A data processing method and device based on request message

Abstract

The present invention provides a data processing method and device based on request messages, which relates to the field of data processing technology and can be used in the financial field or other technical fields. The method comprises: determining a first calling sequence of an authenticator corresponding to the request message according to pre-configuration information; calling each authenticator in turn according to the first calling sequence, and if it is determined that the authority authentication results of all authenticators are successful authentication, sending a request message of successful authentication to the business system; receiving a request response result fed back by the business system, and determining a second calling sequence of a content modifier corresponding to the request response result according to the pre-configuration information; modifying the data in the request response result in turn according to the second calling sequence, and sending the modified request response result. The device executes the above method. The method and device provided by the embodiment of the present invention realize the decoupling of security functions and business functions, and are convenient for expansion.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular to a data processing method and device based on a request message. Background Art

[0002] In order to improve customer service capabilities, more and more business systems need to provide customers with more comprehensive and vivid services by displaying rich data. This places very high demands on data privacy and security, such as: permission verification, sensitive identification, data watermarking and desensitization. Different business systems require different security protection functions, or a combination of multiple protection functions. At present, the more common practice is for the system to develop an independent application gateway according to its own needs, or to implement security functions in business functions.

[0003] Current security gateway solutions have the following shortcomings:

[0004] 1. Each business system in the enterprise needs to be customized and developed repeatedly, which is costly.

[0005] 2. When an enterprise adjusts its overall strategy, all relevant systems need to be upgraded, which makes it difficult to respond quickly and make unified adjustments.

[0006] 3. Security functions are coupled with business functions, making expansion difficult. Summary of the invention

[0007] In view of the problems in the prior art, an embodiment of the present invention provides a data processing method and device based on a request message, which can at least partially solve the problems in the prior art.

[0008] On the one hand, the present invention provides a data processing method based on a request message, comprising:

[0009] receiving a request message sent by a client, and determining an authenticator group corresponding to the request message and a first calling order of authenticators in the authenticator group according to pre-configured information;

[0010] Calling each authenticator in the authenticator group in sequence according to the first calling order, and performing authority authentication on the request message, and if it is determined that the authority authentication results of all authenticators are successful, sending a request message of successful authentication to the business system;

[0011] receiving a request response result fed back by the business system, and determining a content modifier group corresponding to the request response result and a second calling order of the content modifiers in the content modifier group according to the preconfiguration information;

[0012] The content modifiers in the content modifier group are called in sequence according to the second calling sequence, the data in the request response result is modified, and the modified request response result is sent to the client.

[0013] If it is determined that the authorization authentication results of all authenticators are successful, sending a request message of successful authentication to the business system includes:

[0014] If it is determined that the authorization authentication result of all authenticators is successful, data processing is performed on the successfully authenticated request message, and the processed request message is sent to the business system.

[0015] The modifying of the data in the request response result and sending the modified request response result to the client includes:

[0016] The basic information of the request message is recorded, and after the recording is completed, the modified request response result is sent to the client; the basic information of the request message at least includes the modified data.

[0017] Wherein, at least one of the request body, status and request header of the data in the request response result is modified by the content modifier.

[0018] Wherein, the data processing method based on the request message also includes:

[0019] The authenticator that is first determined to have failed authentication is used as the target authenticator, the request message is rejected to continue accessing the business system, and a prompt message based on the authentication failure of the target authenticator is generated.

[0020] Before the step of determining the authenticator group corresponding to the request message and the first calling order of the authenticators in the authenticator group according to the pre-configuration information, the data processing method based on the request message further includes:

[0021] Determine whether the request message needs to be processed by a security gateway based on the pre-configuration information. If it is determined that it needs to be processed by a security gateway, continue to execute the steps of determining the authenticator group corresponding to the request message based on the pre-configuration information, and the first calling order of the authenticators in the authenticator group, as well as subsequent steps.

[0022] Wherein, before the step of determining whether the request message needs to be processed by a security gateway according to the pre-configuration information, the data processing method based on the request message further includes:

[0023] Performing matching verification on the request message according to the matching rules in the pre-configured information; the matching rules include at least one of a uniform resource locator, a resource path, a request header, and small text data; the small text data is smaller than a preset data volume;

[0024] If it is determined that at least one of the matching rules is matched, it is determined that the matching verification is passed, and the step of determining whether the request message needs to be processed by the security gateway according to the pre-configuration information and subsequent steps are continued.

[0025] In one aspect, the present invention provides a data processing device based on a request message, comprising:

[0026] A receiving unit, configured to receive a request message sent by a client, and determine an authenticator group corresponding to the request message and a first calling order of authenticators in the authenticator group according to pre-configuration information;

[0027] an authentication unit, configured to call each authenticator in the authenticator group in sequence according to the first calling sequence, and perform authority authentication on the request message, and if it is determined that the authority authentication results of all authenticators are successful, send a request message of successful authentication to the business system;

[0028] a determining unit, configured to receive a request response result fed back by the business system, and determine a content modifier group corresponding to the request response result and a second calling order of the content modifiers in the content modifier group according to the preconfiguration information;

[0029] A sending unit is used to call each content modifier in the content modifier group in sequence according to the second calling order, modify the data in the request response result, and send the modified request response result to the client.

