Data transmission method, system, computer equipment, and medium based on security verification

Abstract

The present invention belongs to the field of data processing technology, and discloses a data transmission method, system, computer equipment, and medium based on security verification. In the data transmission method based on security verification, the client calculates a signature for the request; the server encrypts, decrypts, and verifies the signature at the time of the request, determines whether it has access rights, and makes a service response. The data encryption of this solution can prevent most acts of espionage, increase the cost of espionage, and thus improve the integrity of the data; it is more suitable for mobile applications: Cookies do not support access from mobile phones; during network transmission, the performance is better; the encryption and decryption processes are all on the server side, avoiding the exposure of the encryption and decryption process. This solution utilizes random seeds, dynamic salt values, and AES encryption, which greatly improves the security of the secret key. The encrypted transmission method of this solution can be called by a third-party interface, and the dynamic secret key can be used independently for different services.

Description

Technical Field

[0001] The present invention belongs to the field of data processing technology, and in particular relates to a data transmission method, system, computer equipment, and medium based on security verification. Background Art

[0002] Currently, HTTP is an object-oriented protocol belonging to the application layer. Due to its simplicity and speed, it is suitable for distributed hypermedia information systems. With the development of web applications, the security requirements of the HTTP protocol have reached an unprecedented level.

[0003] During network transmission, data synchronization issues between services are often encountered, which requires calling the interface services of third-party systems. Therefore, transmission security becomes particularly important.

[0004] Five common ways to ensure transmission security:

[0005] Token authorization and authentication to prevent unauthorized users from accessing data;

[0006] Timestamp timeout mechanism;

[0007] URL signature to prevent request parameters from being tampered with;

[0008] Anti-replay, prevent the interface from being requested a second time, and prevent collection;

[0009] Use HTTPS communication protocol to prevent data transmission in plain text.

[0010] There are two verification methods in actual work:

[0011] (1)Internal company interfaces, including:

[0012] Of course, when the company's internal interface involves relatively confidential information, the caller needs to hold a private key. When calling, the incoming parameters will be encrypted with the private key. If the encrypted content can be decrypted by the public key, then it can pass.

[0013] (2) Calling third-party interfaces, including:

[0014] Communication uses https;

[0015] Request signature to prevent parameters from being tampered with;

[0016] Identity confirmation mechanism, each request must be verified to be legitimate;

[0017] All requests and responses are encrypted and decrypted.

[0018] Prior art 1, a data transmission method, comprising:

[0019] When the current data transmission scenario is a preset data transmission scenario, a corresponding OFDMA sub-channel is allocated to each target neighbor device in the wireless personal area network;

[0020] The data in the preset data transmission scenario is transmitted to each target neighbor device through the sub-channel.

[0021] Prior art 2, a distributed data encryption and decryption method, applied to a distributed data encryption and decryption system, the system comprising: an encryption engine, a file system, and a distributed file storage cluster, characterized in that the distributed data encryption and decryption method comprises the following steps:

[0022] When the encryption engine performs a write operation on the file system according to the first encryption protocol, it encrypts the passing data stream to form a data ciphertext and stores it in the distributed file storage cluster;

[0023] When the encryption engine performs a read operation on the file system according to the second encryption protocol, it obtains the data ciphertext and decrypts it to form data plaintext.

[0024] Prior art three, a data decryption method, applied to a smart terminal, wherein the smart terminal includes a pressure touch sensing module provided on a frame, characterized in that the method includes:

[0025] receiving a pressing event recorded by the user through the pressure touch sensing module;

[0026] Determining whether the pressing event matches a preset data decryption event;

[0027] When the pressing event matches the preset data decryption event, the data is decrypted.

[0028] Through the above analysis, the problems and defects of the existing technology are as follows:

[0029] (1) In the existing technology, data encryption cannot prevent theft of secrets, and the cost of theft is high.

[0030] (2) The data transmission mode in the existing technology does not support mobile phone access; during the network transmission process, the performance is poor.

[0031] (3) In the existing technology, the encryption and decryption process is prone to information exposure and has poor security.

[0032] (4) In the existing technology, the encrypted transmission method cannot be used independently for different server connections, and its practicality is poor.

