Data access method and device

Abstract

The embodiments of the present disclosure provide a data access method and device. The data access method includes: first, in response to receiving an initialization request sent by a client, using a preset private key and preset parameters to obtain initial parameters corresponding to the initialization request according to the file version and the current operating environment, wherein the initialization request includes the text version of the Javascript file and the current operating environment, and then sending the initial parameters to the client so that the client initializes the initial parameters based on the preset public key and obtains the access parameters corresponding to the access operation, and then in response to receiving an access request sent by the client, based on the preset parameters, the access parameters in the access request are parameter verified, and an access result corresponding to the verification result is generated, and finally the access result is sent to the client so that the client presents the access result, thereby realizing request replay detection for data access and improving the security strength of data access and adaptability to different environments.

Description

Technical Field

[0001] The embodiments of the present disclosure relate to the fields of computer technology and Internet technology, specifically to the fields of network security technology and data processing technology, and especially to a data access method and device. Background Art

[0002] With the rapid development of Internet technology, the Internet has penetrated into people's daily lives, especially with the rapid rise of e-government and e-commerce, people can easily obtain information and handle business on the Internet. At the same time, the security of websites has also been challenged. Malicious users maliciously obtain website data or participate in website discounts and promotions through replay requests to make profits, causing economic losses to enterprises. The current methods of request replay detection mainly include: detection method based on digital signature algorithm; detection method based on message authentication code algorithm; detection method based on server-side token; detection method based on timestamp.

[0003] However, the above detection method has low security and cannot guarantee that the request parameters are legal, or the detection can be bypassed by simply tampering with the timestamp. Summary of the invention

[0004] The embodiments of the present disclosure provide a data access method, device, electronic device, and computer-readable medium.

[0005] In a first aspect, an embodiment of the present disclosure provides a data access method, the method comprising: in response to receiving an access operation from a user, sending an initialization request to a server based on a text version of a Javascript file and a current operating environment, so that the server obtains initial parameters corresponding to the initialization request based on the file version and the current operating environment using a preset private key and preset parameters; in response to receiving the initial parameters sent by the server, initializing the initial parameters based on a preset public key, and obtaining access parameters corresponding to the access operation; sending an access request generated based on the access parameters to the server, so that the server performs parameter verification on the access parameters based on the preset parameters, and generates an access result corresponding to the verification result; receiving and presenting the access result sent by the server.

[0006] In some embodiments, in response to receiving the initial parameters sent by the server, the initial parameters are initialized based on a preset public key, and access parameters corresponding to the access operation are obtained, including: in response to receiving the initial parameters sent by the server, performing format verification on the parameter format of the initial parameters; in response to determining that the parameter format of the initial parameters passes the format verification, the initial parameters are decoded to obtain signature preset parameters; performing signature verification on the signature preset parameters based on the preset public key; in response to determining that the signature preset parameters pass the signature verification, obtaining the access parameters corresponding to the access operation based on the preset parameters.

[0007] In some embodiments, in response to determining that the signature preset parameters pass the signature verification, obtaining access parameters corresponding to the access operation based on the preset parameters includes: in response to determining that the signature preset parameters pass the signature verification, generating a time parameter based on a random function and a timestamp corresponding to the access operation; generating a request parameter based on key parameters corresponding to the access operation; generating an environment parameter based on the preset parameters, time parameters, request parameters and the current operating environment; and using the time parameter, request parameter and environment parameter as the access parameter corresponding to the access operation.

[0008] In some embodiments, the preset parameters include an initial vector, a version number of the initial vector, a hash algorithm, and a number of calculation rounds; and, based on the preset parameters, time parameters, request parameters, and the current operating environment, generating environmental parameters, including: concatenating the initial vector, time parameters, request parameters, and the current operating environment to generate a concatenated string; performing hash calculation on the concatenated string based on the hash algorithm and the number of calculation rounds to obtain a hash result; generating environmental parameters based on the hash result and the version number of the initial vector.

[0009] In some embodiments, the preset parameters also include an executable code segment corresponding to the file version and the current running environment; and, in response to determining that the signature preset parameters pass the signature verification, generating a time parameter based on the random function and the timestamp corresponding to the access operation, including: in response to determining that the signature preset parameters pass the signature verification, initializing the executable code segment; in response to completing the initialization of the executable code segment, generating a time parameter based on the random function and the timestamp corresponding to the access operation.

[0010] In a second aspect, an embodiment of the present disclosure provides a data access method, the method comprising: in response to receiving an initialization request sent by a client, obtaining initial parameters corresponding to the initialization request based on a file version and a current operating environment using a preset private key and preset parameters, wherein the initialization request includes a text version of the Javascript file and the current operating environment; sending the initial parameters to the client so that the client initializes the initial parameters based on a preset public key and obtains access parameters corresponding to the access operation; in response to receiving an access request sent by the client, performing parameter verification on the access parameters in the access request based on preset parameters, and generating an access result corresponding to the verification result; sending the access result to the client so that the client presents the access result.

[0011] In some embodiments, in response to receiving an initialization request sent by a client, the initial parameters corresponding to the initialization request are obtained based on the file version and the current operating environment using a preset private key and preset parameters, including: in response to receiving an initialization request sent by a client, the preset parameters corresponding to the initialization request are determined based on the file version and the current operating environment; the preset parameters are signed using a preset private key to obtain signed preset parameters; and the signed preset parameters are encoded to obtain the initial parameters corresponding to the initialization request.

[0012] In some embodiments, in response to receiving an access request sent by a client, parameter verification is performed on the access parameters in the access request based on preset parameters, and an access result corresponding to the verification result is generated, including: in response to receiving an access request sent by the client, format verification is performed on the access parameters in the access request; in response to determining that the access parameters pass the format verification, content verification is performed on the access parameters based on preset parameters to obtain a verification result; and an access result corresponding to the verification result is generated.

[0013] In some embodiments, the access parameters include time parameters, request parameters, environment parameters and identification parameters; and, in response to determining that the access parameters pass format verification, content verification is performed on the access parameters based on preset parameters to obtain verification results, including: in response to determining that the access parameters pass format verification, time verification is performed on the time parameters based on the current time and a first time threshold in the preset parameters; in response to determining that the time parameters pass time verification, determining whether the version number of the initial vector in the preset parameters and the version number of the initial vector in the environment parameters are the same; in response to determining that the version number of the initial vector in the preset parameters and the version number of the initial vector in the environment parameters are the same, performing environment verification on the environment parameters based on the preset parameters and a running environment set; in response to determining that the environment parameters pass environment verification, request time verification is performed on the identification parameters based on an identification information set and a second time threshold in the preset parameters; in response to determining that the identification parameters pass request time verification, obtaining access data corresponding to the access operation.

[0014] In some embodiments, in response to determining that the access parameter passes format verification, content verification is performed on the access parameter based on preset parameters to obtain a verification result, and also includes: in response to determining that the identification parameter does not pass request time verification, generating an access result of access failure.

[0015] In some embodiments, the method further includes: storing the identification parameter and the current time in association with each other in the identification information set.

[0016] In a third aspect, an embodiment of the present disclosure provides a data access device, which includes: a sending module, configured to, in response to receiving an access operation from a user, send an initialization request to a server based on a text version of a Javascript file and a current running environment, so that the server obtains initial parameters corresponding to the initialization request based on the file version and the current running environment using a preset private key and preset parameters; an initialization module, configured to, in response to receiving the initial parameters sent by the server, initialize the initial parameters based on a preset public key, and obtain access parameters corresponding to the access operation; a sending module, configured to send an access request generated based on the access parameters to the server, so that the server performs parameter verification on the access parameters based on the preset parameters, and generates an access result corresponding to the verification result; a receiving module, configured to receive and present the access result sent by the server.