[0030] In another aspect, an embodiment of the present invention provides an electronic device, including: a processor, a memory, and a bus, wherein:

[0031] The processor and the memory communicate with each other via the bus;

[0032] The memory stores program instructions that can be executed by the processor, and the processor calls the program instructions to execute the following method:

[0033] receiving a request message sent by a client, and determining an authenticator group corresponding to the request message and a first calling order of authenticators in the authenticator group according to pre-configured information;

[0034] Calling each authenticator in the authenticator group in sequence according to the first calling order, and performing authority authentication on the request message, and if it is determined that the authority authentication results of all authenticators are successful, sending a request message of successful authentication to the business system;

[0035] receiving a request response result fed back by the business system, and determining a content modifier group corresponding to the request response result and a second calling order of the content modifiers in the content modifier group according to the preconfiguration information;

[0036] The content modifiers in the content modifier group are called in sequence according to the second calling sequence, the data in the request response result is modified, and the modified request response result is sent to the client.

[0037] An embodiment of the present invention provides a non-transitory computer-readable storage medium, including:

[0038] The non-transitory computer-readable storage medium stores computer instructions, which cause the computer to execute the following method:

[0039] receiving a request message sent by a client, and determining an authenticator group corresponding to the request message and a first calling order of authenticators in the authenticator group according to pre-configured information;

[0040] Calling each authenticator in the authenticator group in sequence according to the first calling order, and performing authority authentication on the request message, and if it is determined that the authority authentication results of all authenticators are successful, sending a request message of successful authentication to the business system;

[0041] receiving a request response result fed back by the business system, and determining a content modifier group corresponding to the request response result and a second calling order of the content modifiers in the content modifier group according to the preconfiguration information;

[0042] The content modifiers in the content modifier group are called in sequence according to the second calling sequence, the data in the request response result is modified, and the modified request response result is sent to the client.

[0043] The data processing method and device based on request messages provided by the embodiment of the present invention receive a request message sent by a client, determine an authenticator group corresponding to the request message and a first calling order of authenticators in the authenticator group according to pre-configuration information; call each authenticator in the authenticator group in turn according to the first calling order, and perform authority authentication on the request message. If it is determined that the authority authentication results of all authenticators are successful, send a request message of successful authentication to a business system; receive a request response result fed back by the business system, determine a content modifier group corresponding to the request response result and a second calling order of content modifiers in the content modifier group according to the pre-configuration information; call each content modifier in the content modifier group in turn according to the second calling order, modify the data in the request response result, and send the modified request response result to the client. The pre-configuration information can realize plugging and unplugging corresponding authenticators and content modifiers according to different request messages, and can arrange the calling order of authenticators and content modifiers, so as to realize decoupling of security functions from business functions and facilitate expansion. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0045] Figure 1 It is a flowchart of a data processing method based on a request message provided by an embodiment of the present invention.

[0046] Figure 2 It is a schematic diagram of the structure of the namespace provided by an embodiment of the present invention.

[0047] Figure 3 It is a flowchart of a data processing method based on a request message provided by another embodiment of the present invention.

[0048] Figure 4 It is a structural diagram of a data processing device based on a request message provided by an embodiment of the present invention.

[0049] Figure 5 A schematic diagram of the physical structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical scheme and advantages of the embodiments of the present invention more clear, the embodiments of the present invention are further described in detail below in conjunction with the accompanying drawings. Here, the illustrative embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention. It should be noted that, in the absence of conflict, the embodiments in this application and the features in the embodiments can be combined with each other arbitrarily.

[0051] The professional terms related to the embodiments of the present invention are described as follows:

[0052] Security Gateway: The front gateway of the application system, mainly responsible for authenticating the HTTP requests sent to the application system, intercepting security attacks, and desensitizing the returned response data.

[0053] Namespace: used to define a set of interceptors, including an ignorer, several authenticators, a signer, several content modifiers and a logger. Each namespace can be used to process matching HTTP requests.

[0054] Matcher: matches the parameters of HTTP requests according to the pre-configured information, and returns the result of whether the match is consistent. For example: if the URL configured as the HTTP request contains a certain field content, all HTTP requests whose URLs contain the above field content will be judged as matching HTTP requests.

[0055] Interceptor: It is implemented by a matcher with some business logic. The matcher determines whether to execute the business logic. The business logic determines whether to reject the request or process the request parameters or response results and then hand it over to the next interceptor for further processing. Ignore, authenticator, signer, content modifier, logger are all types of interceptors.

[0056] Figure 1 is a flow chart of a data processing method based on a request message provided by an embodiment of the present invention, such as Figure 1 As shown, the data processing method based on the request message provided by the embodiment of the present invention includes:

[0057] Step S1: receiving a request message sent by a client, and determining an authenticator group corresponding to the request message and a first calling order of authenticators in the authenticator group according to pre-configuration information.

