Data processing method, device, electronic device, system and storage medium

Abstract

The embodiment of the present invention discloses a data processing method, device, electronic device, system and storage medium, the method comprising: receiving service request information sent by a client; serializing the service request information through a service container of a first service instance to generate a Json string, and performing a legality check on the type information in the Json string through a proxy container of the first service instance; when the check result shows that the type information is legal, calling the service container of a second service instance to deserialize the Json string. The embodiment of the present invention can effectively resist attacks and protect data security.

Description

Technical Field

[0001] The present invention relates to data security technology, and in particular to a data processing method, device, electronic equipment, system and storage medium. Background Art

[0002] Fastjson is an open source library that uses Java language to implement high performance, complete functions, and fully supports the Json standard. It is the most widely used library that supports the Json format in the entire Java technology stack. In the process of implementing the present invention, the inventor found that Fastjson has a high-risk vulnerability and is easily attacked. Summary of the invention

[0003] Embodiments of the present invention provide a data processing method, device, electronic device, system and storage medium, which can effectively resist attacks and protect data security.

[0004] In a first aspect, an embodiment of the present invention provides a data processing method, including:

[0005] Receive business request information sent by the client;

[0006] Serializing the business request information through the business container of the first service instance to generate a Json string, and performing a legality check on the type information in the Json string through the proxy container of the first service instance;

[0007] When the check result shows that the type information is legal, the business container of the second service instance is called to deserialize the Json string.

[0008] In a second aspect, an embodiment of the present invention provides a data processing device, including:

[0009] A receiving module, used for receiving service request information sent by a client;

[0010] A first control module, configured to serialize the business request information through a business container of a first service instance to generate a Json string, and perform a validity check on the type information in the Json string through a proxy container of the first service instance;

[0011] The second control module is used to call the business container of the second service instance to deserialize the Json string when the check result shows that the type information is legal.

[0012] In a third aspect, an embodiment of the present invention provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the data processing method as described in the first aspect of the embodiment of the present invention is implemented.

[0013] In a fourth aspect, an embodiment of the present invention provides a data processing system, including a client, a management terminal, and a server for executing the data processing method as described in the first aspect of the embodiment of the present invention.

[0014] In a fifth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the data processing method as described in the first aspect of the embodiment of the present invention.

[0015] In the embodiment of the present invention, when receiving the service request information sent by the client, the service request information can be serialized by the service container of the first service instance to generate a Json string, and the type information in the Json string can be checked for legality by the proxy container of the first service instance. When the check result shows that the type information is legal, the service container of the second service instance is called to deserialize the Json string. That is, in the embodiment of the present invention, the proxy container of the first service instance is used to filter the Json string, thereby preventing criminals from injecting illegal type information into the Json string, thereby effectively resisting attacks and ensuring data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a flowchart of a data processing method provided by an embodiment of the present invention.

[0017] Figure 2 It is a schematic diagram of an interaction method between service instances provided by an embodiment of the present invention.

[0018] Figure 3 It is another flowchart of the data processing method provided by an embodiment of the present invention.

[0019] Figure 4 It is a structural schematic diagram of a data processing device provided by an embodiment of the present invention.

[0020] Figure 5 It is a structural schematic diagram of a data processing system provided by an embodiment of the present invention.

[0021] Figure 6 It is a structural schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0022] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only parts related to the present invention, rather than all structures, are shown in the accompanying drawings.

[0023] Since Fastjson has a high-risk vulnerability, criminals can easily exploit the AutoType mechanism provided by Fastjson to inject the class they want to attack into the @type field of the Json string, thereby launching a network attack and causing data security to be compromised. Therefore, an embodiment of the present invention provides a data processing method to resist network attacks and protect data security.

[0024] Figure 1 A flow chart of a data processing method provided in an embodiment of the present invention is provided. The method can be executed by a data processing device provided in an embodiment of the present invention, and the device can be implemented in software and / or hardware. In a specific embodiment, the device can be integrated in a server, and the following embodiments will be described by taking the device integrated in a server as an example.