[0017] In some embodiments, the initialization module is further configured to: in response to receiving the initial parameters sent by the server, perform format verification on the parameter format of the initial parameters; in response to determining that the parameter format of the initial parameters passes the format verification, decode the initial parameters to obtain signature preset parameters; perform signature verification on the signature preset parameters based on a preset public key; in response to determining that the signature preset parameters pass the signature verification, obtain access parameters corresponding to the access operation based on the preset parameters.

[0018] In some embodiments, the initialization module is further configured to: in response to determining that the signature preset parameters pass the signature verification, generate a time parameter based on a random function and a timestamp corresponding to the access operation; generate a request parameter based on the key parameters corresponding to the access operation; generate an environment parameter based on the preset parameters, time parameters, request parameters and the current operating environment; and use the time parameter, request parameter and environment parameter as the access parameter corresponding to the access operation.

[0019] In some embodiments, the preset parameters include an initial vector, a version number of the initial vector, a hash algorithm and a number of calculation rounds; and the initialization module is further configured to: concatenate the initial vector, time parameters, request parameters and the current operating environment to generate a concatenated string; perform hash calculation on the concatenated string based on the hash algorithm and the number of calculation rounds to obtain a hash result; and generate environmental parameters based on the hash result and the version number of the initial vector.

[0020] In some embodiments, the preset parameters also include an executable code segment corresponding to the file version and the current operating environment; and the initialization module is further configured to: in response to determining that the signature preset parameters pass the signature verification, initialize the executable code segment; in response to completing the initialization of the executable code segment, generate a time parameter based on the random function and the timestamp corresponding to the access operation.

[0021] In a fourth aspect, an embodiment of the present disclosure provides a data access device, which includes: an acquisition module, configured to respond to an initialization request sent by a client, and obtain initial parameters corresponding to the initialization request by using a preset private key and preset parameters according to a file version and a current operating environment, wherein the initialization request includes a text version of the Javascript file and the current operating environment; a sending module, configured to send the initial parameters to the client, so that the client initializes the initial parameters based on a preset public key, and obtains access parameters corresponding to the access operation; a verification module, configured to respond to an access request sent by the client, and perform parameter verification on the access parameters in the access request based on preset parameters, and generate an access result corresponding to the verification result; and a sending module, configured to send the access result to the client, so that the client presents the access result.

[0022] In some embodiments, the acquisition module is further configured to: in response to receiving an initialization request sent by the client, determine the preset parameters corresponding to the initialization request based on the file version and the current operating environment; sign the preset parameters using a preset private key to obtain signed preset parameters; encode the signed preset parameters to obtain the initial parameters corresponding to the initialization request.

[0023] In some embodiments, the verification module is further configured to: in response to receiving an access request sent by a client, perform format verification on the access parameters in the access request; in response to determining that the access parameters pass the format verification, perform content verification on the access parameters based on preset parameters to obtain a verification result; and generate an access result corresponding to the verification result.

[0024] In some embodiments, the access parameters include time parameters, request parameters, environment parameters and identification parameters; and the verification module is further configured to: in response to determining that the access parameters pass the format verification, perform time verification on the time parameters based on the current time and the first time threshold in the preset parameters; in response to determining that the time parameters pass the time verification, determine whether the version number of the initial vector in the preset parameters and the version number of the initial vector in the environment parameters are the same; in response to determining that the version number of the initial vector in the preset parameters and the version number of the initial vector in the environment parameters are the same, perform environment verification on the environment parameters based on the preset parameters and the operating environment set; in response to determining that the environment parameters pass the environment verification, perform request time verification on the identification parameters based on the identification information set and the second time threshold in the preset parameters; in response to determining that the identification parameters pass the request time verification, obtain access data corresponding to the access operation.

[0025] In some embodiments, the verification module is further configured to: in response to determining that the identification parameter does not pass the request time verification, generate an access result of access failure.

[0026] In some embodiments, the device further includes: a storage module configured to store the identification parameter and the current time in association with each other in the identification information set.

[0027] In a fifth aspect, an embodiment of the present disclosure provides an electronic device, comprising: one or more processors; a storage device on which one or more programs are stored; when the one or more programs are executed by one or more processors, the one or more processors implement the data access method described in any embodiment of the first aspect or the second aspect.

[0028] In a sixth aspect, an embodiment of the present disclosure provides a computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the data access method as described in any embodiment of the first aspect or the second aspect.

[0029] The data access method provided by the embodiment of the present disclosure, the execution subject first responds to receiving the user's access operation, and based on the text version of the Javascript file and the current operating environment, sends an initialization request to the server, so that the server obtains the initial parameters corresponding to the initialization request based on the file version and the current operating environment using the preset private key and the preset parameters, and then responds to receiving the initial parameters sent by the server, initializes the initial parameters based on the preset public key, obtains the access parameters corresponding to the access operation, and then sends an access request generated based on the access parameters to the server, so that the server verifies the access parameters based on the preset parameters and generates an access result corresponding to the verification result, and finally receives and presents the access result sent by the server, and uses the Javascript file to calculate the correct hash value after initialization, effectively defends against the attack method of static code analysis, and dynamically obtains the initial parameters based on the file version and the current operating environment, can make judgments for different operating environments, identify different abnormal environments, increase the difficulty of analysis for attackers, realize request replay detection for data access, and improve the security strength of data access and adaptability to different environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Other features, objects and advantages of the present disclosure will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings:

[0031] Figure 1 is an exemplary system architecture diagram in which an embodiment of the present disclosure may be applied;

[0032] Figure 2 is a flow chart of an embodiment of a data access method according to the present disclosure;

[0033] Figure 3is a flowchart of an embodiment of obtaining access parameters corresponding to an access operation based on preset parameters according to the present disclosure;

[0034] Figure 4 is a flowchart of another embodiment of obtaining access parameters corresponding to an access operation based on preset parameters according to the present disclosure;

[0035] Figure 5 is a flow chart of another embodiment of a data access method according to the present disclosure;

[0036] Figure 6 is a flow chart of an embodiment of performing parameter verification on access parameters in an access request according to the present disclosure;

[0037] Figure 7 is a flow chart of an embodiment of content verification of access parameters according to the present disclosure;

[0038] Figure 8 is a structural diagram of an embodiment of a data access device according to the present disclosure;

[0039] Fig. 9 is a structural schematic diagram of another embodiment of a data access device according to the present disclosure;

[0040] Fig.10 It is a schematic diagram of the structure of an electronic device suitable for implementing the embodiments of the present disclosure. DETAILED DESCRIPTION

[0041] The present disclosure is further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the relevant disclosure, rather than to limit the disclosure. It is also necessary to explain that, for ease of description, only the parts related to the relevant disclosure are shown in the accompanying drawings.

[0042] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present disclosure may be combined with each other. The present disclosure will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0043] Figure 1 An exemplary system architecture 100 is shown to which the data access method and apparatus according to the embodiments of the present disclosure can be applied.

[0044] like Figure 1 As shown, the system architecture 100 may include terminal devices 104, 105, 106, a network 107, and servers 101, 102, 103. The network 107 is used to provide a medium for communication links between the terminal devices 104, 105, 106 and the servers 101, 102, 103. The network 107 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0045] Users can interact with servers 101, 102, 103 belonging to the same server cluster through terminal devices 104, 105, 106 via network 107 to receive or send information, etc. Various applications can be installed on terminal devices 104, 105, 106, such as item display applications, data analysis applications, search applications, etc.

[0046] The terminal devices 104, 105, and 106 may be hardware or software. When the terminal device is hardware, it may be various electronic devices having a display screen and supporting communication with the server, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers, etc. When the terminal device is software, it may be installed in the electronic devices listed above. It may be implemented as multiple software or software modules, or as a single software or software module. No specific limitation is made here.

