A data security protection method, device, equipment and storage medium

Abstract

The present invention discloses a data security protection method, device, equipment and storage medium. The method includes: returning the corresponding data obtained from the application server to the target user as target data, and storing the data corresponding to the specified information in the target data as candidate data in the cache warehouse; receiving the data obtained after updating the target data submitted by the target user as the data to be updated, and obtaining the data corresponding to the specified information from the data to be updated as the data to be verified; comparing the data to be verified with the candidate data, if the comparison result is that the two are the same, then respectively perform corresponding updates on the data in the application server and the data in the cache warehouse based on the data to be updated, otherwise, reject the corresponding update based on the data to be updated. It can be seen that the present application can effectively improve the data verification efficiency while realizing the security prevention of user input.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and more specifically, to a data security protection method, device, equipment and storage medium. Background Art

[0002] The popularization of the WEB has enriched various WEB products. However, due to the enhanced WEB interaction ability, various security threats have emerged. Among them, the input of illegal users not only threatens the security of user information, but also brings disasters to servers, operating systems, and even the entire local area network. Therefore, verifying the data input by users is an essential security measure for WEB applications. The conventional method is to manually verify the data submitted by the front end separately, but this method results in low verification efficiency. Summary of the Invention

[0003] The purpose of the present invention is to provide a data security protection method, device, equipment and storage medium, which can effectively improve the data verification efficiency while realizing the security prevention of user input.

[0004] To achieve the above purpose, the present invention provides the following technical solutions:

[0005] A data security protection method includes:

[0006] Return the corresponding data obtained from the application server to the target user as target data, and store the data corresponding to the specified information in the target data in the cache warehouse as candidate data;

[0007] Receive the data obtained after updating the target data submitted by the target user as the data to be updated, and obtain the data corresponding to the specified information from the data to be updated as the data to be verified;

[0008] Compare the data to be verified with the candidate data. If the comparison result is that the two are the same, update the data in the application server and the data in the cache warehouse respectively based on the data to be updated. Otherwise, reject the corresponding update based on the data to be updated.

[0009] Preferably, before returning the corresponding data obtained from the application server to the target user as target data, it further includes:

[0010] Receive an access request initiated by the target user, and judge whether the target user has the permission to access the application server based on the access request. If so, obtain the data required by the target user from the application server. Otherwise, reject the access of the target user.

[0011] Preferably, obtaining the data corresponding to the specified information in the target data and the data to be updated respectively includes:

[0012] Obtaining all the data included in the target data and the data to be updated respectively, or obtaining the specified partial data included in the target data and the data to be updated.

[0013] Preferably, obtaining the specified partial data included in the target data and the data to be updated respectively includes:

[0014] Obtaining the unique identifier values included in the target data and the data to be updated.

[0015] Preferably, after performing corresponding updates based on the data to be updated, it further includes:

[0016] Feedback the information that has been updated accordingly based on the data to be updated to the target user.

[0017] Preferably, after comparing the data to be verified with the candidate data, it further includes:

[0018] If the comparison result shows that the two are different, feedback the information that rejects the corresponding update based on the data to be updated to the target user.

[0019] Preferably, the cache repository is a distributed repository or a single-machine single-service cache repository.

[0020] A data security protection device includes:

[0021] A feedback module, configured to: return the corresponding data obtained from the application server as target data to the target user, and store the data corresponding to the specified information included in the target data as candidate data in the cache repository;

[0022] A receiving module, configured to: receive the data obtained after updating the target data submitted by the target user as the data to be updated, and obtain the data corresponding to the specified information from the data to be updated as the data to be verified;

[0023] A comparison module, configured to: compare the data to be verified with the candidate data, and if the comparison result shows that the two are the same, perform corresponding updates on the data in the application server and the data in the cache repository respectively based on the data to be updated, otherwise, reject the corresponding update based on the data to be updated.

