A method and system for dynamically encrypting application request data based on IAST tools

Abstract

This invention discloses a method and system for dynamically encrypting application request data based on the IAST tool. The method includes: marking request URIs related to personal data in the application with a first marking feature; determining whether there is a request URI with the first marking feature in the request entering the application; if so, marking the request data representing the request content in the request with a second marking feature; marking the return data of the data propagation function with a third marking feature; when the SQL statement executed by the current database function is an insert statement, encrypting and storing the data with the third marking feature to be stored in the database with an encryption key using an encryption key; according to the above method, the data to be stored in the database in the request can be encrypted with an encryption key, thereby achieving the purpose of encrypted storage and effectively improving the security performance of the application.

Description

Technical Field

[0001] This invention relates to the field of application privacy data security protection technology, and in particular to a method and system for dynamically encrypting application request data based on the IAST tool. Background Technology

[0002] With the continuous development of networking, the number of applications is increasing, and personal data is constantly being transmitted between these applications. This has prompted people to pay more attention to the protection of personal data. In response, more and more applications are beginning to implement various security hardening measures for personal data, including standardized storage, restricted transmission, and storage encryption. However, for many applications, with constant changes and iterations in developers, it is difficult to find the previous developers to modify the relevant business logic. Thus, due to insufficient understanding of the application's business logic and security knowledge, hardening the application's security is quite difficult. Summary of the Invention

[0003] The purpose of this invention is to provide a method for encrypting and storing user data in an application database.

[0004] To achieve the above objectives, this invention discloses a method for dynamically encrypting application request data based on the IAST tool, comprising:

[0005] The IAST tool is used to instrument the target application to track the propagation path of requests entering the application;

[0006] The request URIs related to personal data in the application are marked using a first marking feature, wherein the request URI represents the type of request;

[0007] Determine whether there is a request URI with the first marking feature in the request from the user entering the application; if so, use the second marking feature to mark the request data representing the request content in the request.

[0008] Determine whether the parameter data of the data propagation function input to the current application contains the second marking feature. If so, use the third marking feature to mark the return data of the data propagation function.

[0009] When the SQL statement executed by the database function is an insert statement, the data with the third tag feature to be stored in the database is encrypted and stored using an encryption key.

[0010] Preferably, an encryption feature, which is a characteristic character, is added to the encrypted data stored in the database.

[0011] Preferably, after encrypting the current data with an encryption key, the storage address of the encrypted data in the database is recorded to obtain a feature record table.

[0012] Preferably, the request data with the second marker feature is further filtered according to a preset rule, and when the request data meets the preset rule, the second marker feature on the request data is removed.

[0013] This invention also discloses a system for dynamically encrypting application request data based on the IAST tool, comprising:

[0014] Instrumentation module, which is used to instrument a target application via IAST tools to track the propagation path of requests into the application;

[0015] The first marking module uses a first marking feature to mark request URIs related to personal data in the application, wherein the request URI represents the type of request;

[0016] The second marking module is used to mark the request data representing the request content in the request when the request URI in the request from the user has the first marking feature.

[0017] The third marking module is used to mark the return data of the data propagation function with the third marking feature when the parameter data of the data propagation function of the current application contains the second marking feature;

[0018] The encryption module is used to encrypt and store the data with a third marker feature that is to be stored in the database when the SQL statement executed by the current database function is an insert statement, using an encryption key.

[0019] Preferably, it also includes a feature adding module, which is used to add encryption features to the encrypted data, wherein the encryption features are feature characters.

[0020] Preferably, it also includes a recording module for recording the storage address of encrypted data in the database to obtain a feature record table.

[0021] Preferably, the system also includes a filtering module, which is used to filter request data with the second marker feature according to preset rules.

[0022] The present invention also discloses another system for dynamically encrypting application request data, comprising:

[0023] One or more processors;

[0024] Memory;

[0025] And one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs including instructions for performing the method of dynamically encrypting application request data based on the IAST tool as described above.

[0026] The present invention also discloses a computer-readable storage medium comprising a computer program that can be executed by a processor to perform the method described above for dynamically encrypting application request data based on the IAST tool.

[0027] Compared with existing technologies, the above-mentioned technical solution of the present invention identifies privacy requests by marking the request URIs related to personal privacy data in the application. In this way, when a privacy request containing personal data enters the application, the request data in the privacy request is marked again. Then, based on the second marking feature, during the request propagation stage, it can be determined whether the parameter data of the propagation function is privacy data. Thus, the return data of the propagation function that belongs to privacy data is marked a third time. Furthermore, when data with the third marking feature enters the database for storage, the current data can be encrypted using an encryption key, thereby achieving the purpose of encrypted storage and effectively improving the security performance of the application. Attached Figure Description

[0028] Figure 1 This is a flowchart illustrating the dynamic encryption application requesting data in an embodiment of the present invention.