[0047] Terminal devices 104, 105, and 106 can receive the user's access operation, and send an initialization request to the server based on the text version of the Javascript file and the current operating environment, so that the server can obtain the initial parameters corresponding to the initialization request based on the file version and the current operating environment using the preset private key and preset parameters. Then, terminal devices 104, 105, and 106 can receive the initial parameters sent by the server, initialize the initial parameters based on the preset public key, obtain the access parameters corresponding to the access operation, and then send the access request generated based on the access parameters to the server, so that the server can perform parameter verification on the access parameters based on the preset parameters, and generate an access result corresponding to the verification result. Finally, terminal devices 104, 105, and 106 can receive and present the access result sent by the server.

[0048] Servers 101, 102, and 103 may be servers that provide various services, such as a backend server that receives a request sent by a terminal device that establishes a communication connection with the backend server. The backend server may receive and analyze the request sent by the terminal device and generate a processing result.

[0049] Servers 101, 102, and 103 can receive the initialization request sent by the client, and use the preset private key and preset parameters to obtain the initial parameters corresponding to the initialization request according to the file version and the current operating environment. The initialization request includes the text version of the Javascript file and the current operating environment. Then, servers 101, 102, and 103 can send the initial parameters to the client, so that the client initializes the initial parameters based on the preset public key and obtains the access parameters corresponding to the access operation. After that, servers 101, 102, and 103 can receive the access request sent by the client, and perform parameter verification on the access parameters in the access request based on the preset parameters, and generate an access result corresponding to the verification result. Finally, servers 101, 102, and 103 send the access result to the client, so that the client presents the access result.

[0050] It should be noted that the server can be hardware or software. When the server is hardware, it can be various electronic devices that provide various services to the terminal device. When the server is software, it can be implemented as multiple software or software modules that provide various services to the terminal device, or it can be implemented as a single software or software module that provides various services to the terminal device. No specific limitation is made here.

[0051] It should be noted that the data access method provided in the embodiment of the present disclosure can be executed by the terminal devices 104, 105, 106 and the servers 101, 102, 103. Accordingly, the data access device is set in the terminal devices 104, 105, 106 and the servers 101, 102, 103.

[0052] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0053] refer to Figure 2 , shows a process 200 of an embodiment of a data access method according to the present disclosure. The data access method comprises the following steps:

[0054] Step 210, in response to receiving the user's access operation, sends an initialization request to the server based on the text version of the Javascript file and the current operating environment, so that the server obtains the initial parameters corresponding to the initialization request using the preset private key and preset parameters based on the file version and the current operating environment.

[0055] In this step, the execution entity on which the data access method runs (e.g. Figure 1The terminal devices 104, 105, and 106 in the system can display the data access setting interface to the user through the screen. The user can enter the access operation in the setting interface through the screen. The access operation can be the user's access request for a certain business data, and can include the business data and user identification information entered by the user. After receiving the user's access operation, the above-mentioned execution subject can obtain the local Javascript file used to run the access operation and determine the file version of the Javascript file, wherein the Javascript file itself is a shell function, a literal scripting language, a dynamic type, weak type, prototype-based language, with built-in support types, called JavaScript engine, which is part of the browser and widely used as a scripting language for the client. It was first used on HTML (an application under the standard universal markup language) web pages to add dynamic functions to HTML web pages. A preset public key is pre-stored in the Javascript file, and the preset private key corresponding to the preset public key is stored in the server. The preset public key and the preset private key can be a public-private key pair of the asymmetric encryption algorithm SM2.

[0056] After the above-mentioned execution entity determines the text version of the Javascript file, it can detect the running environment of the Javascript file to determine the current running environment of the Javascript file, where the running environment refers to an environment in which the semi-compiled running code runs on the target machine, which may include Node, Python, Phantom, WebDriver, WeChat applet, JD applet and other environments.

[0057] After the execution subject obtains the text version of the Javascript file and the current operating environment, it can send an initialization request to the server based on the text version of the Javascript file and the current operating environment. The initialization request can represent a request to obtain initial parameters corresponding to the text version and the current operating environment.

[0058] After the execution subject sends the initialization request to the server, the server can determine the corresponding preset parameters according to the text version of the Javascript file and the current operating environment, and then use the preset private key and preset parameters to process and obtain the initial parameters corresponding to the initialization request, which are parameters corresponding to the text version and the current operating environment. After the server obtains the initial parameters corresponding to the initialization request, it sends the initial parameters to the execution subject.

[0059] Step 220, in response to receiving the initial parameters sent by the server, the initial parameters are initialized based on the preset public key to obtain access parameters corresponding to the access operation.

[0060] In this step, the execution subject may receive the initial parameters sent by the server, and verify them according to the preset public key corresponding to the preset private key, and after determining that the initial parameters are parameters processed based on the preset private key, further initialize the initial parameters according to the text version of the Javascript file and the current operating environment, so that the initial parameters can be applied to the local environment, etc. After the execution subject initializes the initial parameters, it can obtain the access parameters corresponding to the access operation according to the initialized initial parameters, the current operating environment and the timestamp corresponding to the access operation.

[0061] As an optional implementation, the above step 220, in response to receiving the initial parameters sent by the server, initializing the initial parameters based on the preset public key, and obtaining the access parameters corresponding to the access operation, may include the following steps:

[0062] The first step is to perform format verification on the parameter format of the initial parameters in response to receiving the initial parameters sent by the server.

[0063] Specifically, after the above-mentioned execution entity receives the initial parameters sent by the server, it can determine the encoding function corresponding to the initial parameters. Since different encoding functions can correspond to multiple different encoding formats, and each encoding function corresponds to a unique encoding format, the above-mentioned execution entity can perform format verification on the parameter format of the initial parameters according to the encoding format corresponding to the encoding function to determine whether the parameter format of the initial parameters is the same as the encoding format.

[0064] In the second step, in response to determining that the parameter format of the initial parameter passes the format verification, the initial parameter is decoded to obtain the signature preset parameter.

[0065] Specifically, the execution subject can obtain the decoding function corresponding to the encoding function by determining that the parameter format of the initial parameter passes the format verification. The execution subject decodes the initial parameter using the decoding function to obtain the signature preset parameter, which is the parameter after the server uses the preset private key to sign the preset parameter.

[0066] The third step is to verify the signature of the preset parameters based on the preset public key.

[0067] Specifically, after the above-mentioned execution subject obtains the signature preset parameter, it can use the locally stored preset public key to verify the signature preset parameter to verify whether the signature preset parameter is the parameter after the server signs the preset parameter based on the preset private key.

[0068] In a fourth step, in response to determining that the signature preset parameters pass the signature verification, access parameters corresponding to the access operation are obtained based on the preset parameters.

[0069] Specifically, after the execution subject verifies and determines that the signature preset parameters pass the signature verification, the preset parameters corresponding to the text version and the current operating environment can be determined from the signature preset parameters. The execution subject can initialize the preset parameters and obtain the access parameters corresponding to the access operation based on the initialized preset parameters, the current operating environment and the timestamp corresponding to the access operation.

[0070] In this implementation, the initial parameters are first verified and then the access parameters corresponding to the access operation are obtained using the verified initial parameters, thereby ensuring the accuracy of the initial parameters and ensuring that the initial parameters are sent from the correct server, thereby ensuring the accuracy of the access parameters, thereby improving the accuracy of access requests based on the access parameters.

[0071] Step 230, sending an access request generated based on the access parameters to the server, so that the server performs parameter verification on the access parameters based on preset parameters and generates an access result corresponding to the verification result.

[0072] In this step, after the execution subject obtains the access parameters corresponding to the access operation, it can obtain the business data and user identification information input by the user according to the user's access operation. The execution subject can generate an access request based on the access parameters and the business data and user identification information input by the user, and send the access request to the server.

[0073] After receiving the access request sent by the execution subject, the server can obtain the corresponding preset parameters according to the access request, and then use the preset parameters to verify the access parameters to verify whether the access parameters are sent by the corresponding execution subject, thereby generating a verification result of the access parameters. The server can further generate a corresponding access result according to the verification result, and send the access result to the execution subject, wherein the verification result includes two results: verification success and verification failure. The server can obtain the access data corresponding to the access operation according to the verification success result, and can also generate an access result of access failure according to the verification failure result.