[0033] The difficulty of solving the above problems and defects is:

[0034] When generating a secret key, you need to consider its length and complexity. The longer the key, the higher the complexity, but the slower the network transmission. Therefore, a balance needs to be struck between length and complexity.

[0035] Access restrictions on hosts need to take into account binding and unbinding.

[0036] The significance of solving the above problems and defects is:

[0037] The present invention increases the complexity by making the secret key consist of multiple information such as timestamp + encrypted content + special symbols;

[0038] This invention uses Redis and filters to limit access to specific hosts and limit access peaks. This improves access security, reduces data packet loss, avoids DoS attacks, and increases system security. Summary of the Invention

[0039] In order to solve the problems in the prior art, the present invention provides a data transmission method, system, computer device and medium based on security verification. The present invention provides a decryption process that uses a secret key to encrypt again and compare the plaintext content to determine whether it passes the verification.

[0040] The present invention provides a method for generating a random seed key and a dynamic salt value, wherein the random seed has 32 bits, thereby improving the security of the key. The present invention provides an access IP restriction, which limits the access host in advance.

[0041] The present invention is implemented as follows: a data transmission method based on security verification includes: based on security access verification, limiting host access and access peak, and based on the data encryption method of AES algorithm and dynamic salt value double encryption, transmitting secure data with a third-party system.

[0042] Furthermore, the data transmission method based on security verification specifically includes:

[0043] Step 1: When the client requests data from the interface, the request parameter Param is first calculated using the encrypted characters pig and dog as the dynamic salt value salt, access_token, and timestamp to obtain the signature and put it into the request header;

[0044] Step 2: The server obtains the header parameters in the restful request;

[0045] Step 3: The filter obtains the signature carried by the authorization and checks whether it is consistent; at the same time, the server encrypts, decrypts and verifies the signature of the request;

[0046] Step 4: If the signature values ​​are consistent, access is allowed; if they are inconsistent, access is not allowed.

[0047] Furthermore, in step 3, the server encrypts the signature of the request including:

[0048] Initialize and generate four root key files (pig, cat, bird, dog), input the encrypted key and description content to generate the key, and save the key to the json file on the server;

[0049] Then input the encrypted content and use AES to encrypt the secret key and encrypted content to obtain the ciphertext.

[0050] Furthermore, during the data encryption process, the four root key files are first read, and the key files are XORed one by one to obtain the password segment. Then, the encryption salt value is obtained by performing AND operation on the dog and pig password files, and then the key content is AES encrypted to obtain the final key value.

[0051] Furthermore, when encrypting user passwords, the same password or weak password is saved as different ciphertexts using a random seed key and a dynamic salt value generation method.

[0052] Furthermore, in step 3, the server decrypts the signature of the request including:

[0053] When sending a request, the current timestamp, random number, and plaintext request parameters are sent. The signature key is calculated using the secret key, timestamp, random number, request address, and parameters. When the signature is consistent with the signature in the authorization, access is allowed after verification; otherwise, access is denied.

[0054] Another object of the present invention is to provide a data transmission system based on security verification, comprising:

[0055] The client calculates the signature based on the dynamic salt value, access_token, timestamp, and request parameters used in the request.

[0056] Request sending module, used to send restful requests;

[0057] Filter, used to obtain the signature carried by Authorization and determine whether it is consistent;

[0058] The server is used to encrypt, decrypt, and verify the signature of the request; if they are consistent, access is allowed; if they are inconsistent, access is not allowed.

[0059] Another object of the present invention is to provide a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the data transmission method based on security verification.

[0060] Another object of the present invention is to provide a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the data transmission method based on security verification.

[0061] Another object of the present invention is to provide a distributed hypermedia information system, which executes the data transmission method based on security verification.

[0062] Combining all the above technical solutions, the advantages and positive effects of the present invention are as follows:

[0063] The data encryption of the present invention can prevent most of the theft behaviors, reduce the cost of theft, and thus improve the integrity of data;

[0064] More suitable for mobile applications: Cookies do not support mobile access;

[0065] During network transmission, the performance is better;

[0066] The encryption and decryption processes are both on the server side, avoiding exposure of the encryption and decryption processes.

