A service calling method, device and medium for improving data security

Abstract

The embodiment of the specification discloses a service calling method and device for improving data security and a medium, relates to the technical field of business intelligence, and comprises the following steps: acquiring a plurality of service running parameters corresponding to a to-be-called service and a to-be-called service identifier; determining a specified encryption mode of the service running parameters according to the number of the service running parameters acquired in advance, pre-encrypting the service running parameters through the specified encryption mode to generate encrypted service running parameters; generating a service calling request according to the to-be-called service identifier and the encrypted service running parameters; intercepting and processing the service calling request through an interception task to acquire the to-be-called service identifier and the encrypted service running parameters; performing permission verification on the service calling request; after the verification, decrypting the encrypted service running parameters through a specified decryption mode to generate the service running parameters of the to-be-called service, so that the service end can call the to-be-called service through the service running parameters.

Description

TECHNICAL FIELD

[0001] The present specification relates to the technical field of business intelligence, and particularly relates to a service calling method for improving data security, equipment and medium. BACKGROUND

[0002] As a visualization tool, the Business Intelligence (BI) product finally shows the user a visual board and a graphical display. Because there are differences and particularities between projects, the product cannot meet all the requirements for chart definition on the project. To meet the needs of the project, the product provides a data service interface to call services through the data service interface to achieve the user's project requirements.

[0003] When the service is called through the data service interface, the situation that hackers use SQL injection vulnerabilities to threaten data security may occur, such as obtaining sensitive data from the database, modifying database data (inserting / updating / deleting), performing database management operations (such as closing the database management system), and recovering the contents of specified files existing in the database file system, and other behaviors that harm data security. Generally, the sensitive information of the interface is directly encrypted, but when the number of encryption is large, the system performance loss will be abnormal. From the above discussion, it can be seen that the service calling method in the prior art cannot guarantee the security of the entire data acquisition process, resulting in low data security and failing to meet the user's needs. SUMMARY

[0004] One or more embodiments of the present specification provide a service calling method for improving data security, equipment and medium, to solve the technical problem that the service calling method in the prior art cannot guarantee the security of the entire data acquisition process, resulting in low data security and failing to meet the user's needs.

[0005] One or more embodiments of the present specification adopt the following technical solutions:

[0006] The one or more embodiments of the specification provide a service calling method for improving data security, the method comprising: obtaining a plurality of service running parameters corresponding to a to-be-called service and a to-be-called service identifier pre-set in a client; determining a specified encryption mode of the service running parameters according to the number of the pre-obtained service running parameters, so as to pre-encrypt the service running parameters by the specified encryption mode and generate encrypted service running parameters; generating a service calling request according to the to-be-called service identifier and the encrypted service running parameters by the client, and sending the service calling request to a server; intercepting and processing the service calling request by an interception task pre-set in the server, so as to obtain the to-be-called service identifier and the encrypted service running parameters in the service calling request; performing permission verification on the service calling request by the to-be-called service identifier; when the permission verification is passed, decrypting the encrypted service running parameters by a specified decryption mode to generate service running parameters of the to-be-called service, so that the server calls the to-be-called service by the service running parameters.

[0007] Further, the specified encryption mode of the service running parameters is determined according to the number of the pre-obtained service running parameters, specifically comprising: obtaining the number of the service running parameters and determining the size relationship between the number of the service running parameters and a preset number threshold; when the number of the service running parameters is less than the preset number threshold, setting the specified encryption mode as an RSA encryption algorithm; when the number of the service running parameters is not less than the preset number threshold, setting the specified encryption mode as a combined encryption algorithm; wherein the combined encryption algorithm comprises an RSA encryption algorithm and an AES encryption algorithm, the AES encryption algorithm is used to encrypt the service running parameters, and the RSA encryption algorithm is used to encrypt the AES encryption algorithm.

[0008] Further, the service calling request is verified by the to-be-called service identifier, specifically comprising: determining a specified item credential of a specified item corresponding to the to-be-called service identifier in a pre-set specified correspondence according to the to-be-called service identifier, wherein the specified correspondence is used to represent the correspondence between the items and the services; and verifying the service calling request according to the service calling request and the specified item credential.