[0029] Figure 2 This is a schematic diagram illustrating the principle structure of dynamically encrypted application request data in one embodiment of the present invention.

[0030] Figure 3 This is a schematic diagram illustrating the principle structure of dynamically encrypted application request data in another embodiment of the present invention.

[0031] Figure 4 This is a schematic diagram illustrating the principle structure of dynamically encrypted application request data in another embodiment of the present invention.

[0032] Figure 5 This is a schematic diagram illustrating the principle structure of dynamically encrypted application request data in another embodiment of the present invention. Detailed Implementation

[0033] To illustrate the technical content, structural features, objectives, and effects of the present invention in detail, the following description is provided in conjunction with the embodiments and accompanying drawings.

[0034] This embodiment discloses a method for dynamically encrypting application request data to encrypt and store personal privacy data received by the application, thereby ensuring the security of personal data transmission between applications. Specifically, as shown... Figure 1 The method includes the following steps:

[0035] S1: Use the IAST tool to instrument the target application to track the propagation path of requests entering the application.

[0036] S2: Use the first tagging feature to tag the request URIs related to personal data in the application. The request URI represents the type of request, such as / user, / project, / app, / rule, where / user is the request URI related to personal data, so the first tagging feature is used to tag / user.

[0037] S3: Determine if there is a request URI with the first marker feature in the user's request to the application. If yes, proceed to S4; otherwise, skip directly.

[0038] S4: Use the second marking feature to mark the request data representing the request content in the request. For example, through the instrumentation request parsing function, the request URI in the current request is obtained as / user, and the request data is {"email": "zhangsan@qq.com", "age": "33", "card": "342415667412092743", "time": "2022-07-03", "group": "test", "id": "1", "name": "zhangsan"}. Since the request URI " / user" has the first marking feature, the second marking feature is used to mark the request data.

[0039] S5: Determine whether the parameter data of the data propagation function input to the current application contains the second marker feature. If yes, proceed to step S6 below; otherwise, skip directly. It should also be noted that the application's request processing (i.e., the request propagation process) is roughly divided into four stages, processed by key functions in these four stages: the input stage, the propagation stage, the encoding / decoding stage, and the output stage. In this embodiment, the data propagation function is the key function for the application's propagation stage.

[0040] S6: Track the data propagation function and mark the returned data of the data propagation function using the third marking feature.

[0041] S7: When a database function is called, if the SQL statement executed by the current database function is an insert statement, parse the SQL statement and extract information such as the data table, fields, and field values. The extracted format is such as {"tableName":"users","fields":[{"name":"email","value":"zhangsan@qq.com"}, {"name":"age","value":"33"}, {"name":"card","value":"342415667412092743"}, {"name":"time","value":"2022-07-03"}, {"name":"group","value":"test"}, {"name":"id","value":"1"}, {"name":"name","value":"zhangsan"}]}. Then, use an encryption key to encrypt and store the data with the third-party identifier that is to be stored in the database. For example, encrypting "zhangsan@qq.com" results in "xxxxxx"; encrypting "33" results in "yyyyyy"; encrypting "342415667412092743" results in "zzzzzz"; and encrypting "zhangsan" results in "tttttt".

[0042] It is worth noting that in the above embodiments, the first marker feature, the second marker feature, and the third marker feature can be the same marker or different markers.

[0043] The method for dynamically encrypting application request data according to the above embodiments encrypts user-stored data marked as personal privacy data in the application's database, thereby dynamically completing the encryption of personal data in the request. Moreover, it is imperceptible to the user, thus improving the security of personal data transmission between applications and effectively enhancing the user experience.

[0044] Furthermore, after the request data enters the propagation phase, its form changes due to the execution of the propagation function. Therefore, if the returned data of the propagation function is not marked, after parsing the request data to be stored from the SQL statement, it is necessary to iterate through the data to determine whether it is marked. Therefore, the IAST tool is used to trace the application's propagation function and mark its returned data. For example, the following request execution code uses a third marking feature to mark the insertUserStringBuilder object and the SQL object.