[0024] A data security protection device includes:

[0025] A memory, configured to store a computer program;

[0026] A processor for implementing the steps of the data security protection method described in any one of the above when executing the computer program.

[0027] A computer-readable storage medium having a computer program stored thereon, the computer program implementing the steps of the data security protection method described in any one of the above when executed by a processor.

[0028] The present invention provides a data security protection method, apparatus, device and storage medium. The method includes: returning the corresponding data obtained from the application server as target data to the target user, and storing the data corresponding to the specified information in the target data as candidate data in the cache repository; receiving the data obtained after updating the target data submitted by the target user as the data to be updated, and obtaining the data corresponding to the specified information from the data to be updated as the data to be verified; comparing the data to be verified with the candidate data, if the comparison result is that the two are the same, then perform corresponding updates on the data in the application server and the data in the cache repository based on the data to be updated, otherwise, reject the corresponding update based on the data to be updated. When the present application returns any data obtained from the application server to the user, it will also store the data corresponding to the specified information in the any data as candidate data in the cache repository. Thus, when the user submits the data obtained after updating the any data, the data corresponding to the specified information is extracted from the data obtained after the update. If the extracted data is the same as the candidate data, it means that the user updated the data that he previously obtained from the application server, that is, the data that the user has the right to access. Therefore, corresponding data updates can be performed on the application server and the cache repository, otherwise, the corresponding data updates on the application server and the cache repository are rejected. It can be seen that the present application performs automated management on the data returned by the application server to the user. By comparing the data corresponding to the specified information in the data returned by the application server to the user and the data obtained after the user submits the update, it verifies whether the user's update operation is an update operation for the data returned by the application server to him. Thus, corresponding data updates are only performed on the application server and the cache repository when the user's update operation is an update operation for the data returned by the application server to him, effectively improving the data verification efficiency while achieving security prevention for user input. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, the drawings in the following description are only the embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained according to the provided drawings without creative efforts.

[0030] Figure 1 Flow chart of a data security protection method provided by an embodiment of the present invention;

[0031] Figure 2 Start flow chart in a data security protection method provided by an embodiment of the present invention;

[0032] Figure 3 Specific implementation diagram in a data security protection method provided by an embodiment of the present invention;

[0033] Figure 4 and Figure 5 Respective service flow charts in specific scenarios in a data security protection method provided by an embodiment of the present invention;

[0034] Figure 6 Structure schematic diagram of a data security protection device provided by an embodiment of the present invention. Detailed implementation manners

[0035] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0036] Please refer to Figure 1 , which shows a flow chart of a data security protection method provided by an embodiment of the present invention, and specifically may include:

[0037] S11: Return the corresponding data obtained from the application server to the target user as target data, and store the data corresponding to the specified information in the target data in the cache warehouse as candidate data.

[0038] Among them, the application server can specifically be a WEB application server. When a user needs to implement data interaction with the application server, corresponding actions can be triggered on the WEB page of the application server (including initiating a request to obtain data on the WEB page, submitting the obtained data after update, etc.). In the embodiments of the present application, any user who currently needs to implement data interaction with the application server can be determined as the target user. After the target user initiates a request to obtain data, the data corresponding to the request to obtain data is obtained from the application server and returned to the target user. At the same time, the data corresponding to the specified information is obtained from the data corresponding to the request to obtain data as the corresponding candidate data, and the candidate data is stored in a pre-set cache repository; among them, the specified information is information that can be set according to actual needs, needs to be verified, and does not allow the user to modify the corresponding data. This part of the information can be all or part of the target data. For example, if the target data includes data such as order identification, customer identification, and commodity information, the specified information can include the order identification. At this time, the candidate data is the data including the order identification in the target data.

[0039] S12: Receive the data obtained after updating the target data submitted by the target user as the data to be updated, and obtain the data corresponding to the specified information from the data to be updated as the data to be verified.