[0025] In a specific implementation, a Kubernetes tool can be installed in a server, and an Istio platform for running multiple service instances can be built on the Kubernetes tool. Among them, the Kubernetes tool, which can be referred to as the K8s tool, is a container orchestration engine open sourced by Google, which is mainly responsible for the operation of containers on the host, as well as the scheduling and orchestration of containers. The Istio platform is an open platform for connecting, securing, controlling and observing services. Specifically in an embodiment of the present invention, the Istio platform is built on the K8s tool, the Istio platform and the K8s tool are functionally complementary, containers are used to implement different services, and the Istio platform built on the K8s tool is used to manage these service instances. In an embodiment of the present invention, each service instance has a business container and a proxy container, the business container of each service instance is mainly responsible for implementing the business logic, and the proxy container of each service instance is mainly responsible for implementing the underlying technical system, and the business logic and non-business logic of the service instance are decoupled through the two containers.

[0026] In a specific embodiment, Figure 2 As shown, the multiple service instances may include a first service instance and a second service instance, wherein the second service instance may be a target service instance called by the first service instance, that is, the first service instance is a calling service instance and the second service instance is a called service instance.

[0027] The following will Figure 1 and Figure 2 In combination, the data processing method provided by the embodiment of the present invention is described, and the method may specifically include the following steps:

[0028] Step 101: receiving service request information sent by a client.

[0029] For example, the client is installed with a preset application, such as a shopping application or an information application. When a user needs to use a service provided by the preset application, the user can operate in the preset interface of the client, thereby sending service request information to the server, and the service request information includes at least one service element. For example, when a user purchases a target item through a shopping application, the user can initiate a payment request information to the server through the client installed with the shopping application. The payment request information is the service request information, and the payment request information may include the name, model, and quantity of the target item purchased by the user, the user's name, delivery address, Internet Protocol Address (IP Address), etc. The information included in the payment request information may be the service element.

[0030] Step 102: The business container of the first service instance serializes the business request information to generate a Json string, and the proxy container of the first service instance performs a validity check on the type information in the Json string.

[0031] Generally speaking, a business requires multiple service instances on the server to access and call each other to be implemented. For example, for payment services, it may be necessary for the settlement service instance and the coupon service instance to call each other to be implemented. Therefore, after receiving the business request information, the server can first determine the service instance that can process the business request information, and send the business request information to any service instance among the service instances that can process the business request information, such as the first service instance. After receiving the business request information, the business container of the first service instance can parse the business request information, process the business part that it can process, and generate a Json string based on the parsing result and the business processing result. The Json string includes at least one business element and type information of at least one business element, wherein the type information of at least one business element can be marked in the form of @type.

[0032] After the business container of the first service instance generates a Json string, the Json string can be redirected to the proxy container of the first service instance. The proxy container of the first service instance performs a validity check on the type information included in the Json string. After the check passes, the Json string is sent to the second service instance.

[0033] A specific redirection method, for example, may be to create an iptables rule in the business container of the first service instance, and use the iptables rule to redirect the Json string generated by the business container of the first service instance to the proxy container of the first service instance.

[0034] In a specific implementation, the proxy container of the first service instance can use the pre-acquired and stored type filter list to perform a validity check on the type information. In an embodiment of the present invention, the Istio platform includes an Istio control component and a data component. The Istio control component can be composed of components such as Pilot, Mixer, and Citadel. The data component can be composed of proxy containers of various service instances. The proxy container of the first service instance can obtain the type filter list from the management end through the Istio control component.

[0035] In a specific embodiment, the type filter list may include preset legal type information, that is, the type filter list is a white list, and all classes in the white list are allowed to pass. In a specific embodiment, the type filter list may also include preset illegal type information, that is, the type filter list is a black list, and all classes in the black list are not allowed to pass.

[0036] In a specific implementation, when the type filter list includes preset legal type information, that is, when the type filter list is a whitelist, the proxy container of the first service instance can check whether the type information contained in the Json string is legal in the following method: determine whether the type information exists in the type filter list stored in the proxy container of the first service instance, if it exists, determine that the type information is legal, if not, determine that the type information is illegal. That is, if the type information is in the corresponding whitelist, the type information is legal, if the type information is not in the corresponding whitelist, the type information is illegal.