[0074] Step 240: Receive and present the access result sent by the server.

[0075] In this step, the execution subject may receive the access result sent by the server, and present the access result sent by the server to the user through the screen.

[0076] The data access method provided by the embodiment of the present disclosure, the execution subject first responds to receiving the user's access operation, and based on the text version of the Javascript file and the current operating environment, sends an initialization request to the server, so that the server obtains the initial parameters corresponding to the initialization request based on the file version and the current operating environment using the preset private key and the preset parameters, and then responds to receiving the initial parameters sent by the server, initializes the initial parameters based on the preset public key, obtains the access parameters corresponding to the access operation, and then sends an access request generated based on the access parameters to the server, so that the server verifies the access parameters based on the preset parameters and generates an access result corresponding to the verification result, and finally receives and presents the access result sent by the server, and uses the Javascript file to calculate the correct hash value after initialization, effectively defends against the attack method of static code analysis, and dynamically obtains the initial parameters based on the file version and the current operating environment, can make judgments for different operating environments, identify different abnormal environments, increase the difficulty of analysis for attackers, realize request replay detection for data access, and improve the security strength of data access and adaptability to different environments.

[0077] See also Figure 3 , Figure 3 A flowchart 300 of an embodiment of obtaining access parameters corresponding to an access operation based on preset parameters is shown, that is, the above step of "in response to determining that the signature preset parameters pass the signature verification, obtaining the access parameters corresponding to the access operation based on the preset parameters" may include the following steps:

[0078] Step 310, in response to determining that the signature preset parameters pass the signature verification, generate a time parameter based on the random function and the timestamp corresponding to the access operation.

[0079] In this step, the execution subject can obtain the timestamp corresponding to the access operation after determining the signature preset parameters based on the preset public key and passing the signature verification. Then the execution subject can use the random function and the timestamp corresponding to the access operation to generate a random string consisting of a preset number of integer random numbers and a timestamp, and use the random string as the time parameter.

[0080] Step 320: Generate request parameters based on key parameters corresponding to the access operation.

[0081] In this step, the execution subject may obtain the business data and user identification information input by the user according to the user's access operation, and select key parameters corresponding to the access operation from the business data and user identification information input by the user, and the key parameters may be set by the user according to the needs. The execution subject may generate request parameters corresponding to the access operation according to the key parameters corresponding to the access operation.

[0082] In the present disclosure, relevant technical means can be used to generate request parameters corresponding to the access operation according to the key parameters corresponding to the access operation.

[0083] Step 330, generating environmental parameters based on preset parameters, time parameters, request parameters and the current operating environment.

[0084] In this step, after the above-mentioned execution entity obtains the time parameters and request parameters, it can use the preset parameters, time parameters, request parameters and the current operating environment to perform parameter analysis and processing, and use the preset parameters, time parameters, request parameters and the current operating environment as input parameters of the generation function to generate environmental parameters corresponding to the access operation and the current operating environment.

[0085] As an optional implementation, the preset parameters may include an initial vector, a version number of the initial vector, a hash algorithm, and a number of calculation rounds. Also, the above step 330, based on the preset parameters, time parameters, request parameters, and the current operating environment, generates environment parameters, which may include the following steps:

[0086] The first step is to concatenate the initial vector, time parameters, request parameters and the current running environment to generate a concatenated string.

[0087] Specifically, after the execution subject obtains the time parameter and the request parameter, it can concatenate the initial vector, the request parameter, the time parameter and the current operating environment in the preset parameters to generate a corresponding concatenated string.

[0088] The second step is to perform hash calculation on the concatenated string based on the hash algorithm and the number of calculation rounds to obtain the hash result.

[0089] Specifically, the above-mentioned execution entity performs hash calculations on the concatenated string for a number of rounds according to the hash algorithm and the number of calculation rounds in the preset parameters. That is, if the number of calculation rounds is n, the above-mentioned execution entity can perform n rounds of hash calculations on the concatenated string based on the hash algorithm to obtain a corresponding hash result.

[0090] The third step is to generate environment parameters based on the hash result and the version number of the initial vector.

[0091] Specifically, after the above-mentioned execution entity obtains the hash result, it can concatenate the hash result and the version number of the initial vector in the preset parameter to generate a string in a preset base, and use the string as the environment parameter corresponding to the access operation, where the preset base can include hexadecimal, etc., and the present disclosure does not make specific limitations on this.

[0092] In this implementation, a concatenated string is generated by concatenating the initial vector, time parameters, request parameters and the current operating environment. Based on the hash algorithm and the number of calculation rounds, the concatenated string is hashed to obtain a hash result. Finally, based on the hash result and the version number of the initial vector, the environmental parameters are generated. This can make the environmental parameters related to the preset parameters, time parameters, request parameters and the current operating environment, thereby improving the accuracy of the environmental parameters.

[0093] Step 340: Use the time parameter, request parameter, and environment parameter as access parameters corresponding to the access operation.

[0094] In this step, after the above-mentioned execution entity obtains the time parameters, request parameters and environment parameters corresponding to the access operation, it can also determine the business data and user identification and other information input by the user based on the access operation, and use the time parameters, request parameters and environment parameters, as well as the business data and user identification and other information input by the user as the access parameters corresponding to the access operation.

[0095] In this implementation, access parameters corresponding to the access operation are obtained through time parameter request parameters and environment parameters, which can ensure the comprehensiveness and accuracy of the access parameters, thereby ensuring the accuracy of the access request based on the access parameters and preventing request replay.

[0096] refer to Figure 4 , Figure 4 A flowchart 400 is shown of another embodiment of obtaining access parameters corresponding to an access operation based on preset parameters, that is, the above step of "in response to determining that the signature preset parameters pass the signature verification, obtaining access parameters corresponding to the access operation based on the preset parameters" may also include the following steps:

[0097] Step 410 , in response to determining that the signature preset parameters pass the signature verification, the executable code segment is initialized.

[0098] Among them, the above-mentioned preset parameters also include an executable code segment corresponding to the file version and the current operating environment. The executable code segment can represent a dynamic patch file related to the current operating environment and functional requirements, and is used to modify the files in the current operating environment, as well as to supplement and modify the functions.

[0099] In this step, after the execution subject verifies and determines that the signature preset parameters pass the signature verification, it can initialize the executable code segment in the preset parameters and perform file modification or file supplement operations on the executable code segment.

[0100] Step 420 , in response to completing the initialization of the executable code segment, generating a time parameter based on the random function and the timestamp corresponding to the access operation.

[0101] In this step, after the execution subject determines that the initialization of the executable code segment is completed, it can use the random function and the timestamp corresponding to the access operation to generate a random string consisting of a preset number of integer random numbers and a timestamp, and use the random string as a time parameter.

[0102] Step 430: Generate request parameters based on key parameters corresponding to the access operation.

[0103] Step 430 of this embodiment can be performed according to Figure 3 Step 320 in the illustrated embodiment is performed in a similar manner and will not be described in detail here.

[0104] Step 440, generating environmental parameters based on preset parameters, time parameters, request parameters and the current operating environment.

[0105] Step 440 of this embodiment can be performed according to Figure 3 Step 330 in the illustrated embodiment is performed in a similar manner and will not be described in detail here.

[0106] Step 450: Use the time parameter, request parameter and environment parameter as access parameters corresponding to the access operation.

[0107] Step 450 of this embodiment can be performed in the same manner as Figure 3 Step 340 in the illustrated embodiment is performed in a similar manner and will not be described in detail here.

[0108] In this implementation, when the Javascript file itself is modified through the executable code segment, a defense response can be made to the latest attack method in a timely manner without updating the Javascript file.

[0109] refer to Figure 5 , Figure 5 A process 500 of another embodiment of a data access method according to the present disclosure is shown. The data access method comprises the following steps:

[0110] Step 510, in response to receiving the initialization request sent by the client, the initial parameters corresponding to the initialization request are obtained using a preset private key and preset parameters according to the file version and the current operating environment.