[0009] Further, before the permission verification of the service calling request according to the to-be-called service identifier, the method further comprises: obtaining project information of a project, wherein the project information comprises a project use time interval and a plurality of allowed access addresses corresponding to the project; encrypting the project information to obtain encrypted project information; and generating a project credential corresponding to the project according to the encrypted project information and the project identifier.

[0010] Further, the verification of the service calling request according to the service calling request and the specified project credential comprises: obtaining a service calling time and a service calling address in the service calling request; obtaining specified encrypted project information in the specified project credential, decrypting the specified encrypted information by a preset method to obtain specified project information corresponding to the specified project, wherein the specified project information comprises a use time interval corresponding to the specified project and a plurality of allowed access addresses corresponding to the specified project; judging whether the service calling time is within the use time interval according to the service calling time in the service calling request and the use time interval corresponding to the specified project; if yes, judging whether the service calling address is in the plurality of allowed access addresses according to the service calling address in the service calling request and the allowed access addresses corresponding to the specified project; and if yes, determining that the verification of the service calling request is successful.

[0011] Further, the encryption of the project information to obtain encrypted project information comprises: randomly generating an AES key with a specified length, encrypting the project information by an AES symmetric encryption algorithm and the AES key to obtain first encrypted information; encrypting the AES key by an RSA asymmetric encryption algorithm to obtain an encrypted key; and generating the encrypted project information according to the first encrypted information and the encrypted key.

[0012] Further, according to the to-be-called service identifier, the specified project credential of a specified project corresponding to the to-be-called service identifier is determined in a preset specified correspondence, which comprises: storing the project credential of each project in a credential storage table; presetting the correspondence between the project and the service to construct the specified correspondence between the project identifier and the service identifier; determining the specified project identifier corresponding to the specified project according to the specified correspondence and the to-be-called service identifier; and obtaining the specified project credential corresponding to the specified project identifier in the credential storage table according to the specified project identifier.

[0013] Further, before the permission check on the service call request by the to-be-called service identifier, the method further includes: according to the to-be-called service identifier, judging whether there is a specified project credential corresponding to the to-be-called service identifier in the credential storage table; if yes, determining that the service call request has the check permission, so as to check the service call request by the check permission.

[0014] One or more embodiments of the present specification provide a service calling device for improving data security, comprising:

[0015] at least one processor; and

[0016] a memory in communication connection with the at least one processor; wherein

[0017] The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to:

[0018] obtain a plurality of service running parameters corresponding to a to-be-called service pre-set in a client and a to-be-called service identifier; determine a specified encryption mode of the service running parameters according to the number of pre-obtained service running parameters by the client, so as to pre-encrypt the service running parameters by the specified encryption mode to generate encrypted service running parameters; generate a service call request according to the to-be-called service identifier and the encrypted service running parameters by the client, and send the service call request to a server; intercept the service call request by an interception task pre-set in the server to obtain the to-be-called service identifier and the encrypted service running parameters in the service call request; check the permission of the service call request by the to-be-called service identifier; when the permission check is passed, decrypt the encrypted service running parameters by a specified decryption mode to generate the service running parameters of the to-be-called service, so that the server calls the to-be-called service by the service running parameters.

[0019] One or more embodiments of the present specification provide a non-volatile computer storage medium, which stores computer executable instructions, and the computer executable instructions are configured to:

[0020] Obtaining a plurality of service running parameters corresponding to a service to be called and an identification of the service to be called, which are preset on a client; determining a specified encryption mode of the service running parameters according to the number of the service running parameters obtained in advance, so as to encrypt the service running parameters in advance by using the specified encryption mode, and generating encrypted service running parameters; generating a service calling request according to the identification of the service to be called and the encrypted service running parameters by using the client, and sending the service calling request to a server; intercepting and processing the service calling request by using an interception task preset in the server, and obtaining the identification of the service to be called and the encrypted service running parameters in the service calling request; performing permission checking on the service calling request by using the identification of the service to be called; when the permission checking is passed, decrypting the encrypted service running parameters by using a specified decryption mode, and generating service running parameters of the service to be called, so that the server can call the service to be called by using the service running parameters.