[0045] try{

[0046] User user = JSON.toJsonString(request.getBody(), User.class); / / Request data for the URI ( / user)

[0047] Class.forName("com.mysql.jdbc.Driver"); / / Load the driver

[0048] String url = "jdbc:mysql: / / localhost:3306 / test"; / / Define the connection string url, where test is the database name

[0049] Connection conn = DriverManager.getConnection(url,"root","root"); / / Connect to the database

[0050] String baseSql="insert into users(email,age,card,time,group,id,name)values";

[0051] String insertUserStringBuilder=new StringBuilder(baseSql);

[0052] insertUserStringBuilder.append(“(“).append(user.getEmail()).append(“,”).appe nd(user.getAge()).append(“,”).append(user.getCard()).append(“,”).append(user.getTime()).append(“,”).append(user.getGroup()).append(“,”).append(user.getId()).append (",").append(user.getName()).append(")"); / / Data propagation function, here you need to mark the insertUserStringBuilder object;

[0053] String sql = insertStringBuilder.toString(); / / Data propagation function, the sql object needs to be marked here.

[0054] PreparedStatement pstmt = conn.prepareStatement(sql); / / Get the prepared object

[0055] int res = pstmt.executeUpdate(); / / Execute the SQL statement, which is insert into users(email,age,card,time,group,id,name) values(“zhangsan@qq.com”,“33”,“342415667412092743”,“2022-07-03”,“test”,“1”,“ zhangsan”); This part parses and replaces the data.

[0056] if (res > 0) {

[0057] System.out.println("Data entry successful");

[0058] }

[0059] pstmt.close(); / / Close resources

[0060] conn.close(); / / Close the resource

[0061] }catch(Exception e){

[0062] e.printStackTrace();

[0063] }

[0064] This allows personal privacy data waiting to be stored in the database to be directly marked with a unique identifier, eliminating the need for traversal queries to determine whether the data awaiting storage is data that requires encryption. This avoids slowing down the application's performance due to traversal queries during the encryption process.

[0065] Furthermore, since the encrypted data is essentially no different from the original data (both are strings, e.g., the original data is zhangsan, and the encrypted data is U2FsdGVkX18GleBPIMp5McnqgMXIo2jybLJhoZQZ8qg), in order to enable the decryption program to quickly identify the data object to be decrypted when accessing private data, in step S7 above, an encryption feature is added to the encrypted data stored in the database. This encryption feature is a characteristic character, such as V_AES_00000, so that V_AES_00000_U2FsdGVkX18GleBPIMp5McnqgMXIo2jybLJhoZQZ8qg can be obtained.

[0066] Furthermore, for encrypted data with added encryption features, decryption requires traversing the returned data to determine if it contains encryption features. While this has little impact on response time for simple requests, it significantly affects response time for complex requests involving batch queries, where the returned data volume is large. Traversing each returned data segment takes considerable time, severely impacting response time. Therefore, this embodiment discloses a second method for identifying whether data retrieved from a database is encrypted:

[0067] After encrypting the current data using an encryption key, the storage address of the encrypted data in the database is recorded to obtain a feature record table.

[0068] In this embodiment, when the database function executes a query operation, the IAST tool is used to obtain the returned data of the current request and the storage address of the returned data. Then, the feature record table is queried to determine if the storage address of the returned data is located in the feature record table. If it is, the returned data is decrypted using the decryption key, and then the decrypted returned data is displayed. If not, the returned data is displayed directly. In this embodiment, for the returned data of the request, it is only necessary to query the feature record table to determine whether the returned data is encrypted, without needing to traverse every character in the returned data, thereby effectively reducing the response time of the returned data and improving the user experience.

[0069] Furthermore, in step S4 above, request data with the second marker feature can be filtered according to preset rules. When the request data meets the preset rules, the second marker feature on the request data is removed. Specifically, in this embodiment, the preset rules include a blacklist and / or a whitelist, which are set with preset field names or regular expressions to match the request data. For example, if there is a rule in the blacklist with the known field name "id", then the data "id": "1" in step 4 can be marked and cleaned, that is, the second marker feature on it can be removed, and it will not be tracked further.

[0070] Furthermore, request data with second-label features can be further filtered through neural network-based learning algorithms to intelligently filter personal private data with high accuracy.

[0071] In another preferred embodiment of the present invention, such as Figure 2 The system also discloses a system for dynamically encrypting application request data based on the IAST tool, which includes an instrumentation module 10, a first marking module 11, a second marking module 12, a third marking module 13, and an encryption module 14.

[0072] Instrumentation module 10 is used to instrument a target application using the IAST tool to track the propagation path of requests entering the application.

[0073] The first marking module 11 uses a first marking feature to mark the request URIs related to personal data in the application, where the request URI represents the type of request.

[0074] The second marking module 12 is used to mark the request data representing the request content in the request when the request URI in the request from the user has a first marking feature.

[0075] The third marking module 13 is used to mark the return data of the data propagation function with the third marking feature when the parameter data of the data propagation function of the current application contains the second marking feature.

[0076] The encryption module 14 is used to encrypt and store the data with a third-signature feature that is to be stored in the database using an encryption key when the SQL statement executed by the current database function is an insert statement.