[0058] Step S2: calling each authenticator in the authenticator group in turn according to the first calling order, and performing authority authentication on the request message. If it is determined that the authority authentication results of all authenticators are successful, sending a request message of successful authentication to the business system.

[0059] Step S3: receiving the request response result fed back by the business system, and determining the content modifier group corresponding to the request response result and the second calling order of the content modifiers in the content modifier group according to the pre-configuration information.

[0060] Step S4: calling each content modifier in the content modifier group in sequence according to the second calling order, modifying the data in the request response result, and sending the modified request response result to the client.

[0061] In the above step S1, the device receives a request message sent by the client, and determines the authenticator group corresponding to the request message and the first calling order of the authenticators in the authenticator group according to the pre-configuration information. The device can be a computer device that executes the method, for example, a security gateway device. The request message can be an HTTP request.

[0062] The core of the embodiment of the present invention is based on Spring Gateway technology, and a plurality of interceptors are assembled and arranged as a Spring Gateway Filter to realize an application-defined security gateway.

[0063] The pre-configured information can be configured independently according to the actual business situation. The pre-configured information can be reflected in the namespace structure diagram, such as Figure 2 As shown, the description is as follows:

[0064] Each security gateway can define multiple groups of interceptors, each group of interceptors is used to process different HTTP requests. A group of interceptors is defined by a namespace. Each namespace includes at least one matcher, one ignorer, and one logger. You can configure several authenticators, one signer, and several content modifiers as needed.

[0065] The matcher is used to filter the HTTP requests processed by this group of interceptors. By setting multiple namespaces, different requests can be processed differently, such as distinguishing requests for querying customer information and querying account balances, performing different permission authentication and data desensitization.

[0066] The matchers and various interceptors are described as follows:

[0067] 1) The matcher has a built-in matching rule List, which can maintain multiple matching rules. When the HTTP request matches any rule, the judgment result is "matched", otherwise it is not matched. Currently, url (uniform resource locator), cookie, path (resource path), and header (request header) matching are supported. Among them, cookie is small text data, which is smaller than the preset data size, and the preset data size can be selected as 4KB.

[0068] 2) The ignorer has an independent matcher. When the HTTP request matches, it directly passes through the gateway. When it does not match, it is passed to the subsequent interceptor for processing.

[0069] 3) The authenticator has an independent matcher. When the HTTP request matches, the request is authenticated. The authentication logic can call the enterprise's unified user authority authentication service, or it can be customized by the business system for secondary development. When the authentication is passed, the HTTP request is passed to the subsequent interceptor for processing. If it does not match, the request is rejected.

[0070] 4) The tagger has an independent matcher. When the HTTP request matches, the request is modified. The modifiable contents include the request path, contextPath (content path), headers, queryParams (query parameters), and cookies can be added. Then the request is forwarded to the business system for processing. If it does not match, the request is directly forwarded to the business system for processing.

[0071] 5) The content modifier has an independent matcher. When the HTTP request matches, the response result is modified. The modifiable content includes the response status, headers, body, and adding cookies. Then the response is passed to the logger for processing. When it does not match, the response is directly passed to the logger for processing.

[0072] 6) The logger has an independent matcher. When the HTTP request matches, the log of this request is recorded. The log includes the protocol, host, port, request path, request parameters, request body, request method, whether the gateway has modified the response body, response status code, request IP, request time, response time, execution time (milliseconds), and then returns the response to the client. If there is no match, the response is returned directly to the client.

[0073] You can configure the namespace corresponding to each HTTP request and the specific content in each namespace according to actual business needs, without the need for customized and repeated development for each business system.

[0074] When an enterprise adjusts its overall strategy, it does not need to schedule upgrades for all related systems.

[0075] Security functions are decoupled from business functions to facilitate expansion.

[0076] like Figure 3 As shown, the description is as follows:

[0077] A1: The security gateway receives the HTTP request sent by the client.

[0078] A2: The ignorer determines whether the HTTP request needs to be processed by the security gateway. If it does, it is passed to the authenticator group for processing; if it does not, it is directly released. The ignorer is used to filter HTTP requests that need to be processed by the security gateway.

[0079] A3: The authenticator group includes several authenticators, which are mainly responsible for authenticating the HTTP request. Each authenticator can determine whether the request has the right to access the business system and whether it is safe based on the HTTP request method, url (Uniform Resource Locator), path (resource path), cookies, queryParams (query parameters) and other information. The security gateway will call the authenticators one by one according to the first call order to authenticate the HTTP request. The first call order can be set independently according to the actual situation.

[0080] In the above step S2, the device calls each authenticator in the authenticator group in turn according to the first calling order, and performs authority authentication on the request message. If it is determined that the authority authentication results of all authenticators are successful, a request message of successful authentication is sent to the business system. Continuing from the above A3:

[0081] For example: When a user queries transaction flow, the corresponding HTTP request method is POST, the url is http: / / www.sample.com / query, the cookies are token=ATW1234567890, and the queryParams are startDate=20220101&endDate=20220331.