[0021] The above at least one technical solution adopted by the embodiments of the present specification can achieve the following beneficial effects: According to the above technical solution, a suitable encryption mode is selected according to the number of service running parameters, which can not only ensure data security, but also avoid abnormal system performance loss, so as to solve the problem of system performance loss while ensuring data security; the service calling request is generated after the parameter is encrypted in the request generation stage, which ensures the data security in the data transmission starting stage; the interception task is set in the middle stage of the service calling corresponding data transmission, and the permission of the request verification is checked after the service calling request is intercepted, which further ensures the security of the data, and can avoid the waste of system resources caused by verifying the service calling request of the non-system; the request is verified in the service calling data acquisition stage, which enhances the data security. BRIEF DESCRIPTION OF DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present specification or the prior art, the drawings needed to be used in the embodiments or the prior art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments described in the present specification, and other drawings can be obtained by those skilled in the art without creative labor. In the drawings:

[0023] Figure 1 A flowchart of a service calling method for improving data security provided by the embodiments of the present specification;

[0024] Figure 2 A flowchart of license file generation provided by the embodiments of the present specification;

[0025] Figure 3 A flowchart of license file import provided by an embodiment of the present specification is shown in the figure;

[0026] Figure 4 A structural diagram of a service calling device for improving data security provided by an embodiment of the present specification is shown in the figure. DETAILED DESCRIPTION

[0027] In order to enable personnel in the technical field to better understand the technical solutions in the present specification, the technical solutions in the embodiments of the present specification will be described clearly and completely below in conjunction with the drawings in the embodiments of the present specification. Obviously, the described embodiments are only part of the embodiments of the present specification, rather than all the embodiments. Based on the embodiments of the present specification, all other embodiments obtained by those of ordinary skill in the art without creative labor should fall within the scope of protection of the present specification.

[0028] As a visualization tool, the Business Intelligence (BI) product enables users to ultimately see the display of visual dashboards and graphics. Because there are differences and particularities between projects, the product cannot meet all project requirements for chart definition. To meet the needs of projects, the product provides a data service interface to call services through the data service interface, thereby realizing the project requirements of users.

[0029] When services are called through the data service interface, there may be a situation that hackers use SQL injection vulnerabilities to threaten data security, such as obtaining sensitive data from a database, modifying database data (insertion / update / deletion), performing database management operations (such as closing a database management system), and recovering specified file contents existing in a database file system.

[0030] The current industry solves this problem from two aspects. On the one hand, checks or filters are added on the server to filter common dangerous characters and keywords such as insert, update, etc. On the other hand, sensitive information of the interface is directly encrypted. However, when the number of encryption is large, the system performance loss will be abnormal.

[0031] As can be seen from the above discussion, the service calling method in the prior art cannot guarantee the security of the entire data acquisition process, resulting in low data security and failing to meet user needs.

[0032] The embodiments of the present specification provide a service calling method for improving data security. It should be noted that the execution subject in the embodiments of the present specification can be a server or any device with data processing capability. Figure 1A flowchart of a service calling method for improving data security provided by an embodiment of the present specification is shown in Figure 1 and mainly includes the following steps:

[0033] In step S101, a plurality of service running parameters corresponding to a service to be called and a service identifier of the service to be called are acquired, which are pre-set on a client.

[0034] In an embodiment of the present specification, the service running parameters corresponding to the service are pre-set on the client. The service running parameters herein refer to parameters supporting service running. The service running parameters corresponding to different services are different, and each service includes a plurality of service running parameters. Based on a triggering operation of a user on the client, the plurality of service running parameters corresponding to the service to be called and the service identifier of the service to be called are acquired.

[0035] In step S102, a specified encryption mode of the service running parameters is determined through the client according to the number of the pre-acquired service running parameters, so as to pre-encrypt the service running parameters through the specified encryption mode to generate encrypted service running parameters.

[0036] The specified encryption mode of the service running parameters is determined according to the number of the pre-acquired service running parameters, which specifically includes: acquiring the number of the service running parameters and determining the size relationship between the number of the service running parameters and a preset number threshold; when the number of the service running parameters is less than the preset number threshold, the specified encryption mode is set as the RSA encryption algorithm; when the number of the service running parameters is not less than the preset number threshold, the specified encryption mode is set as a combined encryption algorithm; wherein the combined encryption algorithm includes the RSA encryption algorithm and the AES encryption algorithm, the AES encryption algorithm is used for encrypting the service running parameters, and the RSA encryption algorithm is used for encrypting the AES encryption algorithm.