[0077] Furthermore, such as Figure 3 The system also includes a feature addition module 15, which is used to add encryption features to the encrypted data, and the encryption features are feature characters.

[0078] In addition, such as Figure 4The system may also be equipped with a recording module 16, which is used to record the storage address of encrypted data in the database in order to obtain a feature record table.

[0079] Furthermore, such as Figure 5 The system further includes a filtering module 17, which filters request data with second labeling features according to preset rules. Additionally, the request data with second labeling features can be filtered again using a neural network-based learning algorithm.

[0080] It should be noted that the working principle and operation mode of the system for dynamically encrypting application data requests in this embodiment are detailed in the above-described method for dynamically encrypting application data requests, and will not be repeated here.

[0081] This invention also discloses another system for dynamically encrypting application request data, comprising one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs including instructions for performing the method of dynamically encrypting application request data as described above. The processor may be a general-purpose central processing unit (CPU), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, used to execute the relevant program to implement the functions required by the modules in the system for dynamically encrypting application request data according to the embodiments of this application, or to execute the method of dynamically encrypting application request data according to the method embodiments of this application.

[0082] The present invention also discloses a computer-readable storage medium comprising a computer program executable by a processor to perform a method for requesting data by a dynamically encrypted application as described above. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium can be read-only memory (ROM), random access memory (RAM), or magnetic media, such as floppy disks, hard disks, magnetic tapes, magnetic disks, or optical media, such as digital versatile discs (DVDs), or semiconductor media, such as solid-state disks (SSDs).

[0083] This application also discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. The processor of an electronic device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the electronic device to perform the aforementioned method for requesting data from a dynamically encrypted application.

[0084] The above-disclosed embodiments are merely preferred embodiments of the present invention and should not be construed as limiting the scope of the present invention. Therefore, any equivalent variations made in accordance with the claims of the present invention are still within the scope of the present invention.

Claims

1. A method for dynamically encrypting application request data based on the IAST tool, characterized in that, include: The IAST tool is used to instrument the target application to track the propagation path of requests entering the application; The request URIs related to personal data in the application are marked using a first marking feature, wherein the request URI represents the type of request; Determine whether there is a request URI with the first marking feature in the request from the user entering the application; if so, use the second marking feature to mark the request data representing the request content in the request. Determine whether the parameter data of the data propagation function input to the current application contains the second marking feature. If so, use the third marking feature to mark the return data of the data propagation function. When the SQL statement executed by the current database function is an insert statement, the data with the third marker feature to be stored in the database is encrypted and stored using an encryption key, and the storage address of the encrypted data in the database is recorded to obtain the feature record table.

2. The method for dynamically encrypting application request data based on the IAST tool according to claim 1, characterized in that, Furthermore, encryption features are added to the encrypted data stored in the database, and these encryption features are characteristic characters.

3. The method for dynamically encrypting application request data based on the IAST tool according to claim 1, characterized in that, The system also filters request data with the second marker feature according to preset rules. When the request data meets the preset rules, the second marker feature on the request data is removed.

4. A system for dynamically encrypting application request data based on the IAST tool, characterized in that, include: Instrumentation module, which is used to instrument a target application via IAST tools to track the propagation path of requests into the application; The first marking module uses a first marking feature to mark request URIs related to personal data in the application, wherein the request URI represents the type of request; The second marking module is used to mark the request data representing the request content in the request by using the second marking feature when the request URI in the request from the user has the first marking feature. The third marking module is used to mark the return data of the data propagation function with the third marking feature when the parameter data of the data propagation function of the current application contains the second marking feature; An encryption module is used to encrypt and store data with the third marker feature that is currently to be stored in the database when the SQL statement executed by the current database function is an insert statement, using an encryption key. A recording module is used to record the storage address of encrypted data in the database to obtain a feature record table.

5. The system for dynamically encrypting application request data based on the IAST tool according to claim 4, characterized in that, It also includes a feature addition module, which is used to add encryption features to the encrypted data, wherein the encryption features are feature characters.

6. The system for dynamically encrypting application request data based on the IAST tool according to claim 4, characterized in that, It also includes a filtering module, which is used to filter request data with the second marker feature according to preset rules.

7. A system for dynamically encrypting application request data, characterized in that, include: One or more processors; Memory; And one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs including instructions for performing the method of dynamically encrypting application request data based on the IAST tool as described in any one of claims 1 to 3.

8. A computer-readable storage medium, characterized in that, Includes a computer program that can be executed by a processor to perform the method for dynamically encrypting application request data based on the IAST tool as described in any one of claims 1 to 3.

Images