[0082] The security gateway is configured with three authenticators: security authenticator, user authenticator, and permission authenticator. First, the security authenticator verifies whether the HTTP request contains unsafe information. If so, the request is directly rejected.

[0083] If not, the user authenticator verifies whether the token contained in the cookies is a valid token of the logged-in user and has not timed out. If the verification fails, the request is rejected directly.

[0084] If the verification is successful, the permission authenticator verifies whether the user has the query permission based on the business logic. If the verification fails, the request is directly rejected.

[0085] If the verification is successful, a request message of successful authentication can be sent to the business system, or the request message of successful authentication can be passed to the signer for processing.

[0086] The authenticator that is first determined to have failed authentication is used as the target authenticator, the request message is rejected from continuing to access the business system, and a prompt message based on the authentication failure of the target authenticator is generated. If the authenticator that is first determined to have failed authentication is the user authenticator, the user authenticator is determined to be the target authenticator, the request message continues to access the business system, and there is no need to perform subsequent authentication through the authority authenticator. A prompt message is generated to indicate that the user authenticator has failed authentication.

[0087] A4: The signer is mainly responsible for processing the data of HTTP requests, such as adding a trusted token to the cookies of authenticated requests.

[0088] The tagger can modify the path, contextPath, headers, and add cookies of the HTTP request. After the modification is completed, the HTTP request is forwarded to the business system.

[0089] In the above step S3, the device receives the request response result fed back by the business system, and determines the content modifier group corresponding to the request response result and the second calling order of the content modifiers in the content modifier group according to the pre-configuration information. At least one of the request body, status and request header of the data in the request response result can be modified by the content modifier.

[0090] A5: The content modifier group includes several content modifiers, which are mainly responsible for reprocessing the HTTP request response results returned by the business system, and can achieve functions such as data desensitization and data watermarking. Each content modifier can modify the body (request body), status (status), headers (request headers), and add cookies.

[0091] In the above step S4, the device calls each content modifier in the content modifier group in sequence according to the second calling order, modifies the data in the request response result, and sends the modified request response result to the client. Continuing with the above A5: For example: the security gateway is configured with two: a data desensitizing modifier and a data watermark modifier. When the business application returns the HTTP request result, the data desensitizing modifier first checks the returned result, identifies the identity number, mobile phone number and other information, and performs coding processing. Then the data watermark modifier adds a data watermark according to the unified requirements of the enterprise.

[0092] After the modification is completed, the request response result after the modification process can be sent to the client.

[0093] It is also possible to send modified request responses to the logger.

[0094] A6: The basic information of the request message is recorded by a logger, and after recording is completed, the modified request response result is sent to the client; the basic information of the request message at least includes the modified data. The logger is responsible for recording the basic information of this request into the log, including the protocol, host, port, request path, request parameters, request body, request method, whether the gateway has modified the response body, response status code, request IP, request time, response time, and execution time (milliseconds).

[0095] A7: The security gateway returns the final request response result to the client.

[0096] The data processing method based on request message provided by the embodiment of the present invention receives the request message sent by the client, determines the authenticator group corresponding to the request message and the first calling order of the authenticators in the authenticator group according to the pre-configuration information; calls each authenticator in the authenticator group in turn according to the first calling order, and performs authority authentication on the request message. If it is determined that the authority authentication results of all authenticators are successful, sends the request message of successful authentication to the business system; receives the request response result fed back by the business system, determines the content modifier group corresponding to the request response result and the second calling order of the content modifiers in the content modifier group according to the pre-configuration information; calls each content modifier in the content modifier group in turn according to the second calling order, modifies the data in the request response result, and sends the modified request response result to the client. The pre-configuration information can realize that the corresponding authenticators and content modifiers can be plugged in and out according to different request messages, and the calling order of the authenticators and content modifiers can be arranged, so as to realize the decoupling of security functions and business functions, and facilitate expansion.

[0097] Furthermore, if it is determined that the authority authentication results of all authenticators are successful, sending a request message of successful authentication to the business system includes:

[0098] If it is determined that the authorization authentication results of all authenticators are successful, the request message of successful authentication is processed and the processed request message is sent to the business system. Please refer to the above description and do not repeat it.

[0099] The data processing method based on request messages provided in the embodiment of the present invention can conveniently expand related functions by processing data.

[0100] Furthermore, modifying the data in the request response result and sending the modified request response result to the client includes:

[0101] The basic information of the request message is recorded, and after recording is completed, the modified request response result is sent to the client; the basic information of the request message at least includes the modified data. Please refer to the above description and no further details will be given.

[0102] The data processing method based on request messages provided by the embodiment of the present invention facilitates subsequent management of data by recording basic information of the request messages.

[0103] Furthermore, at least one of the request body, status and request header of the data in the request response result is modified by the content modifier.

[0104] The request message-based data processing method provided by the embodiment of the present invention can completely modify the data in the request response result.

[0105] Furthermore, the data processing method based on the request message also includes:

[0106] The authenticator that first determines that the authentication failed is used as the target authenticator, the request message is rejected to continue accessing the business system, and a prompt message based on the authentication failure of the target authenticator is generated. Please refer to the above description and no further details will be given.

