. Meanwhile, the blacklist user table can be used as one of the bases for judging and analyzing the abnormal behaviors of the user by the administrator. Because the data is recorded in the database, the development of developers for the second time is facilitated, the related front-end functions are developed, and managers can inquire and modify the blacklist data conveniently.
And step 15, receiving all original or plaintext messages processed by the security component through the log recorder, and recording fields for completely backtracking the transaction, such as message content, sequence number, client IP, timestamp, message type and the like.
It should be noted that the security reinforcing framework includes configuration items, and the configuration items may be stored in a configuration file on the server side. In order to better protect data security, attention needs to be paid to the modification authority of the configuration file so as to prevent the configuration file from being tampered or deleted by hackers. These configuration items may specifically include: message encryption switches (global on, global off, intelligent encryption), timestamp key generation mode, message key generation mode, tamper proof checker switch, message tamper proof threshold (unit: millisecond), transaction frequency limiter switch, total daily transaction amount threshold (X strokes), current transaction frequency threshold (X strokes per minute), payload filter switch, payload dictionary table (defined by regular expression), functional authority checker switch, fault tolerant processor switch, fault tolerant dictionary table (defined by regular expression), honeypot error reporting information, suspicious transaction threshold (suspicious transaction type + threshold) for user classifier, and the like.
Specifically, with respect to step 2, in a login scenario (which may be denoted as 2.1) in which the client encrypts the request message, reference may be made to fig. 7. Generally speaking, this is a step of initiating a session by each user, and through this step, the client acquires a message including a session ID, a message encryption switch, and a key generation mode, so as to verify and smoothly perform message encryption and decryption through the server in subsequent transactions, specifically: a client sends a login request; the server side verifies the user name (namely the identity of the user) and the password (namely the login credentials), and jumps to the login authentication page again if the verification is not passed. If the verification is passed, generating a session ID for the user, writing the session ID into the Cookie, and simultaneously recording the user ID and the session ID into a session temporary table; a server side reads a message encryption switch and a timestamp encryption key generation mode; when the message encryption switch: when the global is enabled, reading a message key generation mode and writing Cookie; when the message encrypts the switch: when the global is closed, writing a closing mark into the Cookie; when the message encrypts the switch: during intelligent encryption, the server back end associates to a user ID according to the session ID and inquires a blacklist user table, if the user is not in the blacklist, the processing is closed according to encryption, and if the user is in the blacklist, the processing is started according to encryption; and after the message encryption switch, the message key generation mode are acquired and the Cookie is written in, the timestamp key generation mode is read, and the Cookie is written in and then is transmitted back to the client. (in this case, the Cookie should include the session ID of the current session, the message encryption switch, the message, and the timestamp encryption key generation mode).
It should be noted that: whether the user is a blacklist user or not, a timestamp key generation mode needs to be obtained, and in the subsequent steps, a timestamp in a request message (namely, a request message) needs to be encrypted, so that the condition that the user intercepts and sends the message and tampers the timestamp in the message is avoided, and the control of a tamper-proof checker and a transaction frequency limiter is bypassed.
With respect to step 2, in a non-login scenario (which may be denoted as 2.2) in which the client encrypts the request message, reference may be made to fig. 8. Generally, this is a flow chart each time a user initiates a trigger regular transaction, specifically: the client triggers any non-login transaction; the client reads the Cookie; reading a timestamp encryption key generation mode in the Cookie and adding an encrypted timestamp when generating a request message; and reading a message encryption switch identifier in the cookie, if the cookie is opened, reading a message key generation mode, encrypting a request message, and finally sending the ciphertext request to the server. And if the message is closed, directly generating a plaintext request message and sending the plaintext request message to the server.
It should be noted that: 1) In this step, the timestamp needs to be encrypted first, and then the entire message needs to be encrypted. 2) The key for the message and the timestamp may provide two generation modes (e.g., a generation rule for the first key and a generation rule for the second key).
The first method may be to concatenate the character strings according to the current date and the session ID, for example, to obtain the following concatenated character strings: YYMMDD + sessionID, then converted into a fixed-length string through a hash algorithm (SHA 1 algorithm can be converted into 160 bits), and a plurality of bits of hash value is intercepted as a key (SHA 1 and other hash algorithms can be selected); the second method may be to concatenate the strings of front-end browser information (e.g., browser version number, screen resolution, operating system information, etc.) and then convert the concatenated strings into fixed-length strings through a hash algorithm. During configuration, different generation modes can be selected for the message and the timestamp key, and consistency between the message and the timestamp key is avoided.