[0037] In a specific implementation, when the type filter list includes preset illegal type information, that is, when the type filter list is a blacklist, the proxy container of the first service instance can check whether the type information contained in the Json string is legal in the following method: determine whether the type information exists in the type filter list stored in the proxy container of the first service instance, if it exists, determine that the type information is illegal, if not, determine that the type information is legal. That is, if the type information is in the corresponding blacklist, the type information is illegal, if the type information is not in the corresponding blacklist, the type information is legal.

[0038] Step 103: When the check result shows that the type information is legal, the business container of the second service instance is called to deserialize the Json string.

[0039] For example, when the check result shows that the type information is legal, the proxy container of the second service instance can be called to forward the Json string to the business container of the second service instance through the proxy container of the second service instance, and the business container of the second service instance deserializes the Json string. When the business container of the second service instance deserializes the Json string, the corresponding business element can be deserialized into the class indicated by the type information according to the type information contained in the Json string.

[0040] After deserializing the Json string, the business container of the second service instance can execute the corresponding business processing logic based on the deserialized data. After the processing is completed, the business response information can be sent to the first service instance through the proxy container of the second service instance, and the first service instance forwards the business response information to the client.

[0041] In addition, when the check result shows that the type of information is illegal, the proxy container of the first service instance can also directly discard the Json string to prevent the illegal Json string from flowing to the second service instance, and send error notification information to the client through the business container of the first service instance.

[0042] The above technical solution, when receiving the business request information sent by the client, can serialize the business request information through the business container of the first service instance to generate a Json string, and perform a legality check on the type information in the Json string through the proxy container of the first service instance. When the check result shows that the type information is legal, the business container of the second service instance is called to deserialize the Json string, that is, the Json string is filtered through the proxy container of the first service instance, thereby preventing criminals from injecting illegal type information into the Json string, thereby effectively resisting attacks and ensuring data security.

[0043] It should be noted that the embodiment of the present invention only takes the example that multiple service instances include a first service instance and a second service instance, and the first service instance is a caller service instance and the second service instance is a called service instance. In some specific application scenarios, the server side may also include other service instances, the first service instance may also be a called service instance, and the second service instance may also be a caller service instance, which is not specifically limited here. When a service instance acts as a caller service instance, the processing flow it executes may refer to the processing flow of the first service instance in the embodiment of the present invention (i.e., the business container of the service instance is responsible for the processing logic of generating a Json string, and the proxy container of the service instance is responsible for the processing logic of type filtering, data forwarding, etc.); when a service instance acts as a called service instance, the processing flow it executes may refer to the processing flow of the second service instance in the embodiment of the present invention (i.e., the proxy container of the service instance is responsible for the data forwarding processing logic, and the business container of the service instance is responsible for the processing logic of string deserialization, business execution, etc.).

[0044] The following further describes the data processing method provided by the embodiment of the present invention. Figure 3 , the method of this embodiment includes the following steps:

[0045] Step 301: Obtain a type filter list configured for the first service instance from the management end through the Istio control component.

[0046] In a specific implementation, the management end can be the administrator's terminal. The K8s tool in the server can open a K8s API for the management end. The Istio control component in the server can establish a connection with the management end through the K8s API. The management end can provide the administrator with a K8s API interface. The administrator can configure a type filter list for each service instance in the K8s API interface. The server can obtain the type filter list configured for the first service instance from the K8s API of the management end through the Istio control component.

[0047] Istio provides a service authorization mechanism for access between service instances within the service grid based on the RBAC mechanism. The service authorization mechanism solves the problem of how a service instance (such as service instance A) can access / call another service instance (such as service instance B). Obviously, in this example, service instance A is the caller service instance, service instance B is the called service instance, and the data flow is from service instance A to service instance B. Istio also provides a target service rule custom resource object (Custom Resource Definition, CRD). The target service rule custom resource object CRD can be used to define service roles. The service role actually describes a set of permissions, each of which is a specific rule. For example, the definition of a target service rule custom resource object CRD can be as follows:

[0048]

[0049] That is, the rule stipulates that the service instance B named nsl can only be accessed through GET. The target service rule custom resource object CRD here is used to describe how the "target service instance" provides services to the outside world. It can limit the way the target service instance provides services from multiple dimensions (such as: the version of the target service instance, the IP and port of the target service instance, the label of the target service instance, etc.). In the target service rule custom resource object CRD, there is a constraint field, which allows customizing some "key (key) / value (value)" pairs. These "key / value" pairs are used to enhance the access constraints to the target service instance.