[0040] S13: Compare the data to be verified with the candidate data. If the comparison result is that the two are the same, then update the data in the application server and the data in the cache repository respectively based on the data to be updated. Otherwise, reject the corresponding update based on the data to be updated.

[0041] The target user submits the data obtained after the update (the data to be updated) of the target data. After receiving the data to be updated submitted by the target user, the data corresponding to the specified information is obtained from the data to be updated as the data to be verified, and the candidate data of the target data is read from the cache repository. Then, the data to be verified and the candidate data are compared. If they are the same, it indicates that the data to be updated submitted by the target user is the data obtained by updating on the basis of the target data previously obtained from the application server. Therefore, the verification of the data to be updated passes, and the corresponding data in the application server and the cache repository is updated based on the data to be updated. Otherwise, it indicates that the data to be updated submitted by the target user is not the data obtained by updating on the basis of the target data previously obtained from the application server. Therefore, the verification of the data to be updated fails, and the update of the corresponding data in the application server and the cache repository based on the data to be updated is rejected. Thus, it is determined whether the data operated by the user is the data obtained by the user previously through the comparison of the specified information, ensuring the security and legality of the operation. Among them, the update of the target data may include operations such as modification, deletion, and viewing, and the update of the corresponding data in the application server and the cache repository is also to perform update operations such as modification, deletion, and viewing on the data stored in the application server and the cache repository and included in the target data respectively.

[0042] When the present application returns any data obtained from the application server to the user, the data corresponding to the specified information in the any data is also stored in the cache repository as candidate data. When the user submits the data obtained after the update of the any data, the data corresponding to the specified information is extracted from the data obtained after the update. If the extracted data is the same as the candidate data, it indicates that the data updated by the user is the data previously obtained by the user from the application server, that is, the data that the user has the right to access. Therefore, the corresponding data in the application server and the cache repository can be updated. Otherwise, the update of the corresponding data in the application server and the cache repository is rejected. It can be seen that the present application performs automated management on the data returned by the application server to the user. By comparing the data corresponding to the specified information in the data returned by the application server to the user and the data obtained after the update submitted by the user, it verifies whether the user's update operation is an update operation for the data returned by the application server to the user. Thus, the corresponding data in the application server and the cache repository is updated only when the user's update operation is an update operation for the data returned by the application server to the user, effectively improving the data verification efficiency while realizing the security prevention of the user input.

[0043] Before returning the corresponding data obtained from the application server to the target user as the target data, the data security protection method provided by the embodiment of the present invention may further include:

[0044] Receive an access request initiated by a target user, and based on the access request, determine whether the target user has the permission to access the application server. If so, obtain the data required by the target user from the application server; otherwise, reject the access of the target user.

[0045] It should be noted that, in order to further implement data security protection, before obtaining the data required by the target user from the application server, this application can also receive an access request initiated by the target user. The access request may include the identity information of the target user (such as username, password, etc.); based on this access request, determine whether the target user has the permission to access the application server (such as verifying whether the username, password, etc. are the username, password, etc. of a legitimate user). If the judgment result is yes, obtain the data required by the target user from the application server (at this time, the access request carries a data acquisition request). If the judgment result is no, reject obtaining the data required by the target user from the application server.

[0046] In addition, obtaining the data corresponding to the specified information in the target data and the data to be updated respectively may include: obtaining all the data included in the target data and the data to be updated respectively, or obtaining the specified partial data included in the target data and the data to be updated.

[0047] Specifically, in the embodiments of this application, the specified information may be the information corresponding to all the data included in the target data, or the information corresponding to a part of the data included in the target data, which can be specifically set according to actual needs; correspondingly, when implementing candidate data storage, it is to support full - volume replication (the candidate data is a full - volume replication of the target data) or developer - defined field data replication (the candidate data is the replication of the field data defined by the developer in the target data, such as id, number, etc.); thus, flexible setting of user update permissions can be achieved. For example: the target data includes data such as order identification, customer identification, and commodity information. The specified information may include order identification, customer identification, and commodity information. At this time, obtaining the data corresponding to the specified information is to obtain all of the target data or the data to be updated. The specified information may also only include the order identification. At this time, obtaining the data corresponding to the specified information is to obtain the data corresponding to the order identification in the target data or the data to be updated.