The key is generated by the method, so that the consistency of the symmetric keys used by the front end and the back end is ensured (under the default condition, the encryption and decryption of the frame use symmetric encryption), the symmetric keys with different contents can be generated at each time, the plaintext transmission key is avoided, and the safety is improved. In addition, the front-end retrieval and debugging difficulty is increased through code obfuscation, and the encryption logic is hidden.
With respect to step 3, reference may be made to FIG. 9. Specifically, the method comprises the following steps: the server side receives the request message, checks the validity of the session, and jumps to a login page if the session is invalid; if the session is valid, reading a configuration file of the server side, and acquiring an encryption switch mark, a message and a timestamp key generation mode; and decrypting the message according to a key generation mode configured by the server side, and decrypting a timestamp field in the request. Generating a message serial number for the request, and submitting the message serial number, the message state (original) and the plaintext request message to a log recorder; and simultaneously to the next step tamper proof verifier.
It should be noted that: because the timestamp is encrypted before the whole message is encrypted, the whole message needs to be decrypted first and then the timestamp needs to be decrypted for the second time. After all decryption operations are completed, attaching a serial number and a state to the message, thereby forming a combined main key and recording the combined main key into a log so as to facilitate subsequent positioning of the request.
With respect to step 4, reference may be made to FIG. 10. Specifically, the method comprises the following steps: after the server acquires the plaintext request message, acquiring a decrypted timestamp field; reading a message tamper-proof threshold value configured at a server side; judging whether the timestamp time obtained by subtracting the request from the server time exceeds a threshold value or not; if yes, not processing the request, and returning error information; submitting the message serial number, the user ID and the suspicious type to a user classifier; if not, the request is submitted to the transaction frequency limiter.
It should be noted that: when the message tamper-proof threshold value is set, objective factors such as client performance of a user, network delay, time consumption of message encryption and decryption and the like are fully considered so as to avoid intercepting normal transactions.
With respect to step 5, reference may be made to FIG. 11. Specifically, the method comprises the following steps: after the anti-tampering check is passed, acquiring a decrypted timestamp field; matching a session temporary table according to a session ID in the request message and acquiring a user ID; recording the user ID and the message timestamp into a transaction frequency table; reading a transaction total amount threshold value of the server configured on the current day, and judging whether the transaction total amount of the user on the current day exceeds the threshold value (the transaction number of the user on the current day in the count transaction frequency table); if not, reading a current transaction frequency threshold configured at the server side, and judging whether the current transaction frequency of the user exceeds the threshold (if the current transaction occurs in 12 00; if not, the transaction is regarded as normal transaction and submitted to the next step; if the value exceeds any threshold value, the transaction is regarded as an overrun transaction, the request is not processed, the error report information is returned, and the message serial number, the user ID and the suspicious type are submitted to a user classifier.
It should be noted that: the default control granularity of the framework is global control, and secondary development can be carried out if the angle granularity, the mechanism granularity and the user granularity need to be accurately controlled. When the threshold value is set, special conditions, such as double 11 transaction peaks and the like, should be considered, and normal transactions are prevented from being intercepted.
With respect to step 6, reference may be made to FIG. 12. Specifically, the method comprises the following steps: receiving a plaintext request verified by a transaction frequency limiter; the server reads a currently configured payload dictionary; searching whether the request contains a payload dictionary; if the packet contains the packet, submitting the serial number of the packet, the user ID and the suspicious type to a user classifier, and simultaneously rejecting payload in the packet; submitting the request message, the message serial number and the message state (after payload filtering) with the payload removed to a log recorder; and submitting the request message after the payload is removed or the original message which does not contain the payload to the next step: and a functional authority checker.
It should be noted that: the invention is internally provided with a set of default payload dictionary tables to filter common Web attack payloads such as SQL injection, XSS, file inclusion, XML external entities and the like. The payload dictionary table can be flexibly configured by an administrator to deal with the payload variety or the novel vulnerability, and meanwhile, some payloads can be eliminated to avoid influencing normal transactions.