[0050] Specifically in an embodiment of the present invention, on the management side, the Constraints field can be expanded, some new "key / value" pairs can be expanded in the Constraints field, and the type filter list configured by the administrator can be stored in these expanded new "key / value" pairs in the form of "key / value" pairs.

[0051] In a specific embodiment, the type filter list may include preset legal type information, that is, the type filter list is a white list, and all classes in the white list are allowed to pass. The type filter list may be stored in the Constraints field in the following manner:

[0052] Key: destination.wlist; #Name of the whitelist

[0053] Value: A string separated by separators (such as ;), for example: x1.y1.z1.item; xx1.yy1.zz1.item1.

[0054] In a specific embodiment, the type filter list may also include preset illegal type information, that is, the type filter list is a blacklist, and all classes in the blacklist are not allowed to pass. The type filter list may be stored in the Constraints field in the following manner:

[0055] Key: destination.blist; #The name of the blacklist

[0056] Value: A string separated by separators (such as ;), for example: x2.y2.z2.item; xx2.yy2.zz2.item2.

[0057] When the server obtains the type filter list configured for the first service instance from the management end through the Istio control component, the specific steps are as follows:

[0058] First, the target service rule custom resource object CRD is obtained from the management end through the Istio control component. The target service rule custom resource object CRD includes the constraint field Constraints. Then, the Istio control component parses the Constraints field to obtain the type filter list configured for the first service instance.

[0059] Step 302: Send the type filter list to the proxy container of the first service instance through the Istio control component.

[0060] In the specific implementation, the Istio platform generally runs multiple service instances. All service instances running on the Istio platform will be registered with the Istio control component of the Istio platform, and the Istio control component will save all type filter lists obtained from the management end. Each type filter list also includes the service identifier of the called service instance. The Istio control component, as the manager of each service instance, can know the service instance that each service instance needs to call. Therefore, after the Istio control component obtains the type filter list, it can determine the matching relationship between each type filter list and each service instance according to the registration information of each service instance, the service identifier of the service instance called by each service instance, and the service identifier of the called service instance included in each type filter list. According to the matching relationship, the type filter list configured for the first service instance is determined, and the type filter list configured for the first service instance is sent to the proxy container of the first service instance.

[0061] For example, the registration information of service instance A includes the address and port number of service instance A. The service instance to be called by service instance A is service instance B. The service identifier of the called service instance contained in type filter list 1 is the service identifier of service instance B, that is, the called service instance is service instance B. Then the Istio control component can determine that type filter list 1 matches service instance A, and can send type filter list 1 to the proxy container of service instance A through the xDS protocol based on the address and port number of service instance A.

[0062] Step 303: receiving service request information sent by the client.

[0063] For example, the client is installed with a preset application, such as a shopping application or an information application. When a user needs to use a service provided by the preset application, the user can operate in the preset interface of the client, thereby sending service request information to the server, and the service request information includes at least one service element. For example, when a user purchases a target item through a shopping application, the user can initiate a payment request information to the server through the client installed with the shopping application. The payment request information is the service request information, and the payment request information may include the name, model, and quantity of the target item purchased by the user, the user's name, delivery address, Internet Protocol Address (IP Address), etc. The information included in the payment request information may be the service element.

[0064] Step 304: The business container of the first service instance serializes the business request information to generate a Json string, and the proxy container of the first service instance performs a validity check on the type information in the Json string.