[0067] The present invention utilizes random seeds, dynamic salt values, and AES (Advanced Encryption Standard) encryption, which is more flexible than the DES algorithm in designing key lengths and is impossible to crack using exhaustive methods, thus greatly improving the security of the secret key.

[0068] The encrypted transmission method of the present invention can be called by a third-party interface, and the dynamic key can be used independently for different services. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Figure 1 This is a flow chart of a data transmission method based on security verification provided by an embodiment of the present invention.

[0070] Among them: the request parameters, current timestamp, access_token and dynamic salt value are calculated together to sign: sign = MD5 (request parameters + timestamp + access_token + dynamic salt value).

[0071] Figure 2 It is a schematic diagram of the encryption process and decryption process provided by an embodiment of the present invention.

[0072] Figure 3 This is a schematic diagram of the encryption and decryption algorithm provided by an embodiment of the present invention.

[0073] Figure 4This is a schematic diagram of an application example of a data transmission method based on security verification provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0074] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0075] In order to solve the problems existing in the prior art, the present invention provides a data transmission method, system, computer device and medium for security verification. The present invention is described in detail below with reference to the accompanying drawings.

[0076] The present invention is mainly aimed at the secure transmission method within the company, and has been expanded and strengthened in the direction of identity verification. Systems involved in identity authentication need to store user authentication information. Common user authentication methods are mainly username and password methods. For security reasons, the password entered by the user needs to be saved in ciphertext form. A publicly available irreversible hash encryption algorithm can be used, such as the secure hash algorithm SHA256, SHA512, SHA3, etc. For the same password, the same encryption algorithm will produce the same hash value. In this way, when the user authenticates his identity, the same hash encryption algorithm can also be applied to the plaintext password entered by the user to obtain a hash value, and then the hash value is used to compare with the previously stored ciphertext value. If the two values ​​are the same, the password authentication is successful, otherwise the password authentication fails.

[0077] Since the password is set by the user, in actual applications, the password complexity set by the user may not be high enough. At the same time, different users are very likely to use the same password, so the ciphertexts corresponding to these users will also be the same. In this way, when the database storing user passwords is leaked, attackers will be able to easily find users with the same password, thereby reducing the difficulty of cracking the password. Therefore, when encrypting user passwords, it is necessary to consider disguising the password. Even if the password is the same, it should be saved as different ciphertexts. Even if the user enters a weak password, it is necessary to consider strengthening it to increase the difficulty of the password being cracked. Using salt encryption and IP restrictions can meet this requirement.

[0078] like Figure 1 As shown, the present invention provides a data transmission method based on security verification. Based on security access verification, host access and access peak are restricted, and a data encryption method based on AES algorithm and dynamic salt value double encryption is used to transmit secure data with a third-party system. Specifically, it includes:

[0079] The client calculates the signature of the request using dynamic salt value + access_token + timestamp + request parameters to ensure data encryption, limit the server's access IP, improve access reliability, and determine whether it has access rights by verifying the signature at the time of the request, and then respond to the service.

[0080] The data transmission method based on security verification provided by the present invention can also be implemented by ordinary technicians in the industry using other steps. Figure 1 The data transmission method based on security verification provided by the present invention is only a specific embodiment.

[0081] In a preferred embodiment of the present invention, the data transmission method based on security verification specifically includes:

[0082] Step 1: The client calculates a signature based on the dynamic salt value, access_token, timestamp, and request parameters used in the request.

[0083] Step 2: Send a restful request;

[0084] Step 3: The filter obtains the signature carried by the authorization and checks whether it is consistent; at the same time, the server encrypts, decrypts and verifies the signature of the request;

[0085] Step 4: After verification, if they are consistent, access is allowed; if they are inconsistent, access is not allowed.

[0086] In a preferred embodiment of the present invention, the server encrypts the signature of the request in step 3, including:

[0087] Initialize and generate four root key files (pig, cat, bird, dog), input the encrypted key and description content to generate the key, and save the key to the json file on the server;

[0088] Then input the encrypted content and use AES to encrypt the secret key and encrypted content to obtain the ciphertext.