With respect to step 7, reference may be made to FIG. 13. Specifically, the method comprises the following steps: receiving a plaintext request filtered by payload; matching a session temporary table according to a session ID in the request message and acquiring a user ID; reading a background authority table according to the user ID to acquire the functional authority of the user; checking whether the function call submitted in the request conforms to the authority of the user; if not, not processing the request, returning error report information, and submitting the message serial number, the user ID and the suspicious type to a user classifier; if the function processing program is matched with the function processing program, the corresponding function processing program is called.
It should be noted that: the reason why the unauthorized problem is caused is that the back-end verification of the transaction content is not carried out, and the user can falsely pretend to be operated by other users by tampering the user ID in the message. Therefore, the component uses the session ID which is difficult to forge by the user and can declare the identity of the user as the identity ID of the user, and carries out authority verification at the server side, thereby solving the problems.
With respect to step 9, reference may be made to FIG. 14. Specifically, the method comprises the following steps: receiving a plaintext response message; the server reads the configured fault-tolerant keyword dictionary; searching whether response contains the fault-tolerant keywords; if yes, reading error report information of the honeypots configured at the server side and returning the error report information as a response message to disturb judgment of a hacker, and submitting the response message subjected to fault tolerance processing and a message serial number to a log recorder; if not, the response plaintext message is delivered to the back end of the response message for encryption.
It should be noted that: the server side can also be internally provided with a set of default fault-tolerant dictionary which comprises error-reporting information such as various databases and middleware, and whether response possibly reveals related server information is judged by searching whether response comprises the error-reporting keywords, so that information collectable by hackers is reduced, and the address of the honeypot server can be replaced by the address of the honeypot server. The fault tolerant dictionary also supports flexible configuration to enhance its filtering capabilities. In addition, the developer does not need to worry about not being able to obtain error information after rejecting fault-tolerant information because the complete error information has been submitted to the logger in step 8.
With respect to step 10, reference may be made to fig. 15, in particular: the server reads the message encryption switch; if the switch is globally enabled, reading a message key generation mode, encrypting a response message and transmitting the response message to the client; if the switch is closed globally, the plaintext response message is directly transmitted to the client; and if the switch is intelligently encrypted, matching the session temporary table according to the session ID, associating the session temporary table with the user ID and inquiring the blacklist user table, if the session temporary table is a non-blacklist user, directly transmitting a plaintext response message to the client, and if the session temporary table is a blacklist user, starting processing according to message encryption.
With respect to step 11, reference may be made to fig. 16, in particular: after receiving a response message returned by the server, the client reads an encryption switch identifier in the Cookie; if the key is opened, reading a message key generation mode in the Cookie, decrypting the response into a plaintext, and analyzing the plaintext response; if closed, the plaintext response is parsed directly.
It should be noted that: the client decryption process also improves the difficulty of front-end reading, debugging, decryption and cracking through a code obfuscation method.
In addition, the system security strengthening framework further comprises a user classifier and a log recorder.
The use of the upper user classifier is shown in fig. 17. Specifically, the method comprises the following steps: receiving suspicious users output by an anti-tampering checker, a transaction frequency limiter, a payload filter and a functional authority checker; recording the user ID, the message serial number, the suspicious type and the message date to a suspicious transaction message table; counting the number of suspicious transactions of user dimensions in end-of-day batches or timed batches; and recording users exceeding the threshold value to a blacklist user table according to the set suspicious transaction threshold value.
It should be noted that: the user classifier is one of core components in a system security strengthening framework, collects data of 4 abnormal transactions, and classifies users according to the number of abnormal transactions. Suspicious users are blacklisted (administrators can also manually adjust blacklists) and message-encrypted, thereby restricting them from initiating further suspicious activity. In addition, suspicious transaction messages collected by the user classifier can also be used as data samples for machine learning, and valuable data 'feed' is provided for fitting a malicious transaction model.
The use of the logging tool described above can be seen in fig. 18. Specifically, the method comprises the following steps: receiving a decrypted plaintext request, a plaintext request subjected to filtering payload, a response after normal processing and a response after fault-tolerant processing; and recording the message content, the message serial number, the client IP, the timestamp and the message type (request, response) to a log table.