[0037] In an embodiment of the present specification, the number threshold is pre-set according to a business scenario. The number of the service running parameters is acquired through the client, and the number of the service running parameters is compared with the number threshold to determine the size relationship between the number of the service running parameters and the number threshold. The encryption mode of the service running parameters is determined according to the size relationship between the two.

[0038] In an embodiment of the present specification, when the number of service running parameters is less than the number threshold, the specified encryption mode is set as the RSA encryption algorithm. The service running parameters are encrypted by using the RSA encryption algorithm public key to generate encrypted service running parameters, and an encryption identifier is set in the encrypted service running parameters, wherein the encryption identifier is used to indicate the encryption mode of the service running parameters. It should be noted that the RSA encryption algorithm is an asymmetric encryption algorithm, which usually generates a pair of RSA keys, one of which is a secret key (private key) saved by the user, and the other is a public key (public key) which can be publicly disclosed.

[0039] In an embodiment of the present specification, when the number of service running parameters is greater than or equal to the number threshold, the specified encryption mode is set as a combined encryption algorithm, which includes the RSA encryption algorithm and the Advanced Encryption Standard (AES) encryption algorithm. The service running parameters are encrypted by using the AES encryption algorithm, and the RSA encryption algorithm is used to encrypt the AES encryption algorithm. That is, the service running parameters are encrypted by using the digital envelope technology, a 16-character length AES key is randomly generated, the service running parameters are encrypted by using the AES encryption algorithm, the key is encrypted by using the RSA asymmetric algorithm, the encryption identifier corresponding to the encryption mode is set, and different identifiers are used for transmission.

[0040] Through the above technical solution, the appropriate encryption mode is selected according to the number of service running parameters, which can ensure data security and avoid abnormal system performance loss, thereby solving the problem of system performance loss while ensuring data security.

[0041] In step S103, the client generates a service call request according to the to-be-called service identifier and the encrypted service running parameter, and sends the service call request to the server.

[0042] In an embodiment of the present specification, the client generates a service call request according to the service identifier of the to-be-called service and the encrypted service running parameter. That is, under the specified trigger operation of the user, the name and identifier of the to-be-called service are obtained first, the number of service running parameters corresponding to the service is determined according to the identifier of the to-be-called service, the corresponding encryption mode is selected, and the encrypted service running parameter and the service identifier are used as the service call request. Through the above technical solution, the service call request is generated after the parameter is encrypted in the request generation stage, which ensures the data security in the data transmission starting stage.

[0043] Step S104, intercepting the service call request by the interception task pre-set in the service end, obtaining the to-be-called service identifier and the encrypted service running parameter in the service call request.

[0044] In an embodiment of the present specification, the interception task is set in the service end, and an interceptor can be set. The data service is identified by the interceptor, the service call request is intercepted, and the to-be-called service identifier and the encrypted service running parameter in the service call request are obtained, so as to facilitate the subsequent verification process.

[0045] Through the above technical solution, the interception task is set in the middle stage of the service call corresponding to the data transmission, the service call request is intercepted and authenticated, and the security of the data is further guaranteed.

[0046] Step S105, performing permission verification on the service call request by the to-be-called service identifier.

[0047] Before verifying the service call request by the to-be-called service identifier, the method further includes: obtaining project information of a project, wherein the project information includes a project use time interval and a plurality of allowed access addresses corresponding to the project; encrypting the project information to obtain encrypted project information; and generating a project credential corresponding to the project according to the encrypted project information and the project identifier.

[0048] In an embodiment of the present specification, the project information table is created in the system by the management end in advance, as shown in the following table. The registered project information is stored, and a record corresponding to the project information is added each time a project is registered. The project information of each record can be modified and deleted.

[0049] Field Reference Field Type Business Rule ID Column Varchar(36) Project Unique ID Project Name Varchar(200) Record Project Name Start Time Timestamp Record Usage Start Time End Time Timestamp Record Usage End Time IP Varchar(2000) Record Accessible IPs, multiple IPs separated by semicolons

[0050] As shown in the above table, the project information includes project ID, project name, start time, end time and IP, wherein the project ID is the unique identifier of the project, the project name is the recorded project name, the start time and the end time are the start time and the end time allowed to be used, that is, the allowed use time period, and the IP is the IP address that can access the project. The IP address here can include a plurality of accessible addresses.