[0111] In this step, the execution entity on which the data access method runs (e.g. Figure 1 The servers 101, 102, 103) in the embodiment can receive an initialization request sent by a client, where the initialization request includes a text version of the Javascript file and a current operating environment.

[0112] The above-mentioned execution entity can determine the corresponding preset parameters according to the file version and the current operating environment, and then use the preset private key and preset parameters to process and obtain the initial parameters corresponding to the initialization request, which are the parameters corresponding to the text version and the current operating environment.

[0113] As an optional implementation, in step 510, in response to receiving the initialization request sent by the client, obtaining the initial parameters corresponding to the initialization request using the preset private key and preset parameters according to the file version and the current operating environment, may include the following steps:

[0114] The first step is to determine preset parameters corresponding to the initialization request according to the file version and the current operating environment in response to receiving the initialization request sent by the client.

[0115] Specifically, after the above-mentioned execution entity receives the initialization request sent by the client, it can determine the preset parameters corresponding to the initialization request according to the file version and the current operating environment. The preset parameters may include the initial vector iv, the version number version of the initial vector, the hash algorithm and the number of calculation rounds n, and the executable code segment.

[0116] The second step is to use the preset private key to sign the preset parameters to obtain the signed preset parameters.

[0117] Specifically, after the execution subject obtains the preset parameters, it can obtain the preset private key stored locally, and then the execution subject signs the preset parameters using the preset private key to obtain the signed preset parameters.

[0118] The third step is to encode the signature preset parameters and obtain the initial parameters corresponding to the initialization request.

[0119] Specifically, after the execution subject obtains the preset signature parameters, it uses an encoding function to encode the preset signature parameters to obtain the initial parameters corresponding to the initialization request.

[0120] In this implementation, the initial parameters are obtained by presetting a private key and an encoding function, thereby ensuring the accuracy of the initial parameters, so that the client can verify the received initial parameters to ensure the accuracy of the received initial parameters.

[0121] Step 520: Send initial parameters to the client, so that the client initializes the initial parameters based on the preset public key and obtains access parameters corresponding to the access operation.

[0122] In this step, after the execution subject obtains the initial parameters corresponding to the initialization request, it sends the initial parameters to the client. Therefore, after the client receives the initial parameters sent by the server, it verifies according to the preset public key corresponding to the preset private key, and after determining that the initial parameters are parameters processed based on the preset private key, it further initializes the initial parameters according to the text version of the Javascript file and the current operating environment, so that the initial parameters can be applied to the local environment, etc. After the execution subject initializes the initial parameters, it can obtain the access parameters corresponding to the access operation according to the initialized initial parameters, the current operating environment and the timestamp corresponding to the access operation. After the client obtains the access parameters corresponding to the access operation, it can obtain the business data and user identification and other information input by the user according to the user's access operation. And the client can generate an access request based on the access parameters and the business data and user identification and other information input by the user, and send the access request to the execution subject.

[0123] Step 530 , in response to receiving the access request sent by the client, perform parameter verification on the access parameters in the access request based on preset parameters, and generate an access result corresponding to the verification result.

[0124] In this step, after the above-mentioned execution entity receives the access request sent by the client, it can obtain the corresponding preset parameters according to the access request, and then use the preset parameters to verify the access parameters in the access request to verify whether the access parameters are sent by the corresponding client, thereby generating a verification result of the access parameters.

[0125] The above-mentioned execution subject can further generate corresponding access results based on the verification results. The verification results include two results: verification success and verification failure. The above-mentioned execution subject can obtain the access data corresponding to the access operation based on the result of successful verification, and can also generate an access result of failed access based on the result of failed verification.

[0126] Step 520: Send the access result to the client so that the client presents the access result.

[0127] In this step, the execution subject may send the generated access result to the client, so that the client may receive the access result sent by the execution subject and present the access result sent by the server to the user through the screen.

[0128] The data access method provided by the embodiment of the present disclosure, the above-mentioned execution subject first responds to the initialization request sent by the client, and obtains the initial parameters corresponding to the initialization request by using the preset private key and preset parameters according to the file version and the current operating environment, wherein the initialization request includes the text version of the Javascript file and the current operating environment, and then sends the initial parameters to the client, so that the client initializes the initial parameters based on the preset public key and obtains the access parameters corresponding to the access operation, and then responds to the access request sent by the client, based on the preset parameters, performs parameter verification on the access parameters in the access request, and generates an access result corresponding to the verification result, and finally sends the access result to the client, so that the client presents the access result, and the client calculates the correct hash value by using the Javascript file after initialization, effectively defends against the attack method of static code analysis, and can use the file version and the current operating environment to dynamically obtain the initial parameters, can make judgments for different operating environments, identify different abnormal environments, increase the difficulty of analysis for attackers, realize request replay detection for data access, and improve the security strength of data access and adaptability to different environments.

[0129] refer to Figure 6 , Figure 6 A flowchart 600 showing an embodiment of performing parameter verification on access parameters in an access request, i.e., the above step 530, in response to receiving an access request sent by a client, performing parameter verification on the access parameters in the access request based on preset parameters, and generating an access result corresponding to the verification result, may include the following steps:

[0130] Step 610: In response to receiving an access request sent by the client, format verification is performed on access parameters in the access request.

[0131] In this step, after receiving the access request sent by the client, the execution subject performs format verification on the access parameters in the access request according to the format requirements, and may perform format verification on the time parameters and environment parameters.

[0132] If the verification is successful, step 620 is executed; if the verification fails, it is determined that a tampering attack has occurred, and a verification result indicating verification failure is directly generated.

[0133] Step 620, in response to determining that the access parameter passes the format verification, content verification is performed on the access parameter based on preset parameters to obtain a verification result.

[0134] In this step, the execution subject verifies that the access parameter passes the format verification, and can perform content verification on the access parameter according to the preset parameters corresponding to the access request to determine whether the content of the access parameter corresponds to the preset parameters, thereby obtaining a verification result.

[0135] Step 630: Generate an access result corresponding to the verification result.

[0136] In this step, the above-mentioned execution entity can further generate corresponding access results based on the verification results. The verification results include two results: verification success and verification failure. The above-mentioned execution entity can obtain the access data corresponding to the access operation based on the result of successful verification, and can also generate an access result of failed access based on the result of failed verification.

[0137] In this embodiment, by performing format verification and content verification on the access parameters in the access request and generating an access result corresponding to the verification result, the accuracy and comprehensiveness of the access parameter verification are ensured, thereby improving the accuracy of the access parameters.

[0138] refer to Figure 7 , Figure 7 A flowchart 700 showing an embodiment of performing content verification on access parameters, i.e., the above step 620, in response to determining that the access parameters pass the format verification, performing content verification on the access parameters based on preset parameters to obtain a verification result, may include the following steps:

[0139] Step 710: In response to determining that the access parameter passes the format verification, a time verification is performed on the time parameter based on the current time and a first time threshold in the preset parameter.

[0140] The access parameters include time parameters, request parameters, environment parameters and identification parameters, and the identification parameters may include a string of the domain name domain of the access request source, the user identifier uid and the time parameter. The preset parameters may include the initial vector iv, the version number version of the initial vector, the hash algorithm and the number of calculation rounds n, the executable code segment, the first time threshold T1 and the second time threshold T2, wherein the first time threshold T1 may represent the preset time interval of the access operation pair, and the first time threshold T2 may represent the preset time interval of the identification parameter storage.

[0141] In this step, the execution subject verifies that the access parameter passes the format verification, and can extract the timestamp corresponding to the access operation from the time parameter. Then the execution subject obtains the current time, compares the current time with the timestamp corresponding to the access operation, and determines the time difference between the current time and the timestamp corresponding to the access operation. The execution subject compares the time difference with the first time threshold in the preset parameters to determine whether the time difference is less than the first time threshold in the preset parameters. If the time difference is less than the first time threshold in the preset parameters, it is determined that the time parameter passes the time verification; if the time difference is not less than the first time threshold in the preset parameters, it is determined that the time parameter does not pass the time verification, and it is determined that a replay attack has been received.