[0048] Preferably, obtaining specified partial data included in the target data and the data to be updated may include: obtaining unique identifier values included in the target data and the data to be updated. Specifically, in the embodiments of the present application, the identifier value that can uniquely identify this piece of data in the data can be used as the specified information, so that the verification of the data can be realized based on the unique identifier, and the verification purpose can be achieved with short data, further improving the data verification efficiency. In addition, id / number may refer to the unique identifier value after virtualizing the order / product / customer object, or a combined value of id + number, but it must be unique and not allowed to be modified by the user.

[0049] After performing corresponding updates based on the data to be updated, the data security protection method provided by the embodiments of the present invention may further include:

[0050] Feedback the information that has been updated accordingly based on the data to be updated to the target user.

[0051] After comparing the data to be verified with the candidate data, it may further include:

[0052] If the comparison result is that the two are different, then feedback the information rejecting the corresponding update based on the data to be updated to the target user.

[0053] After the embodiments of the present application perform corresponding data updates in the application server and the cache repository based on the data to be updated, the information indicating that the corresponding updates have been completed can be fed back to the target user, so that the target user can timely learn the result of their data operation, and then perform subsequent operations such as query; and when the comparison result between the data to be verified and the candidate data is different, the information rejecting the corresponding update based on the data to be updated can also be fed back to the target user, so that the target user can timely learn the result of their data operation, and then perform subsequent operations such as re-updating.

[0054] In the embodiment of the present application, the cache warehouse can be a distributed warehouse or a stand-alone single-service cache warehouse. It should be noted that the cache warehouse is a pre-defined module for implementing the cache function. In most cases, the cache warehouse is memory or redis, or it can be a file / database, etc.; specifically, as a security protection automatic verification service, the present application can customize the configuration of the cache warehouse, and can customize the configuration of distributed cache warehouses such as Redis, Ehcache, Cacheonix, JBoss Cache, Voldemort, etc., and can also customize the configuration of single-machine single-service cache warehouses such as Map and Cache. It can also put the data that needs to be verified in the configured cache warehouse in a unique way of path + file name according to the page requirements, and the format can be customized; thereby providing data consistency guarantee, responding to changed data objects, identifiers, and states in a timely manner, in order to ensure the real-time operation while providing high flexibility. Developers can arbitrarily customize the data format they need to verify for storage, and can overwrite, update, and remove existing data.

[0055] In addition, if Figure 2 As shown, when starting the application server, you can first check whether there is a cache warehouse configuration. If so, initialize the cache warehouse according to the cache warehouse configuration and start other startup items at the same time. Otherwise, initialize the cache warehouse to the memory by default, start other startup items at the same time, and the startup is completed.

[0056] In a specific implementation, Figure 3 As shown, a data security protection method provided by an embodiment of the present invention may specifically include the following steps:

[0057] 1. The user initiates a request to submit updated data, which is obtained by the user from the connected database server through the application server (i.e., application server);

[0058] 2. The verification service parses the request URL and obtains the updated data submitted by the user;

[0059] 3. The verification service obtains the corresponding response data (i.e., candidate data) from the distributed cache warehouse, and uses the candidate data to verify the data to be verified in the updated data;

[0060] 4. If the verification is successful, the verification service sends the update information to the application server. The application server updates the updated data to the database server based on the update information. At the same time, the verification service updates the updated data (add, update, remove, etc.) to the distributed cache warehouse. Otherwise, the user is fed back information that the verification failed.