[0051] In an embodiment of the present specification, project information of a project is obtained in a project information table, the project information including a project use time interval and a plurality of allowed access addresses corresponding to the project; the project information is encrypted to obtain encrypted project information corresponding to the project. According to the encrypted project information of the project and a project identifier corresponding to the project, a project credential corresponding to the project is generated, and the project credential is stored in a pre-constructed credential storage table, and a corresponding relationship between the project and the service is established. The credential storage table is shown in the following table. In addition, the project credential here can be called a license file. After generating the license file, the file is downloaded to the local.

[0052] Field Reference Field Type Business Rule ID Column Varchar(36) Unique ID Content Varchar(2000) License File Content

[0053] The project information is encrypted to obtain encrypted project information, specifically including: randomly generating an AES key of a specified length, encrypting the project information through an AES symmetric encryption algorithm and the AES key to obtain first encrypted information; encrypting the AES key through an RSA asymmetric encryption algorithm to obtain an encrypted key; and generating encrypted project information according to the first encrypted information and the encrypted key.

[0054] In an embodiment of the present specification, Figure 2 A flowchart of license file generation provided by an embodiment of the present specification is provided, Figure 3 A flowchart of license file import provided by an embodiment of the present specification is provided. As Figure 2 The project information is encrypted through the AES symmetric encryption algorithm, and an AES key of 16 characters in length is randomly generated. The key is encrypted using the RSA asymmetric algorithm, and the encrypted key and the encrypted project information are used to generate a license file. As Figure 3 The license file is inserted into the database and downloaded to the local.

[0055] Before the service calling request is checked according to the to-be-called service identifier of the to-be-called service, the method further includes: according to the to-be-called service identifier, determining whether a specified project credential corresponding to the to-be-called service identifier exists in the credential storage table; if yes, it is determined that the service calling request has a checking authority, and the service calling request is checked through the checking authority.

[0056] In one embodiment of the present specification, before the service call request is checked, in order to avoid the waste of system resources caused by checking the service call request of non-system, the permission authentication of the service call request is checked in advance. According to the to-be-called service identifier, it is judged in the credential storage table whether there is a specified project credential corresponding to the to-be-called service identifier; if there is, it is judged that the service call request has the checking permission, and the subsequent checking operation of the service call request is performed on the premise of passing the checking permission. That is, the application server checks whether there is a license through the interceptor filter, returns a prompt when there is no license, and has no access right; and decrypts the license.

[0057] The service call request is checked through the to-be-called service identifier, specifically including: determining the specified project credential of the specified project corresponding to the to-be-called service identifier in the pre-set specified correspondence, wherein the specified correspondence is used to represent the correspondence between the project and the service; and checking the service call request according to the service call request and the specified project credential.

[0058] According to the to-be-called service identifier, the specified project credential of the specified project corresponding to the to-be-called service identifier is determined in the pre-set specified correspondence, specifically including: storing the project credential of each project in the credential storage table; pre-setting the correspondence between the project and the service to construct the specified correspondence between the project identifier and the service identifier; determining the specified project identifier of the specified project corresponding to the to-be-called service identifier according to the specified correspondence and the to-be-called service identifier; and obtaining the specified project credential corresponding to the specified project identifier in the credential storage table according to the specified project identifier.

[0059] In one embodiment of the present specification, the project credential of each project is stored in the credential storage table, and the correspondence between the project and the service is pre-set in the foregoing step to construct the specified correspondence between the project identifier and the service identifier. The specified project identifier of the specified project corresponding to the to-be-called service identifier is determined according to the specified correspondence and the to-be-called service identifier, so as to determine the specified project credential corresponding to the project in the credential storage table according to the specified project identifier.

[0060] According to the service call request and the specified item credential, the service call request is checked, specifically including: obtaining the service call time and the service call address in the service call request; obtaining the specified encrypted item information in the specified item credential, decrypting the specified encrypted information through a preset method to obtain the specified item information corresponding to the specified item, wherein the specified item information includes a use time interval corresponding to the specified item and a plurality of allowed access addresses corresponding to the specified item; judging whether the service call time is within the use time interval through the service call time in the service call request and the use time interval corresponding to the specified item; if yes, judging whether the service call address is in the plurality of allowed access addresses through the service call address in the service call request and the allowed access addresses corresponding to the specified item; if yes, determining that the service call request is checked successfully.