[0142] Step 720: In response to determining that the time parameter passes the time verification, determine whether the version number of the initial vector in the preset parameter is the same as the version number of the initial vector in the environment parameter.

[0143] In this step, after the execution subject verifies and determines that the time parameter passes the time verification, the version number of the initial vector can be extracted from the environment parameter. Then the execution subject compares the version number of the initial vector in the preset parameter with the version number of the initial vector in the environment parameter to determine whether the version number of the initial vector in the preset parameter is the same as the version number of the initial vector in the environment parameter.

[0144] If it is determined that the version number of the initial vector in the preset parameters is the same as the version number of the initial vector in the environment parameters, then continue to execute step 730; if the version number of the initial vector in the preset parameters is different from the version number of the initial vector in the environment parameters, it is determined that a tampering attack has occurred.

[0145] Step 730 , in response to determining that the version number of the initial vector in the preset parameters is the same as the version number of the initial vector in the environment parameters, perform environment verification on the environment parameters based on the preset parameters and the operating environment set.

[0146] In this step, the execution subject determines that the version number of the initial vector in the preset parameters is the same as the version number of the initial vector in the environment parameters, and can obtain the initial vector, hash algorithm and number of calculation rounds in the preset parameters, and obtain a set of operating environments including multiple different operating environments. The execution subject can use the operating environment set, the initial vector in the preset parameters, the hash algorithm and the number of calculation rounds to perform calculations to determine whether there is an operating environment in the operating environment set that makes the calculation result the same as the environment parameters.

[0147] If there is an operating environment that makes the calculation result the same as the environmental parameters, it is further determined whether the operating environment is a normal environment. If it is a normal environment, step 740 is executed. If it is an abnormal environment, it is determined that it has been attacked by an abnormal call; if there is no operating environment that makes the calculation result the same as the environmental parameters, it is determined that it has been attacked by tampering.

[0148] Step 740 , in response to determining that the environmental parameter passes the environmental verification, based on the identification information set and the second time threshold in the preset parameter, perform a request time verification on the identification parameter.

[0149] In this step, after the execution subject verifies that the environmental parameters have passed the environmental verification, each identification information in the identification information set can be compared with the identification parameters to determine whether there is identification information in the identification information set that is identical to the identification parameters.

[0150] If there is identification information that is the same as the identification parameter, the storage time corresponding to the identification information is further obtained, the time difference between the storage time and the current time is obtained, the time difference is compared with the second time threshold, and it is determined whether the time difference is greater than the second time threshold. If it is determined that the time difference is greater than the second time threshold, step 750 is executed; if it is determined that the time difference is not greater than the second time threshold, it is determined that a replay attack is received; if there is no identification information that is the same as the identification parameter, step 750 is executed.

[0151] Step 750 , in response to determining that the identification parameter passes the request time verification, obtaining access data corresponding to the access operation.

[0152] In this step, after the execution subject determines through comparison that the identification parameter passes the request time verification, it determines that the received access request is a normal access and can obtain the access data corresponding to the access operation.

[0153] In this embodiment, by verifying the access parameters level by level, the comprehensiveness and accuracy of the access parameter verification are guaranteed, thereby ensuring the accuracy and security of data access.

[0154] As an optional implementation, continue to refer to Figure 7 The above step 620, in response to determining that the access parameter passes the format verification, performs content verification on the access parameter based on preset parameters to obtain a verification result, and may also include the following steps: Step 760, in response to determining that the identification parameter does not pass the request time verification, generates an access result of access failure.

[0155] In this step, after the execution subject determines through comparison that the identification parameter does not pass the request time verification, it determines that the received access request is an abnormal access and can generate an access result of access failure.

[0156] In this embodiment, by verifying the access parameters level by level, the comprehensiveness and accuracy of the access parameter verification are guaranteed, thereby ensuring the accuracy and security of data access.

[0157] As an optional implementation, continue to refer to Figure 7 , the above data access method may further include the following steps:

[0158] Step 770: associate the identification parameter with the current time and store it in the identification information set.

[0159] In this step, after obtaining the access data corresponding to the access operation, the execution subject may store the identification parameter and the current time in association with each other in the identification information set. Alternatively, after generating an access result of access failure, the execution subject may store the identification parameter and the current time in association with each other in the identification information set. Alternatively, after determining that the access parameter does not pass the format verification, the time parameter does not pass the time verification, the version number of the initial vector in the preset parameter is different from the version number of the initial vector in the environment parameter, and the environment parameter does not pass the environment verification, the execution subject may store the identification parameter and the current time in association with each other in the identification information set.

[0160] In this embodiment, by associating the identification parameter with the current time and storing it in the identification information set, the received information can be stored for subsequent verification, thereby improving the security of data access.

[0161] Further references Figure 8 As an implementation of the methods shown in the above figures, the present disclosure provides an embodiment of a data access device. Figure 2 The method embodiments shown correspond.

[0162] like Figure 8 As shown, the data access device 800 of this embodiment may include: a sending module 810 , an initialization module 820 and a receiving module 830 .

[0163] The sending module 810 is configured to send an initialization request to the server in response to receiving the user's access operation based on the text version of the Javascript file and the current operating environment, so that the server obtains the initial parameters corresponding to the initialization request using the preset private key and preset parameters based on the file version and the current operating environment;

[0164] The initialization module 820 is configured to initialize the initial parameters based on a preset public key in response to receiving the initial parameters sent by the server, and obtain access parameters corresponding to the access operation;

[0165] The sending module 810 is configured to send an access request generated based on the access parameters to the server, so that the server performs parameter verification on the access parameters based on preset parameters and generates an access result corresponding to the verification result;

[0166] The receiving module 830 is configured to receive and present the access result sent by the server.

[0167] In some optional implementations of the present embodiment, the initialization module 820 is further configured to: in response to receiving the initial parameters sent by the server, perform format verification on the parameter format of the initial parameters; in response to determining that the parameter format of the initial parameters passes the format verification, decode the initial parameters to obtain signature preset parameters; perform signature verification on the signature preset parameters based on a preset public key; in response to determining that the signature preset parameters pass the signature verification, obtain access parameters corresponding to the access operation based on the preset parameters.

[0168] In some optional implementations of the present embodiment, the initialization module 820 is further configured to: in response to determining that the signature preset parameters pass the signature verification, generate a time parameter based on a random function and a timestamp corresponding to the access operation; generate a request parameter based on the key parameters corresponding to the access operation; generate an environment parameter based on the preset parameters, time parameters, request parameters and the current operating environment; and use the time parameter, request parameter and environment parameter as access parameters corresponding to the access operation.

[0169] In some optional implementations of the present embodiment, the preset parameters include an initial vector, a version number of the initial vector, a hash algorithm and a number of calculation rounds; and the initialization module 820 is further configured to: concatenate the initial vector, time parameters, request parameters and the current operating environment to generate a concatenated string; perform hash calculation on the concatenated string based on the hash algorithm and the number of calculation rounds to obtain a hash result; and generate environmental parameters based on the hash result and the version number of the initial vector.

[0170] In some optional implementations of the present embodiment, the preset parameters also include an executable code segment corresponding to the file version and the current operating environment; and the initialization module 820 is further configured to: in response to determining that the signature preset parameters pass the signature verification, initialize the executable code segment; in response to completing the initialization of the executable code segment, generate a time parameter based on the random function and the timestamp corresponding to the access operation.