[0065] Generally speaking, a business requires multiple service instances on the server to access and call each other to be implemented. For example, for payment services, it may be necessary for the settlement service instance and the coupon service instance to call each other to be implemented. Therefore, after receiving the business request information, the server can first determine the service instance that can process the business request information, and send the business request information to any service instance among the service instances that can process the business request information, such as the first service instance. After receiving the business request information, the business container of the first service instance can parse the business request information, process the business part that it can process, and generate a Json string based on the parsing result and the business processing result. The Json string includes at least one business element and type information of at least one business element, wherein the type information of at least one business element can be marked in the form of @type.

[0066] After the business container of the first service instance generates a Json string, the Json string can be redirected to the proxy container of the first service instance. The proxy container of the first service instance performs a validity check on the type information included in the Json string. After the check passes, the Json string is sent to the second service instance.

[0067] A specific redirection method, for example, may be to create an iptables rule in the business container of the first service instance, and use the iptables rule to redirect the Json string generated by the business container of the first service instance to the proxy container of the first service instance.

[0068] In a specific implementation, the proxy container of the first service instance may use a pre-acquired and stored type filter list to perform a validity check on the type information.

[0069] For example, when the type filter list includes preset legal type information, that is, when the type filter list is a whitelist, the proxy container of the first service instance can check whether the type information contained in the Json string is legal in the following method: determine whether the type information exists in the type filter list stored in the proxy container of the first service instance, if it exists, determine that the type information is legal, if not, determine that the type information is illegal. That is, if the type information is in the corresponding whitelist, the type information is legal, if the type information is not in the corresponding whitelist, the type information is illegal.

[0070] For example, when the type filter list includes preset illegal type information, that is, when the type filter list is a blacklist, the proxy container of the first service instance can check whether the type information contained in the Json string is legal in the following method: determine whether the type information exists in the type filter list stored in the proxy container of the first service instance, if it exists, determine that the type information is illegal, if not, determine that the type information is legal. That is, if the type information is in the corresponding blacklist, the type information is illegal, if the type information is not in the corresponding blacklist, the type information is legal.

[0071] Step 305, determine whether the type of information is legal, if legal, execute step 306, otherwise, execute step 307.

[0072] Step 306: Call the business container of the second service instance to deserialize the Json string.

[0073] For example, when the check result shows that the type information is legal, the proxy container of the second service instance can be called to forward the Json string to the business container of the second service instance through the proxy container of the second service instance, and the business container of the second service instance deserializes the Json string. When the business container of the second service instance deserializes the Json string, the corresponding business element can be deserialized into the class indicated by the type information according to the type information contained in the Json string.

[0074] After deserializing the Json string, the business container of the second service instance can execute the corresponding business processing logic based on the deserialized data. After the processing is completed, the business response information can be sent to the first service instance through the proxy container of the second service instance, and the first service instance forwards the business response information to the client.

[0075] Step 307: Send error notification information to the client through the business container of the first service instance.

[0076] That is, when the check result shows that the type of information is illegal, the proxy container of the first service instance can also directly discard the Json string to prevent the illegal Json string from flowing to the second service instance, and at the same time send error notification information to the client through the business container of the first service instance.

[0077] The above technical solution, when receiving the business request information sent by the client, can serialize the business request information through the business container of the first service instance to generate a Json string, and perform a legality check on the type information in the Json string through the proxy container of the first service instance. When the check result shows that the type information is legal, the business container of the second service instance is called to deserialize the Json string, that is, the Json string is filtered through the proxy container of the first service instance, thereby preventing criminals from injecting illegal type information into the Json string, thereby effectively resisting attacks and ensuring data security.

[0078] Furthermore, the proxy container of the first service instance executes the type filtering logic, and the business container of the second service instance executes the deserialization processing logic of the Json string, thereby achieving a complete decoupling of type filtering and business processing logic. The type filtering mechanism executed by the proxy container cannot be interfered with by the user's business code, thereby avoiding the type filtering mechanism from being bypassed, further ensuring data security.

[0079] In addition, since type filtering is completely decoupled from business processing logic, the configuration and modification of type filtering logic do not depend on business processing logic. Therefore, the type filtering logic can be dynamically modified and updated without affecting normal business processing. It can also effectively filter new classes that appear in real time and can be used by criminals, greatly improving data security.

