Business processing security verification method and device

Abstract

The present invention provides a business processing safety verification method and device. The method includes: querying a local database to obtain a codebook and unused identification bits, and obtaining a random number according to the codebook and identification bits; using the random number to process the service request data Symmetric encryption, and use a fixed key to encrypt the identification bit; send the symmetrically encrypted service request data and the encrypted identification bit, and receive a return package, which includes the service processing data returned for the service request data and the returned encrypted identification bit; use the fixed key to decrypt the returned encrypted identification bit; in the case that the decrypted returned identification bit is invalid, refuse to perform further business processing on the returned business processing data; If the returned identification bit is valid, the returned service processing data is decrypted by using the decrypted returned identification bit for further service processing. The invention can improve the security of business processing.

Description

technical field [0001] The invention relates to the technical field of Internet information security, in particular to a business processing security verification method and device. Background technique [0002] At present, the information transmission between the mobile client and the server of the Internet instant messaging system generally uses a symmetric encryption algorithm to ensure the security of customer information and prevent customer information from being stolen. The server side needs to prevent malicious attacks on the client side. For example, after illegal personnel intercept client transactions, they make frequent repeated calls (for example, query related transactions), which puts pressure on the application server cluster. [0003] The original symmetric encryption key consists of three parts: random number, gesture password lock and fixed key string. Among them, the random number is updated once a day. Therefore, when the gesture password and the fixed ...

AI Technical Summary

Problems solved by technology

Although malicious attacks cannot decipher the ciphertext tampering, they can intercept the request return packet and replace the return packet of the same scenario business, resulting in transaction failure or abnormal results display

In addition, high-frequency repeated calls to intercepted transactions (for example, query related transactions) will also put a certain pressure on the application server cluster

Images