[0061] In an embodiment of the present specification, the service call time in the service call request and the service call address corresponding to the request are obtained, and the address can be an IP address. The specified encrypted item information of the item corresponding to the service to be called, that is, the license file, is obtained. The RSA algorithm is used to decrypt the private key (a pair with the encrypted public key) to obtain the AES key, and then the AES algorithm is used to decrypt the key to obtain the specific item information, that is, the specified item information. The service call time and the service call address in the request are compared with the specified item information, and when they do not match, it is prompted that there is no access right, and when they match, the next step of data service parameter decryption verification is performed.

[0062] In an embodiment of the present specification, whether the service call time is within the use time interval is judged through the service call time in the service call request and the use time interval corresponding to the specified item, if yes, the next step of verification is performed, whether the service call address is in the plurality of allowed access addresses is judged through the service call address in the service call request and the allowed access addresses corresponding to the specified item; if yes, it is determined that the service call request is checked successfully.

[0063] In addition, the above embodiment is to verify the call time first, and then verify the call address, and the call address can also be verified first, and then the call time is verified. Whether the service call address is in the plurality of allowed access addresses is judged through the service call address in the service call request and the allowed access addresses corresponding to the specified item, if yes, the next step of verification is performed, whether the service call time is within the use time interval is judged through the service call time in the service call request and the use time interval corresponding to the specified item; if yes, it is determined that the service call request is checked successfully.

[0064] Step S106, when the permission verification passes, the encrypted service running parameter is decrypted by a specified decryption mode to generate the service running parameter of the service to be invoked, so that the service end invokes the service to be invoked through the service running parameter.

[0065] In an embodiment of the present specification, after the permission verification passes, that is, after the license file verification passes, the data service parameter decryption is performed. According to the encrypted identifier in the encrypted service running parameter, the specified decryption mode corresponding to the encryption mode is selected. The encrypted service running parameter is decrypted by the specified decryption mode to generate the service running parameter of the service to be invoked. When the RSA algorithm identifier is met, the RSA private key (a pair with the public key) is used to decrypt the parameter. If the decryption is successful, the corresponding service is invoked using the service running parameter to obtain data, and the data is returned to the user client. If the decryption fails, it is prompted that there is no access permission. When the AES and RSA combined algorithm identifier is met, the RSA private key (a pair with the public key) is used to decrypt to obtain the AES key, and then the AES key is used to decrypt the parameter to obtain the parameter information. If the decryption is successful, the data service is invoked using the service running parameter to obtain data, and the data is returned to the user client. If the decryption fails, it is prompted that there is no access permission. The authentication is performed in the service calling and data obtaining stage, and the data security is enhanced.

[0066] Through the above technical solution, the appropriate encryption mode is selected according to the number of service running parameters, which can not only ensure data security, but also avoid abnormal system performance loss, so as to solve the system performance loss problem while ensuring data security. The service calling request is generated after the parameter is encrypted in the request generation stage, which ensures the data security in the data transmission initial stage. The interception task is set in the middle stage of the service calling and corresponding data transmission, and the request verification permission is checked after the service calling request is intercepted, which further ensures the data security and avoids the waste of system resources caused by checking the service calling request of the non-system. The request is verified in the service calling and data obtaining stage, which enhances the data security.

[0067] The embodiment of the present specification also provides a service calling device for improving data security, as shown in Figure 4 As shown in the figure, the device comprises at least one processor and a memory connected with the at least one processor in communication; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to:

[0068] The service running parameters corresponding to a to-be-called service pre-set in a client are acquired, and a to-be-called service identifier is acquired; a specified encryption mode of the service running parameters is determined according to the number of the pre-acquired service running parameters, so as to pre-encrypt the service running parameters by using the specified encryption mode, and generate encrypted service running parameters; a service calling request is generated according to the to-be-called service identifier and the encrypted service running parameters, and the service calling request is sent to a server; the to-be-called service identifier and the encrypted service running parameters in the service calling request are acquired by intercepting the service calling request through an intercepting task pre-set in the server; the service calling request is checked for authority according to the to-be-called service identifier; when the authority check is passed, the encrypted service running parameters are decrypted by using a specified decryption mode, and the service running parameters of the to-be-called service are generated, so that the server can call the to-be-called service by using the service running parameters.