[0061] 5. After the application server updates the database server based on the updated data, it feeds back the corresponding response data (the corresponding data update has been completed) to the user.

[0062] In this application, the target data can be list data (such as order list / product list / customer list, etc.). The update of the target data can include operations such as modification, viewing, or deletion (orders / products / customers, etc.). After submitting the updated data (orders / products / customers, etc.), the application server responds to the update result. The business flowcharts of the corresponding technical solutions can be respectively as Figure 4 and Figure 5 shown (where the server is the application server, and the legality is the comparison and verification of candidate data and data to be verified). The following are implementation examples in specific scenarios:

[0063] Zhang San is a distributor who joined in 2020. He placed an order and completed the transaction normally in 2020 (order id: 20200101001). He placed an order at the beginning of 2021 but did not complete the transaction (order id: 20210101001). Recently, due to financial constraints, he needs to cancel the order placed at the beginning of 2021 (order id: 20210101001), that is, delete the order form that has been sent to the factory at the beginning of the year (order id: 20210101001). Then, it is necessary to:

[0064] 1. Log in to the supply platform system;

[0065] 2. Enter the order list page for this year and view the orders he has placed;

[0066] 3. Find the order (order number id: 20210101001);

[0067] 4. Perform the deletion operation;

[0068] Risk point: Performing the deletion operation means deleting the order with the order number id of 20210101001.

[0069] If Zhang San, an attacker, or an illegal user changes the order number 20210101001 to 20200101001 through page tampering technology or with the help of a third-party tool; Zhang San himself has the permission to own the orders with (order number id: 20210101001) and (order number id: 20200101001), but on the order list page this year, there is obviously no order with the number 20200101001. Therefore, if other attackers or illegal users simulate browser behavior to initiate a deletion request, the harm is self-evident; Therefore, based on the technical solution disclosed in this application, the data submitted after the user's update operation must be one of the data that the user last requested and obtained from the application server, so as to prevent users or attackers from tampering with data by simulating browser requests for data, resulting in immeasurable losses, and can greatly protect data security, prevent data from being tampered with, and prevent security risks such as malicious operations; Specifically, in the request interceptor, the request is parsed, and the corresponding candidate data is found from the cache repository and compared with the data to be verified in the submitted data. If the verification fails, the request is interrupted and a friendly reminder is given to prevent data from being tampered with, maliciously operated, and private data from being leaked, so as to ensure the security, integrity, and cleanliness of the data while reducing frequent interactions with the underlying layer; In addition, it can solve the problem of whether the currently logged-in user has the right to operate (modify, delete, view) the data, without the need to connect to the database for verification each time, with good flexibility. Developers can arbitrarily customize the data to be verified, configure the data cache repository, and automatically verify without developers having to pay too much attention to this logic.

[0070] In summary, this application has the following characteristics: Using the configured cache repository to ensure the availability and reliability of the application server under the architecture, and ensuring the real-time and consistency of the verification data change notification to the application server; Developers can customize the format of the verification data for storage according to their own business needs, and can also replace, update, or remove the existing data to ensure the highly flexible operability and data uniqueness; Configure the request interceptor to provide a unified api interface for automatic verification. Developers can also customize the interception verification to implement the interception verification. Unauthorized and illegal data will not pass the verification, and a friendly prompt will be given to achieve automatic verification and ensure data security; Improve development efficiency. Most automatic verifications do not require developers to pay attention. Developers only need to set the data to be verified into the repository; Greatly enhance system security, reduce the risk of being attacked, automatically verify whether the currently logged-in user has the right to operate (modify, delete, view) the data, without the need to connect to the database for verification each time, with good flexibility; Developers can arbitrarily customize the data format and store it in the cache repository for verification. For complex logics, they can also customize the interceptor for verification, thereby reducing the maintenance cost and can be used for continuous integration.