[0107] The data processing method based on request messages provided by the embodiment of the present invention improves security performance by refusing request messages to continue accessing the business system, and generates a prompt message based on the authentication failure of the target authenticator, so as to facilitate relevant personnel to locate the authenticator that failed the authentication and quickly solve the problem.

[0108] Further, before the step of determining the authenticator group corresponding to the request message and the first calling order of the authenticators in the authenticator group according to the pre-configuration information, the data processing method based on the request message further includes:

[0109] Determine whether the request message needs to be processed by the security gateway according to the pre-configuration information. If it is determined that it needs to be processed by the security gateway, continue to execute the authenticator group corresponding to the request message according to the pre-configuration information, and the first call sequence of the authenticators in the authenticator group, and subsequent steps. Referring to the above description, determine whether the request message needs to be processed by the security gateway according to the rules in the ignorer, and refer to the relevant description of the ignorer, that is, when the HTTP request matches, it directly penetrates the gateway to release, and when it does not match, it is passed to the subsequent interceptor for processing.

[0110] The request message-based data processing method provided by the embodiment of the present invention only processes the request message that needs to be processed by the security gateway, and does not need to process the entire amount of data, thereby reducing the amount of data processing.

[0111] Furthermore, before the step of determining whether the request message needs to be processed by a security gateway according to the pre-configuration information, the data processing method based on the request message further includes:

[0112] Performing matching verification on the request message according to the matching rules in the pre-configured information; the matching rules include at least one of a uniform resource locator, a resource path, a request header, and small text data; the small text data is smaller than a preset data volume;

[0113] If at least one of the matching rules is matched, the matching verification is determined to be successful, and the determination of whether the request message needs to be processed by the security gateway according to the pre-configured information and subsequent steps are continued.

[0114] The data processing method based on the request message provided by the embodiment of the present invention obtains the namespace in the pre-configuration information corresponding to the request message without processing the full amount of data, thereby reducing the amount of data processing.

[0115] The embodiment of the present invention provides a pluggable and programmable application security gateway solution. Through this solution, applications can flexibly select the required security protection functions according to their own needs and arrange the order of priority. Based on this solution, enterprises can develop some general and unified security protection function plug-ins, and the business system can complete unified policy deployment by introducing these plug-ins.

[0116] It should be noted that the data processing method based on request messages provided in the embodiment of the present invention can be used in the financial field, and can also be used in any technical field other than the financial field. The embodiment of the present invention does not limit the application field of the data processing method based on request messages.

[0117] Figure 4 is a schematic diagram of the structure of a data processing device based on a request message provided by an embodiment of the present invention. Figure 4 As shown, the data processing device based on the request message provided by the embodiment of the present invention includes a receiving unit 401, an authentication unit 402, a determination unit 403 and a sending unit 404, wherein:

[0118] The receiving unit 401 is used to receive a request message sent by a client, determine an authenticator group corresponding to the request message and a first calling order of the authenticators in the authenticator group according to pre-configuration information; the authentication unit 402 is used to call each authenticator in the authenticator group in turn according to the first calling order, and perform authority authentication on the request message. If it is determined that the authority authentication results of all authenticators are successful, a request message of successful authentication is sent to the business system; the determining unit 403 is used to receive a request response result fed back by the business system, determine a content modifier group corresponding to the request response result and a second calling order of the content modifiers in the content modifier group according to the pre-configuration information; the sending unit 404 is used to call each content modifier in the content modifier group in turn according to the second calling order, modify the data in the request response result, and send the modified request response result to the client.

[0119] Specifically, the receiving unit 401 in the device is used to receive a request message sent by the client, determine the authenticator group corresponding to the request message and the first calling order of the authenticators in the authenticator group according to the pre-configuration information; the authentication unit 402 is used to call each authenticator in the authenticator group in turn according to the first calling order, and perform authority authentication on the request message. If it is determined that the authority authentication results of all authenticators are successful, a request message of successful authentication is sent to the business system; the determination unit 403 is used to receive the request response result fed back by the business system, determine the content modifier group corresponding to the request response result and the second calling order of the content modifiers in the content modifier group according to the pre-configuration information; the sending unit 404 is used to call each content modifier in the content modifier group in turn according to the second calling order, modify the data in the request response result, and send the modified request response result to the client.

[0120] The data processing device based on request message provided by the embodiment of the present invention receives the request message sent by the client, determines the authenticator group corresponding to the request message and the first calling order of the authenticators in the authenticator group according to the pre-configuration information; calls each authenticator in the authenticator group in turn according to the first calling order, and performs authority authentication on the request message, and if it is determined that the authority authentication results of all authenticators are successful authentication, sends the request message of successful authentication to the business system; receives the request response result fed back by the business system, determines the content modifier group corresponding to the request response result and the second calling order of the content modifiers in the content modifier group according to the pre-configuration information; calls each content modifier in the content modifier group in turn according to the second calling order, modifies the data in the request response result, and sends the modified request response result to the client, and the pre-configuration information can be used to realize the pluggable corresponding authenticators and content modifiers according to different request messages, and the calling order of the authenticators and content modifiers can be arranged, so as to realize the decoupling of security functions and business functions, and facilitate expansion.