[0069] The embodiments of the present specification also provide a non-volatile computer storage medium, which stores computer executable instructions, and the computer executable instructions are configured to:

[0070] The service running parameters corresponding to a to-be-called service pre-set in a client are acquired, and a to-be-called service identifier is acquired; a specified encryption mode of the service running parameters is determined according to the number of the pre-acquired service running parameters, so as to pre-encrypt the service running parameters by using the specified encryption mode, and generate encrypted service running parameters; a service calling request is generated according to the to-be-called service identifier and the encrypted service running parameters, and the service calling request is sent to a server; the to-be-called service identifier and the encrypted service running parameters in the service calling request are acquired by intercepting the service calling request through an intercepting task pre-set in the server; the service calling request is checked for authority according to the to-be-called service identifier; when the authority check is passed, the encrypted service running parameters are decrypted by using a specified decryption mode, and the service running parameters of the to-be-called service are generated, so that the server can call the to-be-called service by using the service running parameters.

[0071] Each of the embodiments in the present specification is described in a progressive manner, and the same or similar parts of each of the embodiments can be referred to each other. Each of the embodiments focuses on the difference from other embodiments. In particular, for the device, equipment and non-volatile computer storage medium embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the part of the method embodiment.

[0072] The above described embodiments of the present specification. Other embodiments are within the scope of the following claims. In some cases, the acts or steps recited in the claims can be performed in a different order than those in the embodiments and still achieve desirable results. Additionally, the processes depicted in the accompanying figures do not necessarily require the particular order shown or sequential order to achieve the desired results. In certain implementations, multitasking and parallel processing can be advantageous or necessary.

[0073] The device and medium provided by the embodiments of the present specification are one-to-one corresponding with the method, therefore, the device and medium also have similar beneficial technical effects as the method corresponding thereto, since the beneficial technical effects of the method have been described in detail above, therefore, the beneficial technical effects of the device and medium will not be described here again.

[0074] Those skilled in the art will understand that the embodiments of the present specification can be provided as a method, system, or computer program product. Therefore, the present specification can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present specification can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROMs, optical storage devices, etc.) containing computer usable program code.

[0075] The present specification is described with reference to flowcharts and / or block diagrams of the method, device (system), and computer program product according to the embodiments of the present specification. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, as well as a combination of flows and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing apparatus produce a device that implements the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions specified in the flow or flows and / or blocks Figure 1 The means for performing the functions specified in the flow or flows and / or blocks.

[0076] These computer program instructions can also be stored in a computer-readable memory that can direct the computer or other programmable data processing apparatus to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including instruction means, which implements the functions specified in the flowcharts and / or block diagrams. Figure 1 The functions specified in the flow or flows and / or blocks Figure 1 The means for performing the functions specified in the flow or flows and / or blocks.

[0077] These computer program instructions can also be loaded into a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 Figure 1

[0078] In one typical configuration, the computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0079] The memory can include non-persistent memory and / or volatile memory, such as random access memory (RAM) about which the processor can execute instructions. The memory can also include non-volatile memory, such as read only memory (ROM), electrically programmable read only memory (EPROM), electrically erasable programmable read only memory (EEPROM), programmable read only memory (PROM), erasable programmable read only memory (EPROM), flash memory, or a combination of non-volatile memories in different types. The memory is an example of computer readable storage media.

[0080] Computer readable media includes permanent and non-permanent, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), electrically programmable read only memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital versatile disc (DVD), or other optical storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to computing devices. According to the definition herein, computer readable media does not include transitory media, such as modulated data signals and carrier waves.

[0081] It should also be noted that the terms "comprising", "containing", or any other variant thereof are intended to encompass a non-exclusive inclusion, such that a process, method, article or apparatus that comprises a list of elements does not include only those elements recited, but can also include other elements not expressly listed or inherent to such process, method, article or apparatus. Without further limitation, an element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article or apparatus that includes the element.

[0082] ​​The above merely provides one or more embodiments of the present specification and is not intended to limit the present specification. One of ordinary skill in the art can make various modifications and changes to one or more embodiments of the present specification. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of one or more embodiments of the present specification should be included in the scope of claims of the present specification.