It should be noted that: the logger records the complete process of one transaction from initiation-secure processing-return. And important basis is provided for safety personnel during safety event backtracking, safety problem analysis and safety inspection. In addition to integrity, the security log should be difficult to tamper with or delete. Therefore, the operation and maintenance personnel should carefully maintain the authority of the log file to ensure that hackers have difficulty tampering with or erasing the hacking action.
In this scenario example, based on the method for processing message data provided in the embodiments of the present specification, a non-invasive security reinforcement framework of a modular application system may be constructed, and after limited adaptation work is completed, protection capabilities of various security problems (transaction replay, malicious high-frequency transaction, transaction parameter tampering, SQL injection, XSS cross-site script, XXE external entity attack, unauthorized transaction, and the like) may be greatly improved. Meanwhile, thanks to the non-invasive design concept, the transformation is harmless on the service level; at the user level, this adaptation is imperceptible.
In addition, the traditional safety reinforcing idea of digging holes and filling holes is abandoned, and various frequent safety problems are avoided directly through modes such as encryption, filtering, server side verification and the like. Therefore, there is a clear advantage in terms of reinforcement efficiency. Meanwhile, the main components of the invention have good configuration flexibility, and besides the independent switches, the invention also provides freely customized configuration items to adapt to the characteristics of different systems and can be used for enhancing the protection performance; in addition, the components can operate independently, and system developers can match different reinforcement components according to needs to adapt to business systems
In the scene example, whether the request message has the security risk or not can be accurately detected with lower processing cost through the method.
Although the present specification provides method steps as described in the examples or flowcharts, additional or fewer steps may be included based on conventional or non-inventive means. The order of steps recited in the embodiments is merely one manner of performing the steps in a multitude of orders and does not represent the only order of execution. When implemented in practice, an apparatus or client product may execute sequentially or in parallel (e.g., in a parallel processor or multithreaded processing environment, or even in a distributed data processing environment) in accordance with the embodiments or methods depicted in the figures. The terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, the presence of additional identical or equivalent elements in a process, method, article, or apparatus that comprises the recited elements is not excluded. The terms first, second, etc. are used to denote names, but not any particular order.
Those skilled in the art will also appreciate that, in addition to implementing the controller as pure computer readable program code, the same functionality can be implemented by logically programming method steps such that the controller is in the form of logic gates, switches, application specific integrated circuits, programmable logic controllers, embedded microcontrollers and the like. Such a controller may therefore be considered as a hardware component, and the means included therein for performing the various functions may also be considered as a structure within the hardware component. Or even means for performing the functions may be regarded as being both a software module for performing the method and a structure within a hardware component.
This description may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, classes, etc. that perform particular tasks or implement particular abstract data types. The specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including memory storage devices.
From the above description of the embodiments, it is clear to those skilled in the art that the present specification can be implemented by software plus necessary general hardware platform. Based on such understanding, the technical solutions in this specification may be essentially embodied in the form of a software product, which may be stored in a storage medium, such as a ROM/RAM, a magnetic disk, an optical disk, etc., and includes several instructions for enabling a computer device (which may be a personal computer, a mobile terminal, a server, or a network device, etc.) to execute the methods described in the embodiments or some parts of the embodiments in this specification.
The embodiments in the present specification are described in a progressive manner, and the same or similar parts in the embodiments are referred to each other, and each embodiment focuses on differences from other embodiments. The description is operational with numerous general purpose or special purpose computing system environments or configurations. For example: personal computers, server computers, hand-held or portable devices, tablet-type devices, multiprocessor systems, microprocessor-based systems, set top boxes, programmable electronic devices, network PCs, minicomputers, mainframe computers, distributed computing environments that include any of the above systems or devices, and the like.
While the specification has been described with examples, those skilled in the art will appreciate that there are numerous variations and permutations of the specification that do not depart from the spirit of the specification, and it is intended that the appended claims include such variations and modifications that do not depart from the spirit of the specification.