[0121] Furthermore, the authentication unit 402 is specifically used for:

[0122] If it is determined that the authorization authentication result of all authenticators is successful, data processing is performed on the successfully authenticated request message, and the processed request message is sent to the business system.

[0123] The data processing device based on request messages provided in the embodiment of the present invention can conveniently expand related functions by processing data.

[0124] Furthermore, the sending unit 404 is specifically configured to:

[0125] The basic information of the request message is recorded, and after the recording is completed, the modified request response result is sent to the client; the basic information of the request message at least includes the modified data.

[0126] The data processing device based on request messages provided by the embodiment of the present invention facilitates subsequent management of data by recording basic information of request messages.

[0127] Furthermore, at least one of the request body, status and request header of the data in the request response result is modified by the content modifier.

[0128] The data processing device based on request message provided by the embodiment of the present invention can completely modify the data in the request response result.

[0129] Furthermore, the data processing device based on the request message is specifically used for:

[0130] The authenticator that is first determined to have failed authentication is used as the target authenticator, the request message is rejected to continue accessing the business system, and a prompt message based on the authentication failure of the target authenticator is generated.

[0131] The data processing device based on request messages provided by the embodiment of the present invention improves security performance by refusing request messages to continue accessing the business system, and generates a prompt message based on the authentication failure of the target authenticator, so as to facilitate relevant personnel to locate the authenticator that failed the authentication and quickly solve the problem.

[0132] Further, before the step of determining the authenticator group corresponding to the request message and the first calling order of the authenticators in the authenticator group according to the pre-configuration information, the data processing device based on the request message is specifically used to:

[0133] Determine whether the request message needs to be processed by the security gateway according to the pre-configuration information. If it is determined that it needs to be processed by the security gateway, continue to execute the authenticator group corresponding to the request message according to the pre-configuration information, and the first call sequence of the authenticators in the authenticator group, and subsequent steps. Referring to the above description, determine whether the request message needs to be processed by the security gateway according to the rules in the ignorer, and refer to the relevant description of the ignorer, that is, when the HTTP request matches, it directly penetrates the gateway to release, and when it does not match, it is passed to the subsequent interceptor for processing.

[0134] The request message-based data processing device provided in the embodiment of the present invention only processes the request message that needs to be processed by the security gateway, and does not need to process the full amount of data, thereby reducing the amount of data processing.

[0135] Further, before the step of determining whether the request message needs to be processed by the security gateway according to the pre-configuration information, the data processing device based on the request message is specifically used to:

[0136] Performing matching verification on the request message according to the matching rules in the pre-configured information; the matching rules include at least one of a uniform resource locator, a resource path, a request header, and small text data; the small text data is smaller than a preset data volume;

[0137] If at least one of the matching rules is matched, the matching verification is determined to be successful, and the determination of whether the request message needs to be processed by the security gateway according to the pre-configured information and subsequent steps are continued.

[0138] The data processing device based on the request message provided by the embodiment of the present invention obtains the namespace in the pre-configuration information corresponding to the request message without processing the full amount of data, thereby reducing the amount of data processing.

[0139] The embodiment of the present invention provides an embodiment of a data processing device based on a request message, which can be specifically used to execute the processing flow of the above-mentioned method embodiments. Its functions are not repeated here, and reference can be made to the detailed description of the above-mentioned method embodiments.

[0140] Figure 5 A schematic diagram of the physical structure of an electronic device provided by an embodiment of the present invention, such as Figure 5 As shown, the electronic device includes: a processor (processor) 501, a memory (memory) 502 and a bus 503;

[0141] The processor 501 and the memory 502 communicate with each other via a bus 503;

[0142] The processor 501 is used to call the program instructions in the memory 502 to execute the methods provided by the above method embodiments, for example, including:

[0143] receiving a request message sent by a client, and determining an authenticator group corresponding to the request message and a first calling order of authenticators in the authenticator group according to pre-configured information;

[0144] Calling each authenticator in the authenticator group in sequence according to the first calling order, and performing authority authentication on the request message, and if it is determined that the authority authentication results of all authenticators are successful, sending a request message of successful authentication to the business system;

[0145] receiving a request response result fed back by the business system, and determining a content modifier group corresponding to the request response result and a second calling order of the content modifiers in the content modifier group according to the preconfiguration information;

[0146] The content modifiers in the content modifier group are called in sequence according to the second calling sequence, the data in the request response result is modified, and the modified request response result is sent to the client.