Claims

1. A service invocation method for improving data security, characterized in that, The method includes: Obtain multiple service runtime parameters and service identifiers that are pre-set on the client for the service to be invoked; The client determines a specified encryption method for the service operation parameters based on the number of pre-acquired service operation parameters, and pre-encrypts the service operation parameters using the specified encryption method to generate encrypted service operation parameters. The client generates a service call request based on the service identifier to be called and the encrypted service operation parameters, and sends the service call request to the server. By pre-setting an interception task in the server, the service call request is intercepted and processed to obtain the identifier of the service to be called and the encrypted service operation parameters in the service call request; The service call request is validated using the identifier of the service to be called. Once the permission verification is successful, the encrypted service operation parameters are decrypted using a specified decryption method to generate the service operation parameters of the service to be called, so that the server can call the service to be called using the service operation parameters; Based on the number of pre-acquired service operation parameters, a specified encryption method for the service operation parameters is determined, specifically including: Obtain the number of service operation parameters and determine the relationship between the number of service operation parameters and a preset number threshold; When the number of service operation parameters is less than the preset threshold, the specified encryption method is set to the RSA encryption algorithm; When the number of service operation parameters is not less than the preset number threshold, the specified encryption method is set to a combined encryption algorithm; The combined encryption algorithm includes an RSA encryption algorithm and an AES encryption algorithm. The AES encryption algorithm is used to encrypt service operation parameters, and the RSA encryption algorithm is used to encrypt the AES encryption algorithm. The service call request is verified using the identifier of the service to be called, specifically including: Based on the service identifier to be invoked, a designated project credential corresponding to the designated project of the designated project is determined in a pre-set designated correspondence, wherein the designated correspondence is used to represent the correspondence between the project and the service; The method further includes verifying the service call request based on the service call request and the specified project credentials; before performing permission verification on the service call request using the identifier of the service to be called, the method also includes: Obtain project information, including the project usage time range and multiple allowed access addresses corresponding to the project; The project information is encrypted to obtain encrypted project information; Based on the encrypted project information and the project identifier, a project credential corresponding to the project is generated; The service call request is validated based on the service call request and the specified project credentials, specifically including: Obtain the service call time and service call address from the service call request; Obtain the specified encrypted project information from the specified project credential, and decrypt the specified encrypted information using a preset method to obtain the specified project information corresponding to the specified project. The specified project information includes the usage time range corresponding to the specified project and multiple allowed access addresses corresponding to the specified project. By using the service call time in the service call request and the usage time interval corresponding to the specified project, it is determined whether the service call time is within the usage time interval; If so, then determine whether the service call address is among the multiple allowed access addresses by using the service call address in the service call request and the allowed access address corresponding to the specified project; If so, the service call request is deemed to have been successfully verified. The project information is encrypted to obtain encrypted project information, specifically including: A random AES key of a specified length is generated, and the project information is encrypted using the AES symmetric encryption algorithm and the AES key to obtain the first encrypted information; The AES key is encrypted using the RSA asymmetric encryption algorithm to obtain the encryption key; Based on the first encryption information and the encryption key, generate encrypted project information; Based on the service identifier to be invoked, determine the specified item credential of the specified item corresponding to the specified service identifier in a pre-set specified correspondence, specifically including: Store the project vouchers for each project in the voucher storage table; Pre-set the mapping relationship between projects and services, and construct the specified mapping relationship between project identifiers and service identifiers; Based on the specified correspondence and the service identifier to be invoked, determine the specified project identifier of the specified project corresponding to the service identifier to be invoked; Based on the specified project identifier, retrieve the specified project voucher corresponding to the specified project identifier from the voucher storage table.

2. The service invocation method for improving data security according to claim 1, characterized in that, Before performing permission verification on the service call request using the service identifier to be called, the method further includes: Based on the service identifier to be invoked, determine in the credential storage table whether there is a credential for a specific item corresponding to the service identifier to be invoked; If so, the service call request is determined to have verification permissions, and the service call request is verified by passing the verification permissions.

3. A service invocation device for improving data security, characterized in that, The device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method as described in any one of claims 1-2.

4. A non-volatile computer storage medium storing computer-executable instructions, the computer-executable instructions being configured to perform the method as described in any one of claims 1-2.

Images