[0080] Figure 4 The present invention is a structural diagram of a data processing device provided by an embodiment, the data processing device is applied to a server, a Kubernetes tool is installed in the server, an Istio platform for running multiple service instances is built on the Kubernetes tool, each of the multiple service instances has a business container and a proxy container, the multiple service instances include a first service instance and a second service instance called by the first service instance, the device is suitable for executing the data processing method provided by an embodiment of the present invention, such as Figure 4 As shown, the device may specifically include:

[0081] Receiving module 401, used to receive service request information sent by the client;

[0082] The first control module 402 is used to serialize the business request information through the business container of the first service instance to generate a Json string, and perform a legality check on the type information in the Json string through the proxy container of the first service instance;

[0083] The second control module 403 is used to call the business container of the second service instance to deserialize the Json string when the check result shows that the type information is legal.

[0084] In one embodiment, the data processing device further includes:

[0085] The third control module is used to obtain the type filter list configured for the first service instance from the management end through the Istio control component, and send the type filter list to the proxy container of the first service instance through the Istio control component.

[0086] In one embodiment, the third control module obtains the type filter list configured for the first service instance from the management end through the Istio control component, including:

[0087] The type filter list is obtained from a preset application programming interface API of the management end through the Istio control component, and the preset application programming interface API is a Kubernetes application programming interface API open to the management end.

[0088] In one embodiment, the third control module obtains the type filter list configured for the first service instance from the management end through the Istio control component, including:

[0089] Obtaining a target service rule custom resource object CRD from the management end through the Istio control component, wherein the target service rule custom resource object CRD includes a constraint field Constraints;

[0090] The Istio control component parses the constraint field to obtain the type filter list.

[0091] In one embodiment, the first control module 402 performs a validity check on the type information in the Json string through the proxy container of the first service instance, including:

[0092] The type information is checked for legality using the type filter list through the proxy container of the first service instance.

[0093] In one embodiment, the type filter list includes preset legal type information, and the first control module 402 uses the type filter list to perform a legality check on the type information through the proxy container of the first service instance, including: determining whether the type information exists in the type filter list through the proxy container of the first service instance, if so, determining that the type information is legal, and if not, determining that the type information is illegal;

[0094] Or the type filter list includes preset illegal type information, and the first control module 402 uses the type filter list through the proxy container of the first service instance to perform a legitimacy check on the type information, including: determining whether the type information exists in the type filter list through the proxy container of the first service instance, and if so, determining that the type information is illegal; if not, determining that the type information is legal.

[0095] In one embodiment, the first control module 402 is further configured to:

[0096] An iptables rule is created in the business container of the first service instance, and the iptables rule is used to redirect the Json string to the proxy container of the first service instance.

[0097] In one embodiment, the first control module 402 is further configured to:

[0098] When the checking result is that the type information is illegal, error notification information is sent to the client through the business container of the first service instance.

[0099] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example for illustration. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. The specific working process of the functional modules described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0100] The device of the embodiment of the present invention, when receiving the service request information sent by the client, can serialize the service request information through the service container of the first service instance to generate a Json string, and perform a legality check on the type information in the Json string through the proxy container of the first service instance, and when the check result shows that the type information is legal, call the service container of the second service instance to deserialize the Json string. That is, in the embodiment of the present invention, the proxy container of the first service instance is used to filter the Json string, so as to prevent criminals from injecting illegal type information into the Json string, thereby effectively resisting attacks and ensuring data security.

[0101] An embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the data processing method provided in any of the above embodiments is implemented.

[0102] An embodiment of the present invention further provides a computer-readable medium on which a computer program is stored. When the program is executed by a processor, the data processing method provided by any of the above embodiments is implemented.

[0103] The embodiment of the present invention also provides a data processing system, such as Figure 5 As shown, it includes a client 501, a server 502 for executing the data processing method of the embodiment of the present invention, and a management terminal 503.

[0104] Among them, there is a network between the client 501, the server 502, and the management end 503. The network is used to provide a medium for the communication link between the client 501, the server 502, and the management end 503. The network can include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0105] The user can use the client 501 to interact with the server 502 through the network to receive or send messages, etc. Various client applications can be installed on the client 501, such as enterprise applications, e-commerce applications, web browser applications, search applications, instant messaging tools, and mailboxes.