[0147] This embodiment discloses a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a computer, the computer can perform the methods provided by the above method embodiments, for example, including:

[0148] receiving a request message sent by a client, and determining an authenticator group corresponding to the request message and a first calling order of authenticators in the authenticator group according to pre-configured information;

[0149] Calling each authenticator in the authenticator group in sequence according to the first calling order, and performing authority authentication on the request message, and if it is determined that the authority authentication results of all authenticators are successful, sending a request message of successful authentication to the business system;

[0150] receiving a request response result fed back by the business system, and determining a content modifier group corresponding to the request response result and a second calling order of the content modifiers in the content modifier group according to the preconfiguration information;

[0151] The content modifiers in the content modifier group are called in sequence according to the second calling sequence, the data in the request response result is modified, and the modified request response result is sent to the client.

[0152] This embodiment provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, wherein the computer program enables the computer to execute the methods provided by the above method embodiments, for example, including:

[0153] receiving a request message sent by a client, and determining an authenticator group corresponding to the request message and a first calling order of authenticators in the authenticator group according to pre-configured information;

[0154] Calling each authenticator in the authenticator group in sequence according to the first calling order, and performing authority authentication on the request message, and if it is determined that the authority authentication results of all authenticators are successful, sending a request message of successful authentication to the business system;

[0155] receiving a request response result fed back by the business system, and determining a content modifier group corresponding to the request response result and a second calling order of the content modifiers in the content modifier group according to the preconfiguration information;

[0156] The content modifiers in the content modifier group are called in sequence according to the second calling sequence, the data in the request response result is modified, and the modified request response result is sent to the client.

[0157] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0158] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0159] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0160] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0161] In the description of this specification, the description with reference to the terms "one embodiment", "a specific embodiment", "some embodiments", "for example", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0162] The specific embodiments described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A data processing method based on a request message, characterized in that: include: receiving a request message sent by a client, and determining an authenticator group corresponding to the request message and a first calling order of authenticators in the authenticator group according to pre-configured information; The pre-configuration information is configured autonomously according to the actual business situation and is reflected through a namespace structure diagram. Each namespace includes at least one matcher, one ignorer, one logger, several authenticators, one signer, and several content modifiers. Use the matcher to filter the request messages processed by this group of interceptors, and set multiple namespaces to handle different requests differently. The matcher has a built-in matching rule. When the request message matches any rule, the result is a match, otherwise it is a mismatch. The ignorer has an independent matcher. When the request message matches, it directly passes through the gateway and is released. When it does not match, it is passed to the subsequent interceptor for processing. The authenticator has an independent matcher. When the request message matches, the request is authenticated, and the authentication logic calls the enterprise's unified user authority authentication service. When the authentication passes, the request message is passed to the subsequent interceptor for processing. If there is no match, the request is rejected. The tagger has an independent matcher. When the request message matches, the request is modified, including the path, contextPath, headers, queryParams of the request, and cookies are added. Then the request is forwarded to the business system for processing. When there is no match, the request is directly forwarded to the business system for processing. The content modifier has an independent matcher. When the request message matches, the response result is modified, including the status, headers, body of the response, and adding cookies, and then the response is passed to the logger for processing; when it does not match, the response is passed directly to the logger for processing; The logger has an independent matcher. When the request message matches, the log of this request is recorded. The log includes the protocol, host, port, request path, request parameters, request body, request method, whether the gateway has modified the response body, response status code, request IP, request time, response time, execution time, and then returns the response to the client. If there is no match, the response is returned directly to the client. Calling each authenticator in the authenticator group in sequence according to the first calling order, and performing authority authentication on the request message, and if it is determined that the authority authentication results of all authenticators are successful, sending a request message of successful authentication to the business system; receiving a request response result fed back by the business system, and determining a content modifier group corresponding to the request response result and a second calling order of the content modifiers in the content modifier group according to the preconfiguration information; Calling each content modifier in the content modifier group in sequence according to the second calling sequence, modifying the data in the request response result, and sending the modified request response result to the client, so as to realize the decoupling of security function and business function; Before the step of determining the authenticator group corresponding to the request message and the first calling order of the authenticators in the authenticator group according to the pre-configuration information, the data processing method based on the request message further includes: Determine whether the request message needs to be processed by the security gateway according to the pre-configuration information, and if it is determined that it needs to be processed by the security gateway, continue to perform the steps of determining the authenticator group corresponding to the request message and the first calling order of the authenticators in the authenticator group according to the pre-configuration information, and subsequent steps; Before the step of determining whether the request message needs to be processed by a security gateway according to the pre-configuration information, the data processing method based on the request message further includes: Performing matching verification on the request message according to the matching rules in the pre-configured information; the matching rules include at least one of a uniform resource locator, a resource path, a request header, and small text data; the small text data is smaller than a preset data volume; If it is determined that at least one of the matching rules is matched, it is determined that the matching verification is passed, and the step of determining whether the request message needs to be processed by the security gateway according to the pre-configuration information and subsequent steps are continued; The first calling sequence is security authenticator, user authenticator, and authority authenticator; accordingly, the authority authentication of the request message includes: The security authenticator verifies whether the HTTP request contains any unsafe information. If so, the request is rejected directly. If not, the user authenticator verifies whether the token contained in the cookies is a valid token of the logged-in user and has not timed out. If the verification fails, the request is rejected directly. If the verification is successful, the permission authenticator verifies whether the user has the query permission based on the business logic. If the verification fails, the request is directly rejected. If the verification is successful, a request message indicating successful authentication is sent to the business system.