[0171] The data access device provided by the above-mentioned embodiment of the present disclosure, the above-mentioned execution subject first responds to receiving the user's access operation, and based on the text version of the Javascript file and the current operating environment, sends an initialization request to the server, so that the server obtains the initial parameters corresponding to the initialization request based on the file version and the current operating environment using the preset private key and the preset parameters, and then responds to receiving the initial parameters sent by the server, initializes the initial parameters based on the preset public key, obtains the access parameters corresponding to the access operation, and then sends an access request generated based on the access parameters to the server, so that the server verifies the access parameters based on the preset parameters and generates an access result corresponding to the verification result, and finally receives and presents the access result sent by the server, uses the Javascript file to calculate the correct hash value after initialization, effectively defends against the attack method of static code analysis, and dynamically obtains the initial parameters based on the file version and the current operating environment, can make judgments for different operating environments, identify different abnormal environments, increase the difficulty of analysis for attackers, realize request replay detection for data access, and improve the security strength of data access and adaptability to different environments.

[0172] Those skilled in the art will appreciate that the above device also includes some other well-known structures, such as a processor, a memory, etc. In order to unnecessarily obscure the embodiments of the present disclosure, these well-known structures are described in detail. Figure 8 Not shown.

[0173] Further references Fig. 9 As an implementation of the methods shown in the above figures, the present disclosure provides an embodiment of a data access device. Figure 5 The method embodiments shown correspond.

[0174] like Fig. 9 As shown, the data access device 900 of this embodiment may include: an acquisition module 910 , a sending module 920 and a verification module 930 .

[0175] The acquisition module 910 is configured to, in response to receiving an initialization request sent by the client, obtain initial parameters corresponding to the initialization request using a preset private key and preset parameters according to the file version and the current operating environment, wherein the initialization request includes a text version of the Javascript file and the current operating environment;

[0176] The sending module 920 is configured to send initial parameters to the client, so that the client initializes the initial parameters based on a preset public key and obtains access parameters corresponding to the access operation;

[0177] The verification module 930 is configured to, in response to receiving an access request sent by the client, perform parameter verification on the access parameters in the access request based on preset parameters, and generate an access result corresponding to the verification result;

[0178] The sending module 920 is configured to send the access result to the client so that the client presents the access result.

[0179] In some optional implementations of the present embodiment, the acquisition module 910 is further configured to: in response to receiving an initialization request sent by the client, determine the preset parameters corresponding to the initialization request according to the file version and the current operating environment; sign the preset parameters using a preset private key to obtain signed preset parameters; encode the signed preset parameters to obtain the initial parameters corresponding to the initialization request.

[0180] In some optional implementations of the present embodiment, the verification module 930 is further configured to: in response to receiving an access request sent by the client, perform format verification on the access parameters in the access request; in response to determining that the access parameters pass the format verification, perform content verification on the access parameters based on preset parameters to obtain a verification result; and generate an access result corresponding to the verification result.

[0181] In some optional implementations of the present embodiment, the access parameters include time parameters, request parameters, environment parameters and identification parameters; and the verification module 930 is further configured to: in response to determining that the access parameters pass the format verification, based on the current time and the first time threshold in the preset parameters, perform time verification on the time parameters; in response to determining that the time parameters pass the time verification, determine whether the version number of the initial vector in the preset parameters and the version number of the initial vector in the environment parameters are the same; in response to determining that the version number of the initial vector in the preset parameters and the version number of the initial vector in the environment parameters are the same, perform environment verification on the environment parameters based on the preset parameters and the operating environment set; in response to determining that the environment parameters pass the environment verification, perform request time verification on the identification parameters based on the identification information set and the second time threshold in the preset parameters; in response to determining that the identification parameters pass the request time verification, obtain access data corresponding to the access operation.

[0182] In some optional implementations of the present embodiment, the verification module 930 is further configured to: in response to determining that the identification parameter does not pass the request time verification, generate an access result of access failure.

[0183] In some optional implementations of the present embodiment, the device further includes: a storage module configured to store the identification parameter and the current time in association with each other in the identification information set.

[0184] The data access device provided by the above-mentioned embodiment of the present disclosure, the above-mentioned execution body first responds to receiving the initialization request sent by the client, and obtains the initial parameters corresponding to the initialization request by using the preset private key and preset parameters according to the file version and the current operating environment, wherein the initialization request includes the text version of the Javascript file and the current operating environment, and then sends the initial parameters to the client, so that the client initializes the initial parameters based on the preset public key and obtains the access parameters corresponding to the access operation, and then responds to receiving the access request sent by the client, based on the preset parameters, the access parameters in the access request are verified, and an access result corresponding to the verification result is generated, and finally the access result is sent to the client, so that the client presents the access result, and the client calculates the correct hash value by using the Javascript file after initialization, effectively defends against the attack method of static code analysis, and can dynamically obtain the initial parameters by using the file version and the current operating environment, can make judgments for different operating environments, identify different abnormal environments, increase the difficulty of analysis for attackers, realize request replay detection for data access, and improve the security strength of data access and adaptability to different environments.

[0185] Those skilled in the art will appreciate that the above device also includes some other well-known structures, such as a processor, a memory, etc. In order to unnecessarily obscure the embodiments of the present disclosure, these well-known structures are described in detail. Fig. 9 Not shown.

[0186] Reference below Fig.10 , which shows a schematic diagram of the structure of an electronic device 1000 suitable for implementing an embodiment of the present disclosure. The terminal device in the embodiment of the present disclosure may include but is not limited to mobile terminals such as smart screens, notebook computers, PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Fig.10 The terminal device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0187] like Fig.10As shown, the electronic device 1000 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 1001, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage device 1008 into a random access memory (RAM) 1003. In the RAM 1003, various programs and data required for the operation of the electronic device 1000 are also stored. The processing device 1001, the ROM 1002, and the RAM 1003 are connected to each other via a bus 1004. An input / output (I / O) interface 1005 is also connected to the bus 1004.

[0188] Typically, the following devices may be connected to the I / O interface 1005: an input device 1006 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 1007 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 1008 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 may allow the electronic device 1000 to communicate with other devices wirelessly or by wire to exchange data. Although Fig.10 The electronic device 1000 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead. Fig.10 Each block shown in the figure may represent one device, or may represent multiple devices as required.

[0189] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 1009, or installed from the storage device 1008, or installed from the ROM 1002. When the computer program is executed by the processing device 1001, the above functions defined in the method of the embodiment of the present disclosure are executed. It should be noted that the computer-readable medium of the embodiment of the present disclosure can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, but not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection with one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In an embodiment of the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, an apparatus, or a device. In an embodiment of the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in combination with an instruction execution system, an apparatus, or a device. The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to: wire, optical cable, RF (radio frequency), etc., or any suitable combination of the foregoing.

[0190] Computer program code for performing the operations of the embodiments of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" language or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet).

[0191] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0192] The units involved in the embodiments described in the present application may be implemented by software or hardware. The units described may also be set in a processor, for example, it may be described as: a processor includes a sending module, an initialization module and a receiving module; or a processor includes an acquisition module, a sending module and a verification module, wherein the names of these modules do not constitute a limitation on the modules themselves in some cases.

[0193] As another aspect, the present application also provides a computer-readable medium, which may be included in the electronic device; or may exist independently without being assembled into the electronic device. The computer-readable medium carries one or more programs, and when the one or more programs are executed by the electronic device, the electronic device: in response to receiving the user's access operation, based on the text version of the Javascript file and the current operating environment, sends an initialization request to the server, so that the server obtains the initial parameters corresponding to the initialization request based on the file version and the current operating environment using a preset private key and preset parameters; in response to receiving the initial parameters sent by the server, initializes the initial parameters based on the preset public key and obtains the access parameters corresponding to the access operation; sends an access request generated based on the access parameters to the server, so that the server verifies the access parameters based on the preset parameters and generates an access result corresponding to the verification result; receives and presents the access result sent by the server. Alternatively, the electronic device: in response to receiving an initialization request sent by a client, obtains initial parameters corresponding to the initialization request by using a preset private key and preset parameters according to the file version and the current operating environment, wherein the initialization request includes a text version of the Javascript file and the current operating environment; sends the initial parameters to the client so that the client initializes the initial parameters based on the preset public key and obtains access parameters corresponding to the access operation; in response to receiving an access request sent by the client, performs parameter verification on the access parameters in the access request based on the preset parameters, and generates an access result corresponding to the verification result; and sends the access result to the client so that the client presents the access result.