[0106] The client 501 may be any electronic device having a display screen and supporting any client application, including but not limited to a smart phone, a tablet computer, a laptop computer, a desktop computer, and the like.

[0107] The server 502 may be a server that provides various services, such as a background management server that provides support for the service request website sent by the user using the client 501. The background management server may process the received service request and feed back the processing result to the client 501.

[0108] It should be noted that the data processing method provided in the embodiment of the present invention is generally executed by the server 502 , and accordingly, the data processing device is generally set in the server 502 .

[0109] The administrator can use the management terminal 503 to interact with the server 502 through the network to receive or send information, etc. The management terminal 503 can be various electronic devices with a display screen and supporting various applications, including but not limited to smart phones, tablet computers, laptops, desktop computers, etc.

[0110] The management end 503 can establish a connection with the K8s tool in the server 502 through the K8s API. The management end 503 can provide the administrator with a K8s API interface. The administrator can configure a type filter list for each service instance in the K8s API interface. The management end 503 can have a target service rule controller. The target service rule controller can monitor the administrator's configuration in the K8s API interface through the list / watch mechanism. When it is monitored that the administrator has configured a type filter list, the type filter list is obtained and stored in a database. The type filter lists stored in the database can be browsed and queried by different administrators, that is, the type filter lists configured by different administrators through the management end can eventually be stored in the database. In this way, the type filter lists are centrally and uniformly managed, which facilitates information sharing between different administrators.

[0111] At the same time, the type filter list configured by the administrator for each service instance in the K8s API interface can be perceived by the Istio control component in the server 502. The Istio control component can obtain the type filter list configured for each service instance and send the type filter list to the proxy container of the corresponding service instance, so that the proxy container of the corresponding service instance can use the type filter list to perform a validity check on the type information contained in the Json string when obtaining the Json string.

[0112] In addition, the administrator can also modify the type filter list configured for one or some service instances in the K8s API interface; on the one hand, when the modification is perceived by the Istio control component in the server 502, the Istio control component obtains the modified type filter list and sends the modified type filter list to the proxy container of the corresponding service instance; on the other hand, when the target service rule controller monitors that the administrator has modified the type filter list, it can obtain the modified type filter list and use the modified type filter list to replace the previously stored corresponding type filter list. In this way, for new classes that can be used by criminals in real time, the administrator can promptly add these classes to the type filter list, thereby timely and effectively filtering out illegal new classes, improving the emergency response capabilities of service instances to emergencies, and greatly improving data security.

[0113] For other technical details not described in detail in this embodiment, please refer to the description of the previous embodiments and will not be repeated here.

[0114] Reference below Figure 6 , which shows a schematic diagram of the structure of a computer system 700 of an electronic device suitable for implementing an embodiment of the present invention. Figure 6 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0115] like Figure 6 As shown, the computer system 700 includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage part 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the system 700 are also stored. The CPU 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0116] Typically, the following components are connected to the I / O interface 705: an input section 706 including a keyboard, a mouse, etc.; an output section 707 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, a modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 710 as needed, so that a computer program read therefrom is installed into the storage section 708 as needed.

[0117] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 709, and / or installed from the removable medium 711. When the computer program is executed by the central processing unit (CPU) 701, the above-mentioned functions defined in the system of the present invention are executed.

[0118] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0119] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0120] The modules and / or units involved in the embodiments of the present invention may be implemented in software or hardware. The modules and / or units described may also be arranged in a processor. For example, they may be described as follows: a processor includes a receiving module, a first control module, and a second control module. The names of these modules do not, in some cases, constitute limitations on the modules themselves.

[0121] As another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiment; or it may exist independently without being assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by a device, the device includes: receiving business request information sent by the client; serializing the business request information through the business container of the first service instance to generate a Json string, and performing a legality check on the type information in the Json string through the proxy container of the first service instance; when the check result shows that the type information is legal, calling the business container of the second service instance to deserialize the Json string.