[0089] In a preferred embodiment of the present invention, during the data encryption process, four root key files are first read, and the key files are XORed one by one to obtain the password segment. Then, the dog and pig password files are ANDed to obtain the encryption salt value, and then the key content is AES encrypted to obtain the final key value.

[0090] In a preferred embodiment of the present invention, when encrypting a user password, the same password or weak password is saved as different ciphertexts using a random seed key and a dynamic salt value generation method.

[0091] In a preferred embodiment of the present invention, the server decrypting the signature of the request in step 3 includes:

[0092] When sending a request, the current timestamp, random number, and plaintext request parameters are sent. The signature key is calculated using the secret key, timestamp, random number, request address, and parameters. When the signature is consistent with the signature in the authorization, access is allowed after verification; otherwise, access is denied.

[0093] In a preferred embodiment of the present invention, the present invention provides a data transmission system based on security verification, comprising:

[0094] The client calculates the signature based on the dynamic salt value, access_token, timestamp, and request parameters used in the request.

[0095] Request sending module, used to send restful requests;

[0096] Filter, used to obtain the signature carried by Authorization and determine whether it is consistent;

[0097] The server is used to encrypt, decrypt, and verify the signature of the request; if they are consistent, access is allowed; if they are inconsistent, access is not allowed.

[0098] The technical solution of the present invention is further described below in conjunction with specific embodiments.

[0099] Example

[0100] In one embodiment of the present invention, Figure 2 As shown in (a) encryption process; (b) decryption process), the encryption and decryption process provided by the present invention first needs to initialize and generate four root key files (pig, cat, bird, dog) during encryption, input the encrypted key and description content to generate the key, the key is stored in the json file on the server, and then the encrypted content is input, and finally the key and the encrypted content are encrypted using AES to obtain the ciphertext.

[0101] During the request process, decryption is required. When sending a request, the current timestamp, random number and plaintext request parameters will be sent. At this time, the present invention uses the secret key, timestamp, random number, request address and parameters to request the calculation of the signature key. When the signature is consistent with the signature in the authorization, access is allowed through verification, otherwise access is denied.

[0102] like Figure 3 As shown, the encryption and decryption algorithm provided by the present invention includes:

[0103] During the data encryption process, the four root key files (bird, cat, dog, pig) are first read, and the key files are XORed one by one to obtain the password segment. The encryption salt value is then obtained by performing an AND operation on the dog and pig password files. The key content is then AES encrypted to obtain the final key value. This method greatly enhances the security of the key.

[0104] In a preferred embodiment of the present invention, in the step of reading four encrypted files (bird, cat, dog, pig), secureRandom is used to randomly generate a 32-bit encryption key and store it in the file.

[0105] In a preferred embodiment of the present invention, in the step of obtaining the password segment, the byte arrays of dog and cat are obtained, and the result of XORing dog and cat is assigned to a new array. The result is then XORed with the other two files in sequence, and finally converted into a hexadecimal string.

[0106] In a preferred embodiment of the present invention, in the step of obtaining the encryption salt value, a byte AND operation is performed using dog and pig, and then converted into a hexadecimal string.

[0107] In a preferred embodiment of the present invention, in the step of obtaining the password encryption bytes, the password segment is compared with the fixed bytes.

[0108] The present invention is further described below by comparing the traditional session with the solution of the present invention.

[0109] The traditional session login verification method is as follows:

[0110] 1) The user enters their login information.

[0111] 2) The server verifies that the information is correct, creates a session, and stores it in the database.

[0112] 3) The server generates a sessionId for the user and places a cookie with the sessionId in the user's browser.

[0113] 4) In subsequent requests, the sessionID is verified against the database and if valid, the request is accepted.

[0114] 5) Once the user logs out of the application, the session will be destroyed on both the client and server side.

[0115] The data transmission method based on security verification provided by the present invention is as follows: Figure 4 Shown; including:

[0116] 1. The user enters their login information.

[0117] 2. The server verifies that the information is correct and returns a signed token.

[0118] 3. The token is stored on the client, for example in local storage or a cookie.

[0119] 4. All subsequent HTTP requests will add the token to the request header.