2. The data processing method based on the request message according to claim 1, characterized in that: If it is determined that the authorization authentication results of all authenticators are successful, a request message of successful authentication is sent to the business system, including: If it is determined that the authorization authentication result of all authenticators is successful, data processing is performed on the successfully authenticated request message, and the processed request message is sent to the business system.

3. The data processing method based on the request message according to claim 1, characterized in that: The modifying the data in the request response result and sending the modified request response result to the client includes: The basic information of the request message is recorded, and after the recording is completed, the modified request response result is sent to the client; the basic information of the request message at least includes the modified data.

4. The data processing method based on the request message according to claim 1, characterized in that: At least one of the request body, status and request header of the data in the request response result is modified by the content modifier.

5. The data processing method based on the request message according to claim 1, characterized in that: The data processing method based on the request message also includes: The authenticator that is first determined to have failed authentication is used as the target authenticator, the request message is rejected to continue accessing the business system, and a prompt message based on the authentication failure of the target authenticator is generated.

6. A data processing device based on a request message, characterized in that: include: A receiving unit, configured to receive a request message sent by a client, and determine an authenticator group corresponding to the request message and a first calling order of authenticators in the authenticator group according to pre-configuration information; The pre-configuration information is configured autonomously according to the actual business situation and is reflected through a namespace structure diagram. Each namespace includes at least one matcher, one ignorer, one logger, several authenticators, one signer, and several content modifiers. Use the matcher to filter the request messages processed by this group of interceptors, and set multiple namespaces to handle different requests differently. The matcher has a built-in matching rule. When the request message matches any rule, the result is a match, otherwise it is a mismatch. The ignorer has an independent matcher. When the request message matches, it directly passes through the gateway and is released. When it does not match, it is passed to the subsequent interceptor for processing. The authenticator has an independent matcher. When the request message matches, the request is authenticated, and the authentication logic calls the enterprise's unified user authority authentication service. When the authentication passes, the request message is passed to the subsequent interceptor for processing. If there is no match, the request is rejected. The tagger has an independent matcher. When the request message matches, the request is modified, including the path, contextPath, headers, queryParams of the request, and cookies are added. Then the request is forwarded to the business system for processing. When there is no match, the request is directly forwarded to the business system for processing. The content modifier has an independent matcher. When the request message matches, the response result is modified, including the status, headers, body of the response, and adding cookies, and then the response is passed to the logger for processing; when it does not match, the response is passed directly to the logger for processing; The logger has an independent matcher. When the request message matches, the log of this request is recorded. The log includes the protocol, host, port, request path, request parameters, request body, request method, whether the gateway has modified the response body, response status code, request IP, request time, response time, execution time, and then returns the response to the client. If there is no match, the response is returned directly to the client. an authentication unit, configured to call each authenticator in the authenticator group in sequence according to the first calling sequence, and perform authority authentication on the request message, and if it is determined that the authority authentication results of all authenticators are successful, send a request message of successful authentication to the business system; a determining unit, configured to receive a request response result fed back by the business system, and determine a content modifier group corresponding to the request response result and a second calling order of the content modifiers in the content modifier group according to the preconfiguration information; A sending unit, used for calling each content modifier in the content modifier group in sequence according to the second calling sequence, modifying the data in the request response result, and sending the modified request response result to the client, so as to realize the decoupling of security function and business function; Before the step of determining the authenticator group corresponding to the request message and the first calling order of the authenticators in the authenticator group according to the preconfiguration information, the data processing device based on the request message is further used to: Determining whether the request message needs to be processed by a security gateway according to the pre-configuration information, and if it is determined that the request message needs to be processed by a security gateway, continuing to perform the steps of determining an authenticator group corresponding to the request message and a first calling sequence of authenticators in the authenticator group according to the pre-configuration information, and subsequent steps; Before the step of determining whether the request message needs to be processed by the security gateway according to the pre-configuration information, the data processing device based on the request message is further used to: Performing matching verification on the request message according to the matching rules in the pre-configured information; the matching rules include at least one of a uniform resource locator, a resource path, a request header, and small text data; the small text data is smaller than a preset data volume; If it is determined that at least one of the matching rules is matched, it is determined that the matching verification is passed, and the step of determining whether the request message needs to be processed by the security gateway according to the pre-configuration information and subsequent steps are continued; The first calling sequence is security authenticator, user authenticator, and authority authenticator; accordingly, the authority authentication of the request message includes: The security authenticator verifies whether the HTTP request contains any unsafe information. If so, the request is rejected directly. If not, the user authenticator verifies whether the token contained in the cookies is a valid token of the logged-in user and has not timed out. If the verification fails, the request is rejected directly. If the verification is successful, the permission authenticator verifies whether the user has the query permission based on the business logic. If the verification fails, the request is directly rejected. If the verification is successful, a request message indicating successful authentication is sent to the business system.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 5 are implemented.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images