[0122] According to the technical solution of the embodiment of the present invention, when receiving the business request information sent by the client, the business request information can be serialized by the business container of the first service instance to generate a Json string, and the type information in the Json string can be checked for legality by the proxy container of the first service instance. When the check result shows that the type information is legal, the business container of the second service instance is called to deserialize the Json string. That is, in the embodiment of the present invention, the proxy container of the first service instance is used to filter the Json string, which prevents criminals from injecting illegal type information into the Json string, thereby effectively resisting attacks and ensuring data security.

[0123] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A data processing method, characterized in that: include: Receive business request information sent by the client; Parsing the business request information and processing the corresponding business logic through the business container of the first service instance, generating a Json string according to the parsing result and the business processing result, redirecting the Json string to the proxy container of the first service instance, and performing a legality check on the type information in the Json string through the proxy container of the first service instance; When the check result shows that the type information is legal, the Json string is sent to the proxy container of the second service instance, the proxy container of the second service instance is called to forward the Json string to the business container of the second service instance, and the business container of the second service instance is called to deserialize the Json string and execute corresponding business logic according to the deserialized data; The second service instance is a target service instance called by the first service instance to process the business request information.

2. The data processing method according to claim 1, characterized in that: Before receiving the service request information sent by the client, it also includes: Obtaining a type filter list configured for the first service instance from the management end through the Istio control component; The type filter list is sent to the proxy container of the first service instance through the Istio control component.

3. The data processing method according to claim 2, characterized in that: The obtaining, from the management end, a type filter list configured for the first service instance through the Istio control component includes: The type filter list is obtained from a preset application programming interface API of the management end through the Istio control component, and the preset application programming interface API is a Kubernetes application programming interface API open to the management end.

4. The data processing method according to claim 2, characterized in that: The obtaining, from the management end, a type filter list configured for the first service instance through the Istio control component includes: Obtaining a target service rule custom resource object CRD from the management end through the Istio control component, wherein the target service rule custom resource object CRD includes a constraint field Constraints; The Istio control component parses the constraint field to obtain the type filter list.

5. The data processing method according to claim 2, characterized in that: The performing a validity check on the type information in the Json string through the proxy container of the first service instance includes: The type information is checked for legality using the type filter list through the proxy container of the first service instance.

6. The data processing method according to claim 5, characterized in that: The type filter list includes preset legal type information, and the checking the legality of the type information by using the type filter list through the proxy container of the first service instance includes: determining whether the type information exists in the type filter list through the proxy container of the first service instance, and if so, determining that the type information is legal, and if not, determining that the type information is illegal; Or the type filter list includes preset illegal type information, and the proxy container of the first service instance uses the type filter list to check the legitimacy of the type information, including: determining whether the type information exists in the type filter list through the proxy container of the first service instance, if so, determining that the type information is illegal, and if not, determining that the type information is legal.

7. The data processing method according to claim 1, characterized in that: Before the proxy container of the first service instance performs a validity check on the type information in the Json string, the method further includes: An iptables rule is created in the business container of the first service instance, and the iptables rule is used to redirect the Json string to the proxy container of the first service instance.

8. The data processing method according to claim 1, characterized in that: The method further comprises: When the checking result is that the type information is illegal, error notification information is sent to the client through the business container of the first service instance.

9. A data processing device, characterized in that: include: A receiving module, used for receiving service request information sent by a client; A first control module is used to parse the business request information and process the corresponding business logic through the business container of the first service instance, generate a Json string according to the parsing result and the business processing result, redirect the Json string to the proxy container of the first service instance, and perform a legality check on the type information in the Json string through the proxy container of the first service instance; A second control module is used to send the Json string to the proxy container of the second service instance when the check result shows that the type information is legal, call the proxy container of the second service instance to forward the Json string to the business container of the second service instance, call the business container of the second service instance to deserialize the Json string and execute corresponding business logic according to the deserialized data; The second service instance is a target service instance called by the first service instance to process the business request information.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the data processing method according to any one of claims 1 to 8 is implemented.

11. A data processing system, characterized in that: It comprises a client, a management terminal and a server for executing the data processing method as claimed in any one of claims 1 to 8.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the data processing method according to any one of claims 1 to 8 is implemented.

Images