Claims (26)

1. A method for processing message data is characterized by comprising the following steps:
receiving an encrypted request message sent by terminal equipment; the terminal equipment encrypts a timestamp of the request message by using a first secret key under the condition that the interaction mode is determined to be an encryption mode according to the Cookie data to obtain an encrypted timestamp; encrypting the request message carrying the encrypted timestamp by using a second secret key to obtain the encrypted request message; the first secret key is secret key data generated locally by the terminal equipment according to a generation rule of the first secret key; the second secret key is secret key data locally generated by the terminal equipment according to a generation rule of the second secret key; the Cookie data at least comprises a generation rule of a first secret key and a generation rule of a second secret key;
generating a second secret key locally at the server according to the generation rule of the second secret key, and decrypting the encrypted request message by using the second secret key to obtain the request message carrying the encrypted timestamp;
generating a first secret key locally at a server according to the generation rule of the first secret key, and decrypting the encrypted timestamp by using the first secret key to obtain a timestamp;
and detecting whether the request message has a first-class security risk or not according to the time information indicated by the timestamp and the receiving time of the encrypted request message.
2. The method according to claim 1, wherein before receiving the encrypted request message sent by the terminal device, the method further comprises:
receiving a login request sent by terminal equipment; the login request carries identity information and a login credential of a user;
under the condition that the identity information of the user and the login certificate are verified, generating a session ID associated with the identity information of the user, and determining a corresponding interaction mode;
generating a generation rule of a first secret key and a generation rule of a second secret key under the condition that the corresponding interaction mode is determined to be the encryption mode;
storing the session ID, the generation rule of the first secret key and the generation rule of the second secret key in Cookie data;
and feeding the Cookie data back to the terminal equipment.
3. The method of claim 2, wherein determining the corresponding interaction mode comprises:
inquiring a risk user blacklist according to the identity information of the user to obtain a corresponding inquiry result; the risk user blacklist stores identity information of risk users;
and according to the query result, determining that the corresponding interaction mode is an encryption mode under the condition that the user is determined to belong to the risk user.
4. The method of claim 2, wherein after saving the session ID, the generation rule for the first key, and the generation rule for the second key in Cookie data, the method further comprises:
encrypting the Cookie data to obtain ciphertext data of the Cookie data;
and feeding back the ciphertext data of the Cookie data to the terminal equipment.
5. The method according to claim 2, wherein generating the second key locally at the server according to the generation rule of the second key comprises:
acquiring a current date character string and a session ID corresponding to the encrypted request message according to a generation rule of the second secret key;
splicing the current date character string and the session ID to obtain a second character string;
calculating a hash value of the second character string by using a second preset hash function to serve as a second hash value;
and according to a generation rule of the second secret key, extracting a numerical value on a second preset data bit from the second hash value to generate the second secret key.
6. The method according to claim 2, wherein the encrypted request packet further carries characteristic information of the terminal device; wherein the characteristic information includes at least one of: the version number of the browser logged in by the terminal equipment, the screen resolution of the terminal equipment and the system information of the terminal equipment.
7. The method according to claim 6, wherein generating the first secret key locally at the server according to the rule for generating the first secret key comprises:
acquiring characteristic information of the terminal equipment according to a generation rule of the first secret key;
generating a first character string according to the characteristic information of the terminal equipment;
calculating a hash value of the first character string by using a first preset hash function to serve as a first hash value;
and according to the generation rule of the first secret key, extracting the value on the first preset data bit from the first hash value to generate the first secret key.
8. The method according to claim 2, wherein detecting whether the request packet has a first type of security risk according to the time information indicated by the timestamp and the receiving time of the encrypted request packet comprises:
calculating a time difference between the time information and the receiving time;
comparing the time difference value with a preset time threshold value to obtain a corresponding comparison result;
and according to the comparison result, determining that the first type of security risk exists in the request message under the condition that the time difference is larger than the preset time threshold.
9. The method of claim 8, wherein after determining that the request packet has a first type of security risk, the method further comprises:
stopping processing the request message and generating risk prompt information;
sending the request message to a user classifier; the user classifier is used for generating a risk user blacklist according to the received request message with the first type of security risks.
10. The method of claim 8, further comprising:
according to the comparison result, under the condition that the time difference value is determined to be smaller than or equal to the preset time threshold, obtaining and inquiring the log record of the system according to the identity information of the user so as to obtain the behavior statistical data of the user in a preset time period; wherein, the behavior statistical data of the user in the preset time period comprises: the total amount of message data sent by a user in a preset time period and/or the frequency of sending the message data;
and determining whether the first type of security risk exists in the request message according to the behavior statistical data of the user in the preset time period.
11. The method according to claim 10, wherein in case it is determined, according to the comparison result, that the time difference is less than or equal to the preset time threshold, the method further comprises:
detecting whether the request message carries preset risk characters or not according to a preset payload dictionary; wherein the preset risk character comprises: risk characters related to SQL injection, risk characters related to XSS, risk characters related to XML external entities;
under the condition that the request message is determined to carry preset risk characters, marking the request message as a potential risk message;
and sending the potential risk message to a user classifier.
12. The method according to claim 10, wherein in case it is determined that the time difference value is less than or equal to the preset time threshold value according to the comparison result, the method further comprises:
determining a target authority related to the request message according to the request message;
acquiring an authority table of a user according to the identity information of the user;
determining whether the request message has an unauthorized operation according to the authority table of the user and the target authority;
and under the condition that the request message is determined to have the unauthorized operation, determining that the request message has a first type of security risk.
13. The method of claim 1, wherein in the case that it is determined that the request packet does not have the first type of security risk, the method further comprises:
responding to the request message, and performing corresponding data processing to obtain a corresponding reply message;
and sending the reply message to the terminal equipment.
14. The method according to claim 13, wherein before sending the reply message to the terminal device, the method further comprises:
detecting whether the reply message carries a keyword related to sensitive information or not according to a preset fault-tolerant dictionary;
and under the condition that the reply message is determined to carry the keywords related to the sensitive information, determining that the request message has a second type of security risk.
15. The method according to claim 14, wherein in case that it is determined that the request packet has a security risk of the second type, the method further comprises:
acquiring misleading data; wherein the misleading data comprises honeypot server information;
and replacing the reply message with the misleading data, and feeding back the misleading data to the terminal equipment.
16. The method according to claim 14, wherein in case it is determined that the request packet does not have the second type of security risk, the method further comprises:
generating a second key locally at the server according to a generation rule of the second key;
encrypting the reply message by using a second secret key to obtain an encrypted reply message;
and sending the encrypted reply message to the terminal equipment.
17. A method for processing message data is characterized by comprising the following steps:
determining an interaction mode with a server according to the Cookie data; the Cookie data at least comprises a generation rule of a first secret key and a generation rule of a second secret key;
under the condition that the interaction mode is determined to be the encryption mode, acquiring a generation rule of a first secret key and a generation rule of a second secret key from the Cookie data;
according to the generation rule of the first secret key, the first secret key is locally generated in the terminal equipment, the timestamp of the request message is encrypted by the first secret key, and the request message carrying the encrypted timestamp is obtained;
generating a second secret key locally at the terminal equipment according to the generation rule of the second secret key, and encrypting the request message carrying the encrypted timestamp by using the second secret key to obtain an encrypted request message;
sending the encrypted request message to a server, so that the server performs the following operations: generating a second secret key locally at the server according to the generation rule of the second secret key, and decrypting the encrypted request message by using the second secret key to obtain the request message carrying the encrypted timestamp; generating a first secret key locally at a server according to the generation rule of the first secret key, and decrypting the encrypted timestamp by using the first secret key to obtain a timestamp; and detecting whether the request message has a first-class security risk or not according to the time information indicated by the timestamp and the receiving time of the encrypted request message.
18. The method of claim 17, wherein prior to determining the interaction pattern with the server based on the Cookie data, the method further comprises:
sending a login request to a server; the login request carries identity information and a login credential of a user;
receiving Cookie data fed back by the server; the server generates and sends corresponding Cookie data to the terminal equipment under the condition that the identity information and the login certificate of the user are verified; the Cookie data at least comprises: a session ID associated with the identity information of the user, a generation rule of the first key, and a generation rule of the second key.