[0071] An embodiment of the present invention further provides a data security protection device, as Figure 6 shown, which may include:

[0072] A feedback module 11, configured to: return the corresponding data obtained from the application server to the target user as target data, and store the data corresponding to the specified information in the target data in the cache repository as candidate data;

[0073] A receiving module 12, configured to: receive the data obtained after updating the target data submitted by the target user as the data to be updated, and obtain the data corresponding to the specified information from the data to be updated as the data to be verified;

[0074] A comparison module 13, configured to: compare the data to be verified with the candidate data. If the comparison result shows that they are the same, respectively update the data in the application server and the data in the cache repository based on the data to be updated. Otherwise, reject the corresponding update based on the data to be updated.

[0075] An embodiment of the present invention further provides a data security protection device, which may include:

[0076] A memory, configured to store a computer program;

[0077] A processor, configured to implement the steps of any one of the above data security protection methods when executing the computer program.

[0078] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of any one of the above data security protection methods can be implemented.

[0079] It should be noted that for the description of the relevant parts in a data security protection device, device and storage medium provided by an embodiment of the present invention, please refer to the detailed description of the corresponding parts in a data security protection method provided by an embodiment of the present invention, which will not be elaborated here. In addition, for the parts in the above technical solutions provided by the embodiments of the present invention that are consistent with the implementation principles of the corresponding technical solutions in the prior art, no detailed description is given to avoid excessive elaboration.

[0080] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A data security protection method, characterized in that, it includes: Return the corresponding data obtained from the application server to the target user as target data, and store the data corresponding to the specified information in the target data as candidate data in the cache repository; Receive the data obtained after updating the target data submitted by the target user as the data to be updated, and obtain the data corresponding to the specified information from the data to be updated as the data to be verified; Compare the data to be verified with the candidate data. If the comparison result is that the two are the same, respectively update the data in the application server and the data in the cache repository based on the data to be updated. Otherwise, reject the corresponding update based on the data to be updated.

2. The method according to claim 1, characterized in that, Before returning the corresponding data obtained from the application server to the target user as target data, it further includes: Receive the access request initiated by the target user, and determine whether the target user has the permission to access the application server based on the access request. If so, obtain the data required by the target user from the application server. Otherwise, reject the access of the target user.

3. The method according to claim 2, characterized in that, Respectively obtaining the data corresponding to the specified information in the target data and the data to be updated includes: Respectively obtain all the data included in the target data and the data to be updated, or obtain the specified partial data included in the target data and the data to be updated.

4. The method according to claim 3, characterized in that, Obtaining the specified partial data included in the target data and the data to be updated includes: Obtain the unique identifier values included in the target data and the data to be updated.

5. The method according to claim 4, characterized in that, After performing the corresponding update based on the data to be updated, it further includes: Feedback the information that the corresponding update has been realized based on the data to be updated to the target user.

6. The method according to claim 5, characterized in that, After comparing the data to be verified with the candidate data, it further includes: If the comparison result is that the two are different, feedback the information that the corresponding update based on the data to be updated is rejected to the target user.

7. The method according to claim 6, characterized in that, The cache repository is a distributed repository or a single-machine single-service cache repository.

8. A data security protection device, characterized in that, it includes: A feedback module for: returning the corresponding data obtained from the application server to the target user as target data, and storing the data corresponding to the specified information in the target data as candidate data in the cache repository; A receiving module for: receiving the data obtained after updating the target data submitted by the target user as the data to be updated, and obtaining the data corresponding to the specified information from the data to be updated as the data to be verified; A comparison module, configured to: compare the data to be verified with the candidate data, and if the comparison result shows they are the same, respectively perform corresponding updates on the data in the application server and the data in the cache repository based on the data to be updated; otherwise, reject the corresponding update based on the data to be updated.

9. A data security protection device, characterized in that, it includes: a memory for storing a computer program; a processor for implementing the steps of the data security protection method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that, a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the steps of the data security protection method according to any one of claims 1 to 7 are implemented.

Images