[0120] 5. The server decodes the JWT and, if the token is valid, accepts the request.

[0121] 6. Once the user logs out, the token will be destroyed on the client side, without the need to interact with the server. A key point is that the token is stateless. The backend server does not need to keep a record of the token or the current session.

[0122] Through the above technical comparison:

[0123] Traditionally, the user login status is verified based on session + filter. The session life cycle is a session (from opening the browser to closing the browser). The method of the present invention is to use the jwt method. The key can be accessed statelessly during the validity period and is not restricted by the browser. When the key expires, it needs to be obtained again, which increases the difficulty of cracking the key.

[0124] It should be noted that the embodiments of the present invention can be implemented by hardware, software, or a combination of software and hardware. The hardware portion can be implemented using dedicated logic; the software portion can be stored in a memory and executed by an appropriate instruction execution system, such as a microprocessor or dedicated design hardware. Those skilled in the art will appreciate that the above-mentioned devices and methods can be implemented using computer-executable instructions and / or contained in processor control code, for example, such as a carrier medium such as a disk, CD or DVD-ROM, a programmable memory such as a read-only memory (firmware), or a data carrier such as an optical or electronic signal carrier. The devices and modules of the present invention can be implemented by hardware circuits such as very large-scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., can also be implemented by software executed by various types of processors, or can be implemented by a combination of the above-mentioned hardware circuits and software, such as firmware.

[0125] The above description is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any modifications, equivalent substitutions and improvements made by any technician familiar with this technical field within the technical scope disclosed by the present invention and within the spirit and principles of the present invention should be covered by the scope of protection of the present invention.

Claims

1. A data transmission method based on security verification, characterized in that: The data transmission method based on security verification includes: Based on secure access verification, host access and access peak are restricted, and data encryption based on AES algorithm and dynamic salt value double encryption is used to transmit secure data with third-party systems; The data transmission method based on security verification specifically includes: Step 1: When the client requests data from the interface, the request parameter Param is first generated by performing an AND operation on the encrypted characters pig and dog to generate a dynamic salt value salt. The salt is then used together with the access_token and timestamp to calculate the signature sign, and finally the sign is placed in the request header; Step 2: The server obtains the header parameters in the restful request; Step 3: The filter obtains the signature carried by the authorization and checks whether it is consistent; at the same time, the server encrypts, decrypts and verifies the signature of the request; Step 4: If the signature values ​​are consistent, access is allowed; if they are inconsistent, access is not allowed. In step 3, the server encrypts the signature of the request, including: Initialize and generate four root key files, input the encrypted key and description content to generate the key, and save the key to the json file on the server; Then input the encrypted content and use AES to encrypt the secret key and encrypted content to obtain the ciphertext; During the data encryption process, the four root key files are first read, and the password segments are obtained by performing XOR operations on the key files one by one. Then, the encryption salt value is obtained by performing AND operations on the dog and pig password files. Then, the key content is encrypted with AES to obtain the final key value. When encrypting user passwords, for identical or weak passwords, the randomly generated seed key and dynamic salt value are combined to ensure that the ciphertext saved each time is different. In step 3, the server decrypts the signature of the request, including: When sending a request, the current timestamp, random number, and plaintext request parameters are sent. The signature key is calculated using the secret key, timestamp, random number, request address, and parameters. When the signature is consistent with the signature in the authorization, access is allowed after verification; otherwise, access is denied.

2. A data transmission system based on security verification that implements the data transmission method based on security verification according to claim 1, characterized in that: The data transmission system based on security verification includes: The client calculates the signature based on the dynamic salt value, access_token, timestamp, and request parameters used in the request. Request sending module, used to send restful requests; Filter, used to obtain the signature carried by Authorization and determine whether it is consistent; The server is used to encrypt, decrypt, and verify the signature of the request; if they are consistent, access is allowed; if they are inconsistent, access is not allowed.

3. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the data transmission method based on security verification according to claim 1.

4. A computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor executes the data transmission method based on security verification according to claim 1.

5. A distributed hypermedia information system, characterized in that: The distributed hypermedia information system executes the data transmission method based on security verification as claimed in claim 1.

Images