19. The method of claim 18, wherein the Cookie data further comprises a pattern identifier, and wherein determining the interaction pattern with the server based on the Cookie data comprises:
extracting the pattern identification from the Cookie data;
and determining an interaction mode with the server according to the mode identification.
20. The method according to claim 17, wherein generating the first secret key locally at the terminal device according to the rule for generating the first secret key comprises:
acquiring characteristic information of the terminal equipment according to a generation rule of the first secret key;
generating a first character string according to the characteristic information of the terminal equipment;
calculating a hash value of the first character string by using a first preset hash function to serve as a first hash value;
and according to the generation rule of the first secret key, extracting the value on the first preset data bit from the first hash value to generate the first secret key.
21. The method according to claim 17, wherein generating the second secret key locally at the terminal device according to the generation rule of the second secret key comprises:
acquiring a current date character string and a session ID according to a generation rule of the second secret key;
splicing the current date character string and the session ID to obtain a second character string;
calculating a hash value of the second character string by using a second preset hash function to serve as a second hash value;
and according to a generation rule of the second secret key, extracting a numerical value on a second preset data bit from the second hash value to generate the second secret key.
22. A message data processing apparatus, comprising:
the receiving module is used for receiving the encrypted request message sent by the terminal equipment; the terminal equipment encrypts a timestamp of the request message by using a first secret key under the condition that the interaction mode is determined to be an encryption mode according to the Cookie data to obtain an encrypted timestamp; encrypting the request message carrying the encrypted timestamp by using a second secret key to obtain the encrypted request message; the first secret key is secret key data locally generated by the terminal equipment according to a generation rule of the first secret key; the second secret key is secret key data locally generated by the terminal equipment according to a generation rule of the second secret key; the Cookie data at least comprises a generation rule of a first secret key and a generation rule of a second secret key;
the processing module is used for locally generating a second secret key at the server according to the generation rule of the second secret key, and decrypting the encrypted request message by using the second secret key to obtain the request message carrying the encrypted timestamp;
the processing module is further configured to locally generate a first secret key at the server according to a generation rule of the first secret key, and decrypt the encrypted timestamp by using the first secret key to obtain a timestamp;
and the detection module is used for detecting whether the request message has the first type of security risk or not according to the time information indicated by the timestamp and the receiving time of the encrypted request message.
23. A message data processing apparatus, comprising:
the determining module is used for determining an interaction mode with the server according to the Cookie data; the Cookie data at least comprises a generation rule of a first secret key and a generation rule of a second secret key;
the acquisition module is used for acquiring a generation rule of a first secret key and a generation rule of a second secret key from the Cookie data under the condition that the interaction mode is determined to be the encryption mode;
the processing module is used for locally generating a first secret key at the terminal equipment according to the generation rule of the first secret key, and encrypting the timestamp of the request message by using the first secret key to obtain the request message carrying the encrypted timestamp;
the processing module is further configured to locally generate a second secret key at the terminal device according to a generation rule of the second secret key, and encrypt the request packet carrying the encrypted timestamp by using the second secret key to obtain an encrypted request packet;
a sending module, configured to send the encrypted request packet to a server, so that the server performs the following operations: generating a second secret key locally at the server according to the generation rule of the second secret key, and decrypting the encrypted request message by using the second secret key to obtain the request message carrying the encrypted timestamp; generating a first secret key locally at a server according to the generation rule of the first secret key, and decrypting the encrypted timestamp by using the first secret key to obtain a timestamp; and detecting whether the request message has a first-class security risk or not according to the time information indicated by the timestamp and the receiving time of the encrypted request message.
24. A server comprising a processor and a memory for storing processor-executable instructions which, when executed by the processor, implement the steps of the method of any one of claims 1 to 16.
25. A terminal device comprising a processor and a memory for storing processor-executable instructions which, when executed by the processor, implement the steps of the method of any one of claims 17 to 21.
26. A computer readable storage medium having stored thereon computer instructions which, when executed by a processor, carry out the steps of the method of any of claims 1 to 16, or 17 to 21.
CN202011144928.9A 2020-10-23 2020-10-23 Message data processing method and device, server and terminal equipment Active CN112217835B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202011144928.9A CN112217835B (en) 2020-10-23 2020-10-23 Message data processing method and device, server and terminal equipment