[0194] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present disclosure is not limited to the technical solutions formed by a specific combination of the above-mentioned technical features, but should also cover other technical solutions formed by any combination of the above-mentioned technical features or their equivalent features without departing from the above-mentioned inventive concept. For example, the above-mentioned features are replaced with the technical features with similar functions disclosed in the embodiments of the present disclosure (but not limited to) to form a technical solution.

Claims

1. A data access method, the method comprising: In response to receiving the user's access operation, based on the file version of the Javascript file and the current operating environment, an initialization request is sent to the server, so that the server determines corresponding preset parameters based on the file version and the current operating environment, and obtains initial parameters corresponding to the initialization request using a preset private key and the preset parameters, wherein the preset parameters include an initial vector, a version number of the initial vector, a hash algorithm, and a number of calculation rounds; In response to receiving the initial parameters sent by the server, initializing the initial parameters based on a preset public key, and obtaining access parameters corresponding to the access operation; Sending an access request generated based on the access parameter to the server, so that the server performs parameter verification on the access parameter based on the preset parameter and generates an access result corresponding to the verification result; Receive and present the access result sent by the server.

2. The method according to claim 1, wherein: The step of initializing the initial parameters based on a preset public key in response to receiving the initial parameters sent by the server, and obtaining access parameters corresponding to the access operation includes: In response to receiving the initial parameters sent by the server, performing format verification on the parameter format of the initial parameters; In response to determining that the parameter format of the initial parameter passes the format verification, decoding the initial parameter to obtain a signature preset parameter; Performing signature verification on the signature preset parameters based on a preset public key; In response to determining that the signature preset parameters pass the signature verification, access parameters corresponding to the access operation are obtained based on the preset parameters.

3. The method according to claim 2, wherein: In response to determining that the signature preset parameters pass the signature verification, obtaining the access parameters corresponding to the access operation based on the preset parameters includes: In response to determining that the signature preset parameter passes the signature verification, generating a time parameter based on a random function and a timestamp corresponding to the access operation; Generate request parameters based on key parameters corresponding to the access operation; Generate environment parameters based on the preset parameters, the time parameters, the request parameters and the current operating environment; The time parameter, the request parameter and the environment parameter are used as access parameters corresponding to the access operation.

4. The method according to claim 3, wherein: The generating of the environment parameter based on the preset parameter, the time parameter, the request parameter and the current operating environment includes: Concatenate the initial vector, the time parameter, the request parameter and the current operating environment to generate a concatenated string; Based on the hash algorithm and the number of calculation rounds, performing hash calculation on the concatenated string to obtain a hash result; The environment parameter is generated based on the hash result and the version number of the initial vector.

5. The method according to claim 4, wherein: The preset parameters also include an executable code segment corresponding to the file version and the current operating environment; as well as, In response to determining that the signature preset parameter passes the signature verification, generating a time parameter based on a random function and a timestamp corresponding to the access operation, includes: In response to determining that the signature preset parameters pass the signature verification, initializing the executable code segment; In response to completing the initialization of the executable code segment, a time parameter is generated based on a random function and a timestamp corresponding to the access operation.

6. A data access method, the method comprising: In response to receiving an initialization request sent by a client, determining corresponding preset parameters according to a file version of the Javascript file and a current operating environment, and obtaining initial parameters corresponding to the initialization request using a preset private key and the preset parameters, wherein the initialization request includes the file version of the Javascript file and the current operating environment, and the preset parameters include an initial vector, a version number of the initial vector, a hash algorithm, and a number of calculation rounds; Sending the initial parameters to the client, so that the client initializes the initial parameters based on a preset public key and obtains access parameters corresponding to the access operation; In response to receiving the access request sent by the client, based on the preset parameters, performing parameter verification on the access parameters in the access request, and generating an access result corresponding to the verification result; The access result is sent to the client, so that the client presents the access result.

7. The method according to claim 6, wherein: The step of, in response to receiving an initialization request sent by a client, obtaining initial parameters corresponding to the initialization request by using a preset private key and preset parameters according to a file version and a current operating environment, includes: In response to receiving an initialization request sent by a client, determining preset parameters corresponding to the initialization request according to the file version and the current operating environment; Signing the preset parameters using a preset private key to obtain signed preset parameters; The signature preset parameters are encoded to obtain initial parameters corresponding to the initialization request.

8. The method according to claim 6, wherein: The step of performing parameter verification on the access parameter in the access request based on the preset parameters in response to receiving the access request sent by the client, and generating an access result corresponding to the verification result, includes: In response to receiving the access request sent by the client, performing format verification on the access parameters in the access request; In response to determining that the access parameter passes the format verification, performing content verification on the access parameter based on the preset parameter to obtain a verification result; Generate an access result corresponding to the verification result.

9. The method according to claim 8, wherein: The access parameters include time parameters, request parameters, environment parameters and identification parameters; and, In response to determining that the access parameter passes the format verification, performing content verification on the access parameter based on the preset parameter to obtain a verification result includes: In response to determining that the access parameter passes the format verification, performing time verification on the time parameter based on the current time and a first time threshold in the preset parameter; In response to determining that the time parameter passes the time verification, determining whether a version number of the initial vector in the preset parameter and a version number of the initial vector in the environment parameter are the same; In response to determining that the version number of the initial vector in the preset parameter is the same as the version number of the initial vector in the environment parameter, performing environment verification on the environment parameter based on the preset parameter and the operating environment set; In response to determining that the environmental parameter passes the environmental verification, based on the identification information set and a second time threshold in the preset parameter, performing a request time verification on the identification parameter; In response to determining that the identification parameter passes the request time verification, access data corresponding to the access operation is obtained.

10. The method according to claim 9, wherein: In response to determining that the access parameter passes the format verification, performing content verification on the access parameter based on the preset parameter to obtain a verification result, the method further includes: In response to determining that the identification parameter does not pass the request time verification, an access result of access failure is generated.

11. The method according to claim 9 or 10, further comprising: The identification parameter and the current time are associated and stored in the identification information set.

12. A data access device, comprising: a sending module configured to, in response to receiving an access operation from a user, send an initialization request to a server based on a file version of a Javascript file and a current operating environment, so that the server determines corresponding preset parameters based on the file version and the current operating environment, and obtains initial parameters corresponding to the initialization request using a preset private key and the preset parameters, wherein the preset parameters include an initial vector, a version number of the initial vector, a hash algorithm, and a number of calculation rounds; an initialization module, configured to, in response to receiving the initial parameters sent by the server, initialize the initial parameters based on a preset public key and obtain access parameters corresponding to the access operation; The sending module is configured to send an access request generated based on the access parameter to the server, so that the server performs parameter verification on the access parameter based on the preset parameter and generates an access result corresponding to the verification result; The receiving module is configured to receive and present the access result sent by the server.

13. A data access device, comprising: an acquisition module, configured to, in response to receiving an initialization request sent by a client, determine corresponding preset parameters according to a file version of a Javascript file and a current operating environment, and acquire initial parameters corresponding to the initialization request using a preset private key and preset parameters, wherein the initialization request includes the file version of the Javascript file and the current operating environment, and the preset parameters include an initial vector, a version number of the initial vector, a hash algorithm, and a number of calculation rounds; A sending module, configured to send the initial parameters to the client, so that the client initializes the initial parameters based on a preset public key and obtains access parameters corresponding to the access operation; a verification module configured to, in response to receiving an access request sent by the client, perform parameter verification on the access parameters in the access request based on the preset parameters, and generate an access result corresponding to the verification result; The sending module is configured to send the access result to the client, so that the client presents the access result.

14. An electronic device comprising: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors are enabled to implement the method according to any one of claims 1 to 11.

15. A computer readable medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 11 is implemented.

Images