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202011144928.9A CN112217835B (en) 2020-10-23 2020-10-23 Message data processing method and device, server and terminal equipment

Publications (2)

Publication Number Publication Date
CN112217835A CN112217835A (en) 2021-01-12
CN112217835B true CN112217835B (en) 2022-11-04

Family

ID=74056472

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202011144928.9A Active CN112217835B (en) 2020-10-23 2020-10-23 Message data processing method and device, server and terminal equipment

Country Status (1)

Country Link
CN (1) CN112217835B (en)

Families Citing this family (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112995138B (en) * 2021-02-03 2022-12-27 上海钧正网络科技有限公司 Data communication method and device, electronic equipment and readable storage medium
CN113422758B (en) * 2021-06-08 2023-04-07 深圳市欢太数字科技有限公司 Data encryption method and device, internet of things system, electronic equipment and storage medium
CN113452710B (en) * 2021-06-28 2022-12-27 深圳前海微众银行股份有限公司 Unauthorized vulnerability detection method, device, equipment and computer program product
CN113794702A (en) * 2021-08-31 2021-12-14 杭州控客信息技术有限公司 Communication high-level encryption method in intelligent household system
CN113792314B (en) * 2021-09-17 2024-11-22 北京中网易企秀科技有限公司 A secure access method, device and system
CN114339630B (en) * 2021-11-30 2023-07-21 度小满科技(北京)有限公司 Method and device for protecting short message
CN114548899A (en) * 2022-01-11 2022-05-27 北京思特奇信息技术股份有限公司 A method and system for invoking customer data for preventing plug-ins
CN114499847A (en) * 2022-01-20 2022-05-13 无锡众星微系统技术有限公司 Sensitive information writing method in chip production test stage
CN114465710A (en) * 2022-01-21 2022-05-10 安徽华云安科技有限公司 A traffic-based vulnerability detection method, device, device and storage medium
CN114491518B (en) * 2022-01-27 2025-09-19 中国农业银行股份有限公司 Unauthorized access detection method, device, system and medium
CN114866309B (en) * 2022-04-28 2024-03-08 四川万网鑫成信息科技有限公司 Data transmission method, system, equipment and medium
CN115643117B (en) * 2022-12-23 2023-03-21 北京六方云信息技术有限公司 Digital entity identity identification method, device, terminal equipment and storage medium
CN117579392B (en) * 2024-01-16 2024-04-16 北京富通亚讯网络信息技术有限公司 Reliable data transmission method, device, equipment and medium based on encryption processing

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102647461A (en) * 2012-03-29 2012-08-22 奇智软件（北京）有限公司 Communication method, server and terminal based on hypertext transfer protocol
WO2017210038A1 (en) * 2016-06-01 2017-12-07 Mastercard International Incorporated Method and system for authorization using a public ledger and encryption keys
CN108959990A (en) * 2017-05-23 2018-12-07 中国移动通信有限公司研究院 A kind of verification method and device of two dimensional code

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102647461A (en) * 2012-03-29 2012-08-22 奇智软件（北京）有限公司 Communication method, server and terminal based on hypertext transfer protocol
WO2017210038A1 (en) * 2016-06-01 2017-12-07 Mastercard International Incorporated Method and system for authorization using a public ledger and encryption keys
CN108959990A (en) * 2017-05-23 2018-12-07 中国移动通信有限公司研究院 A kind of verification method and device of two dimensional code

Also Published As

Publication number Publication date
CN112217835A (en) 2021-01-12

Similar Documents

Publication Publication Date Title
CN112217835B (en) Message data processing method and device, server and terminal equipment
US10680812B2 (en) Event attestation for an electronic device
CN108780485B (en) Pattern matching based data set extraction
CN108304704B (en) Authority control method and device, computer equipment and storage medium
CN112131564B (en) Method, device, equipment and medium for encrypting data communication
US9584543B2 (en) Method and system for web integrity validator
US9294489B2 (en) Method and apparatus for detecting an intrusion on a cloud computing service
CN108347361B (en) Application program testing method and device, computer equipment and storage medium
JP2022037896A (en) Automation method for responding to threat
CN112149123B (en) Safety inspection system and method for application program
US20110314297A1 (en) Event log authentication using secure components
US20150229667A1 (en) Self-destructing content
CN119442290A (en) Data isolation and privacy protection method and system for large data security models
CN108694329B (en) Mobile intelligent terminal security event credible recording system and method based on combination of software and hardware
EP3420694B1 (en) Systems and methods for recognizing and categorizing a device
CN104657504A (en) Fast file identification method
KR20200080776A (en) Data security apparatus
Sorge IT Security measures and their relation to data protection
CN110610103A (en) Method and device for verifying confidential document
CN120034395B (en) Full lifecycle key management service method and system supporting KMIP protocol
CN119676001B (en) Data encryption transmission method and device with early warning mechanism
Changsan et al. Log4shell Investigate Based On Generic Computer Forensic Investigation Model
Das et al. Cryptolog: A new approach to provide log security for digital forensics
Hohenegger Developing a vulnerability assessment concept for eHealth iOS applications
Flores Armas Theory and practice of proactive database forensics

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant