Data reading system, method, electronic device and computer readable storage medium

Abstract

The application provides a data reading system, method, electronic device and computer readable storage medium. The data reading method comprises: obtaining first signature information generated by a client according to a first target signature key, the first target signature key being obtained by the client from an authority server according to target login credentials and target key acquisition credentials of the client; sending a data reading request carrying the first signature information to a backend; obtaining second signature information generated by the backend according to a second target signature key, the second target signature key being obtained by the backend from the authority server according to target login credentials carried by the data reading request; when the first signature information and the second signature information are consistent, sending data matched with the data reading request to the client, the data matched with the data reading request being obtained by the backend from a server. In the application, the problem that the signature key is easily stolen can be avoided, and the security of data reading in a micro-service architecture is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of microservices, and particularly relates to a data reading system and method, an electronic device and a computer readable storage medium. BACKGROUND

[0002] The microservice architecture is widely used in the Internet field to process user requests under the condition of billions of high concurrency, so as to ensure the normal operation of the business. However, when the request data is transmitted between the client and the server, it needs to pass through many routers and switches, and the attacker can intercept the transmitted request data to obtain the request content, thereby stealing the user's login identity authentication information or modifying the request body, which leads to the security of the request data.

[0003] In the prior art, in order to improve the security of the request data, the request data is encrypted by using a signature key, so that even if the attacker intercepts the request data during the forwarding process, the data cannot be effectively analyzed or tampered with.

[0004] However, the present inventors have found in practical application that the existing encryption processing method is prone to the theft of the signature key, and therefore the security of data reading in the existing microservice architecture is relatively low. SUMMARY

[0005] The present application provides a data reading system and method, an electronic device and a computer readable storage medium, which aims to solve the problem of low security of data reading in the existing microservice architecture due to the easy theft of the signature key.

[0006] In a first aspect, the present application provides a data reading system, which comprises a client, a backend, an authority server and a server, the client is in communication connection with the backend and the authority server respectively, and the backend is in communication connection with the authority server and the server respectively;

[0007] The client is configured to obtain a first target signature key of the client from the authority server according to a target login credential and a target key acquisition credential of the client.

[0008] The client is further configured to send a data reading request carrying first signature information to the backend, wherein the first signature information is generated by the client according to the first target signature key, and the data reading request carries the target login credential.

[0009] The backend is configured to obtain a second target signature key matched with the target login credential carried in the data reading request from the authority server.

[0010] The back end is further configured to generate second signature information according to the second target signature key; and when the first signature information and the second signature information are consistent, data matched with the data reading request is obtained from the server and sent to the client.

[0011] In a second aspect, the present application provides a data reading method, which comprises:

[0012] obtaining first signature information generated by a client according to a first target signature key, wherein the first target signature key is obtained by the client from an authority server according to a target login credential and a target key acquisition credential of the client;

[0013] sending a data reading request carrying the first signature information to a back end;

[0014] obtaining second signature information generated by the back end according to a second target signature key, wherein the second target signature key is obtained by the back end from the authority server according to a target login credential carried by the data reading request;

[0015] when the first signature information and the second signature information are consistent, sending data matched with the data reading request to the client, wherein the data matched with the data reading request is obtained by the back end from a server.

[0016] In a third aspect, the present application further provides an electronic device, which comprises a processor and a memory, the memory storing a computer program, and the processor invoking the computer program in the memory to execute the steps in any of the data reading methods provided by the present application.

[0017] In a fourth aspect, the present application further provides a computer readable storage medium, which stores a computer program, and the computer program is loaded by a processor to execute the steps in the data reading method.

[0018] In the application, in the first aspect, the target login credential and the target secret key of the client are obtained to obtain the first target signature key of the client from the permission server for generating the first signature information, and the data reading request carrying the first signature information is sent to the backend through the client, so that any one of the target login credential and the target secret key of the client is unable to obtain the signature key of the client, thereby avoiding the problem that the signature key is easily stolen, and the security of data reading in the micro-service architecture is improved to a certain extent. In the second aspect, the second target signature key matched with the target login credential carried in the data reading request is obtained from the permission server by the backend for generating the second signature information; when the first signature information and the second signature information are consistent, the data matched with the data reading request is obtained from the server and sent to the client, so that the security problem of the request data caused by stealing the login identity authentication information of the user or modifying the request body by an attacker can be avoided; therefore, the security of data reading in the micro-service architecture is also provided to a certain extent. It can be seen that the application can avoid the problem that the signature key is easily stolen, and improve the security of data reading in the micro-service architecture. BRIEF DESCRIPTION OF DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor.

[0020] Figure 1 is a scene schematic diagram of the data reading system provided by the embodiments of the application;

[0021] Figure 2 is a schematic diagram for generating a signature key based on a permission server in the embodiments of the application;

[0022] Figure 3 is a schematic diagram for the client to obtain a signature key in the embodiments of the application;

[0023] Figure 4 is a schematic diagram for the client to generate a first signature information in the embodiments of the application;

[0024] Figure 5 is a schematic diagram for the backend to obtain a signature key in the embodiments of the application;

[0025] Figure 6 is a schematic diagram for the backend to verify a signature in the embodiments of the application;

[0026] Figure 7is a flowchart of a data reading method provided by an embodiment of the present application.

[0027] Figure 8 is an embodiment structure diagram of an electronic device provided in the present application. DETAILED DESCRIPTION

[0028] The technical solutions in the embodiments of the present application will be clearly and completely described with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments in the present application, any other embodiments obtained by a person skilled in the art without creative work fall within the scope of protection of the present application.

[0029] In the description of the embodiments of the present application, it should be understood that the terms "first", "second" are used only for the purpose of description, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined with "first", "second" can explicitly or implicitly include one or more of the features. In the description of the embodiments of the present application, the meaning of "multiple" is two or more, unless otherwise specifically limited.

[0030] The following description is given in order to enable any person skilled in the art to practice and use the present application. In the following description, details are set forth in order to explain the application. It will be apparent to a person skilled in the art that the application can be practiced without using these specific details. In other instances, well-known processes have not been described in detail in order to avoid unnecessarily obscuring the description of the embodiments of the present application. Therefore, the present application is not intended to be limited to the embodiments shown, but is to be accorded the widest scope consistent with the principles and features disclosed herein.

[0031] The embodiments of the present application provide a data reading system, method, electronic device and computer readable storage medium.

[0032] First, the data reading system provided in the embodiments of the present application will be introduced, referring to Figure 1 , Figure 1 is a scenario diagram of a data reading system provided by the embodiments of the present application. The data reading system 100 includes a client 101, a backend 102, an authority server 103 and a server 104, the client 101 is in communication connection with the backend 102 and the authority server 103 respectively, the backend 102 is in communication connection with the authority server 103 and the server 104 respectively. Wherein, the server 104 can further include one or more microservices.

[0033] The client 101 is used to obtain the target login credential of the client 101 and the target key acquisition credential to obtain the first target signature key of the client 101 from the authority server 103.

[0034] The target login credential is the login credential of the client 101. The target key acquisition credential is the credential of the client 101 for obtaining the signature key from the authority server 103.

[0035] The signature key is the proof of the identity of the sender. The first target signature key is the signature key obtained by the client 101 from the authority server 103.

[0036] Exemplarily, the authority server 103 can pre-generate the login credential, the key acquisition credential and the signature key of each client 101. As shown in Figure 2 Figure 2 is a schematic diagram for generating the signature key based on the authority server 103 in the embodiment of the application. The process of generating the login credential, the key acquisition credential and the signature key of each client 101 by the authority server 103 includes: verifying the user information of the client 101 through the CAS (Central Authentication Service) in the process of logging in the data reading system of the client 101, and generating the login credential (Token) through the authority server 103; and generating the signature key (ValidateKey) and the key acquisition credential (Validate_Key_Auth) belonging to the current login credential Token in the process of generating the login credential Token. After generating the login credential, the key acquisition credential and the signature key of each client 101, the authority server 103 can store the login credential, the key acquisition credential and the signature key of each client 101 in association in the local of the authority server 103, or in other terminals or servers in communication connection with the authority server 103.

[0037] Further, in order to avoid the login credential, the key acquisition credential and the signature key of each client 101 being easily read or leaked, and to improve the security of the login credential, the key acquisition credential and the signature key of each client 101, and further improve the data reading security in the micro-service architecture, the login credential, the key acquisition credential and the signature key of each client 101 can be stored in association in the cache of the authority server 103.

[0038] It can be seen that the authority server 103 can be used to generate the target login credential, the first target signature key and the target key acquisition credential of the client 101 when the client 101 logs in the data reading system.

[0039] ​In some embodiments, the target login credentials and the target key acquisition credentials are stored locally on the client 101. The client 101 can directly obtain the first target signature key from the authorization server 103 based on the target login credentials and the target key acquisition credentials stored locally on the client 101.

[0040] Furthermore, to prevent the target login credentials and target key acquisition credentials stored on client 101 from being easily read or leaked, and to prevent attackers from using the obtained login credentials and target key acquisition credentials to read the target signing key from the authorization server 103, the target login credentials and target key acquisition credentials are stored in client 101 as cookies, and the security attributes (i.e., the Secure attribute) and HTTP transport attributes (i.e., the HttpOnly attribute) of the target key acquisition credential cookie are set to enabled, ensuring that the target key acquisition credentials can only be transmitted under the HTTPS protocol and cannot be obtained through JavaScript, thereby improving the security of the target key acquisition credentials on client 101, and consequently improving the security of the target signing key, thus enhancing data read security in the microservice architecture.

[0041] For example, such as Figure 3 As shown, Figure 3 This is an illustrative diagram illustrating how client 101 obtains the signature key in this embodiment of the application. The process by which client 101 obtains the first target signature key from the authorization server 103 specifically includes the following steps (1) to (3):

[0042] (1) Client 101 sends a first key read request to the authorization server 103 via the HTTPS transport protocol.

[0043] (2) The authorization server 103 reads the target login credentials carried in the first key reading request, obtains the first target signature key that matches the target login credentials, and sends it to the client 101.

[0044] Here, the signature key matching the target login credential refers to the signature key stored by the authority server 103 in association with the target login credential Token carried in the first key reading request. Since the client 101 carries the target login credential Token stored by the client 101 and the target key acquisition credential Validate_Key_Auth when accessing a specific interface of the authority server 103 under the HTTPS protocol, the authority server 103 judges whether the client 101 is logged in by verifying the target login credential Token of the client 101 after receiving the first key reading request. When it is determined that the client 101 is logged in, the authority server 103 searches for the signature key stored in association with the target login credential Token from the signature keys stored thereby, and sends the signature key as the first target signature key to the client 101.

[0045] Alternatively, further, in order to improve the security of the signature key, when it is determined that the client 101 is logged in, the authority server 103 searches for the key acquisition credential Validate_Key_Auth stored in association with the target login credential Token carried in the first key reading request from the key acquisition credentials stored thereby, and compares the searched key acquisition credential Validate_Key_Auth with the target key acquisition credential Validate_Key_Auth carried in the first key reading request. When the searched key acquisition credential Validate_Key_Auth is identical to the target key acquisition credential Validate_Key_Auth carried in the first key reading request, the authority server 103 searches for the signature key stored in association with the target login credential Token from the signature keys stored thereby, and sends the signature key as the first target signature key to the client 101. When the searched key acquisition credential Validate_Key_Auth is not identical to the target key acquisition credential Validate_Key_Auth carried in the first key reading request, the authority server 103 does not send the signature key to the client 101.

[0046] As can be seen from the above, by simultaneously verifying whether the login credential and the signature acquisition credential are identical, the first target signature key matching the target login credential and the target key acquisition credential carried in the first key reading request is sent to the client 101, so that the client 101 can still not acquire the signature key of the client 101 from the authority server 103 even when the login credential of the client 101 is stolen and the key acquisition credential of the client 101 is not available, thereby improving the security of the signature key.

[0047] (3) The client 101 receives the first target signature key fed back by the authority server 103 based on the first key reading request, whereby the client 101 acquires the first target signature key from the authority server 103.

[0048] The client 101 is further configured to send a data reading request carrying the first signature information to the backend 102. The first signature information is generated by the client 101 according to the first target signature key, and the data reading request carries the target login credential.

[0049] In some embodiments, as shown in FIG. 1, the client 101 generates the first signature information in the following steps (1) to (3): Figure 4

[0050] (1) Sign the request information.

[0051] For example, the request information includes the data type Content-Type, the transmission method HttpMethod, the access path Path, and the current timestamp TimeStamp. The request information (e.g., the data type Content-Type, the transmission method HttpMethod, the access path Path, and the current timestamp TimeStamp) is signed by the first target signature key and the signature algorithm to generate the first signature code VCode1 of the request information.

[0052] (2) Sign the parameter information.

[0053] For example, the parameter information includes the QueryParams carried by the uniform resource locator (URL), the JSON (JavaScript Object Notation) carried by the request body Body, and the current timestamp TimeStamp. The parameter information (e.g., the QueryParams carried by the URL, the JSON carried by the request body Body, and the current timestamp TimeStamp) is signed by the first target signature key and the signature algorithm to generate the first signature code VCode2 of the parameter information.

[0054] (3) Merge the signed request information and the parameter information to form the first signature information.

[0055] ​Exemplarily, the first signature code VCode1 of the request information and the first signature code VCode2 of the parameter information are merged into a Header named ValidateCode with a preset fixed format of the Header. The fixed format of the Header can be {signed request information / signed parameter information / signed timestamp}, i.e., the request information and the parameter information signed in (I) and (II) above are merged to form the Header named ValidateCode: VCode1 / VCode2 / TimeStamp.

[0056] The client 101 is specifically configured to generate the first signature code of the request information and the first signature code of the parameter information based on the first target signature key, and merge the first signature code of the request information and the first signature code of the parameter information to obtain the first signature information. The generation of the first signature code of the request information by the client 101 can refer to the description of (I) above, the generation of the first signature code of the parameter information by the client 101 can refer to the description of (II) above, and the merging of the first signature code of the request information and the first signature code of the parameter information can refer to the description of (III) above.

[0057] The backend 102 is configured to obtain, from the authority server 103, a second target signature key matched with the target login credential carried in the data reading request.

[0058] The second target signature key refers to the signature key obtained by the backend 102 from the authority server 103.

[0059] Exemplarily, as shown in Figure 5 , Figure 5 is a schematic diagram for explaining the backend 102 obtaining the signature key in the embodiments of the present application, and the process of the backend 102 obtaining the second target signature key from the authority server 103 specifically includes the following steps 1) to 3):

[0060] 1) The backend 102 sends a second key reading request to the authority server 103 through the HTTPS transmission protocol.

[0061] The second key reading request refers to the key reading request sent by the backend 102 to the authority server 103.

[0062] The target login credential of the client 101 is also carried in the data reading request sent by the backend 102 to the backend 102. The backend 102 can send the second key reading request to the authority server 103 according to the target login credential carried in the data reading request sent by the backend 102.

[0063] 2) The permission server 103 reads the target login credential carried by the second key reading request, obtains the second target signature key matched with the target login credential, and sends it to the backend 102.

[0064] Here, the signature key matched with the target login credential refers to the signature key stored by the permission server 103, which is associated with the target login credential Token carried in the second key reading request.

[0065] Since the backend 102 carries the target login credential Token of the client 101 when accessing the specific interface of the permission server 103 under the HTTPS protocol, after receiving the second key reading request sent by the backend 102, the permission server 103 finds the signature key associated with the target login credential Token carried in the second key reading request from the signature keys stored by it, as the second target signature key sent to the backend 102.

[0066] 3) The backend 102 receives the second target signature key fed back by the permission server 103 based on the second key reading request, so that the backend 102 realizes obtaining the second target signature key from the permission server 103.

[0067] The backend 102 is also used to generate second signature information according to the second target signature key; when the first signature information and the second signature information are consistent, the data matched with the data reading request is obtained from the server 104 and sent to the client 101.

[0068] Similar to the signature method of the client 101, in some embodiments, the process of the backend 102 generating the second signature information is as follows:

[0069] I) Sign the request information.

[0070] Exemplarily, the request information includes the data type Content-Type, the transmission method HttpMethod, the access path Path, and the current timestamp TimeStamp. The request information (such as the data type Content-Type, the transmission method HttpMethod, the access path Path, and the current timestamp TimeStamp) is signed by the second target signature key and the signature algorithm to generate the second signature code VCode1' of the request information.

[0071] II) Sign the parameter information.

[0072] Exemplarily, the parameter information includes QueryParams carried by a URL, and information such as JSON carried by a request body, and a current timestamp TimeStamp. The parameter information (such as QueryParams carried by a URL, information such as JSON carried by a request body, and a current timestamp TimeStamp) is signed by using a second target signature key and a signature algorithm, to generate a second signature code VCode2’ of the parameter information.

[0073] That is, the second signature information includes a second signature code of the request information and a second signature code of the parameter information, and the backend 102 is specifically configured to generate the second signature code of the request information and the second signature code of the parameter information based on the second target signature key. The backend 102 generates the second signature code of the request information can refer to the description of the above “i)”, and the backend 102 generates the second signature code of the parameter information can refer to the description of the above “ii)”.

[0074] The backend 102 is further configured to detect whether the first signature information and the second signature information are consistent. As shown in Figure 6 Figure 6 is a schematic diagram of signature verification of the backend 102 provided in an embodiment of the present application. There are various ways for the backend 102 to detect whether the first signature information and the second signature information are consistent, exemplarily including:

[0075] Method 1: The backend 102 detects whether the first signature code of the request information and the second signature code of the request information are consistent. When the first signature code of the request information and the second signature code of the request information are consistent, it is determined that the first signature information and the second signature information are consistent. When the first signature code of the request information and the second signature code of the request information are inconsistent, it is determined that the first signature information and the second signature information are inconsistent. By comparing whether the first signature code of the request information and the second signature code of the request information are consistent, it can be determined whether the request information of the client 101 is tampered with, so as to determine whether to obtain data matched with the data reading request from the server 104 and send to the client 101 in the subsequent, thereby ensuring the data reading security in the micro-service architecture to a certain extent.

[0076] ​Manner 2: The backend 102 detects whether the first signature code of the parameter information and the second signature code of the parameter information are consistent. When the first signature code of the parameter information and the second signature code of the parameter information are consistent, it is determined that the first signature information and the second signature information are consistent. When the first signature code of the parameter information and the second signature code of the parameter information are inconsistent, it is determined that the first signature information and the second signature information are inconsistent. By comparing whether the first signature code of the parameter information and the second signature code of the parameter information are consistent, it can be determined whether the parameter information of the client 101 is tampered with, so as to determine whether the data matched with the data read request is obtained from the server 104 and sent to the client 101 in the subsequent, thereby ensuring the data read security in the micro-service architecture to a certain extent.

[0077] Manner 3: The backend 102 detects whether the first signature code of the request information and the second signature code of the request information are consistent, and whether the first signature code of the parameter information and the second signature code of the parameter information are consistent. When the first signature code of the request information and the second signature code of the request information are consistent, and the first signature code of the parameter information and the second signature code of the parameter information are consistent, it is determined that the first signature information and the second signature information are consistent. When the first signature code of the request information and the second signature code of the request information are inconsistent, and / or the first signature code of the parameter information and the second signature code of the parameter information are inconsistent, it is determined that the first signature information and the second signature information are inconsistent.

[0078] When it is determined that the first signature information and the second signature information are consistent, the backend 102 is further configured to obtain the data matched with the data read request from the server 104 and send the data to the client 101. The client 101 receives the data matched with the data read request fed back by the backend 102 based on the data read request, and thus the data read of the client 101 is completed.

[0079] Since even if the request data is transmitted in an encrypted manner, an attacker can still resend the intercepted message to the receiver without any change, thereby causing a replay attack on the server 104 and the client 101. Further, in order to reduce the replay attack of the attacker on the server 104 and the client 101, the backend 102 also verifies the timeliness of the data read request when verifying the signature information (hereinafter referred to as backend 102 signature verification in the embodiments of the present application), such as Figure 6As shown, the backend 102 is further configured to detect whether a time difference between the request time of the data read request carried in the first signature information and a current time is less than a preset time length based on the data carried in the first signature information. When the time difference is less than the preset time length and the first signature information is consistent with the second signature information, it is proved that the timeliness of the data read request meets the requirements, and the backend 102 obtains the data matched with the data read request from the server 104 and sends the data to the client 101. When the time difference is less than the preset time length, it is proved that the timeliness of the data read request does not meet the requirements, and the backend 102 will not send the data matched with the data read request to the client 101, so as to avoid the replay attack on the server 104 and the client 101 caused by the attacker who continuously sends the intercepted message to the receiver again without any change.

[0080] The time difference refers to a time difference between the request time of the data read request carried in the first signature information and a current time.

[0081] The preset time length can be set according to an actual business scenario, and the specific value of the preset time length is not limited herein.

[0082] Further, in order to improve the accuracy of signature verification of the backend 102 and improve the data read security in the micro-service architecture, the backend 102 will further verify the compliance of the signature algorithm during signature verification, such as Figure 6 As shown, the backend 102 will further determine whether the data read request sent by the client 101 carries a Header with a preset name (such as validateMethod), and determine whether the signature algorithm of the client 101 is compliant through the signature algorithm name carried by the data read request. When the signature algorithm of the client 101 is not compliant, the backend 102 sends error prompt information or prompt information that the data cannot be read to the client 101.

[0083] Further, in order to improve the accuracy of signature verification of the backend 102 and improve the data read security in the micro-service architecture, the backend 102 will further verify the correctness of the signature information format during signature verification, such as Figure 6 As shown, the backend 102 will further determine whether the data read request sent by the client 101 carries a Header with a preset name (such as validateMethod), and determine whether the signature information format carried by the Header is correct. When the signature information format carried by the Header is not correct, the backend 102 sends error prompt information or prompt information that the data cannot be read to the client 101. For example, the preset correct format is: signature of request type / signature of carried parameter information / timestamp, and when the signature information format carried by the Header is not the preset correct format “signature of request type / signature of carried parameter information / timestamp”, the backend 102 sends error prompt information or prompt information that the data cannot be read to the client 101.

[0084] wherein, Figure 6 “Y” represents that the verification is passed, and “N” represents that the verification is not passed, Figure 6 the arrow in the “Y” does not limit the compliance of the signature algorithm, the format of the signature information, the timeliness of the request, the verification sequence of the request information and the parameter information. Figure 6 In the “Y”, when the compliance of the signature algorithm, the format of the signature information, the timeliness of the request, the request information and the parameter information are all verified, the data corresponding to the data reading request is sent to the client 101. When at least one of the compliance of the signature algorithm, the format of the signature information, the timeliness of the request, the request information and the parameter information is not verified, the data corresponding to the data reading request DUIYI is not sent to the client 101, but an error prompt information or a prompt information that the data cannot be read is sent to the client 101.

[0085] From the above, in the embodiment of the application, in a first aspect, the first target signature key of the client 101 is obtained from the authority server 103 for generating the first signature information according to the target login credential and the target key acquisition credential of the client 101, and the data reading request carrying the first signature information is sent to the backend 102 through the client 101, so that any one lacking the target login credential and the target key acquisition credential of the client 101 cannot obtain the signature key of the client 101, thereby avoiding the problem that the signature key is easily stolen, and improving the security of data reading in the micro-service architecture to a certain extent.

[0086] In a second aspect, the second target signature key matching the target login credential carried in the data reading request is obtained from the authority server 103 by the backend 102 for generating the second signature information; when the first signature information and the second signature information are consistent, the data matching the data reading request is obtained from the server 104 and sent to the client 101, which can avoid the security problem of the request data caused by the attacker stealing the login identity authentication information of the user or modifying the request body; therefore, the security of data reading in the micro-service architecture is also improved to a certain extent.

[0087] As can be seen, through the data reading system in the embodiment of the application, the problem that the signature key is easily stolen can be avoided, and the security of data reading in the micro-service architecture is improved.

[0088] The data reading method provided by the embodiment of the application will be introduced below. The data reading method provided by the embodiment of the application can be applied to the above-mentioned data reading system. In the embodiment of the application, the data reading method can be applied to the above-mentioned data reading system as an example, and the data reading system is taken as an execution subject, such as Figure 1As shown, the data reading system 100 can include a client 101, a backend 102, an authority server 103 and a server 104, the client 101 is in communication connection with the backend 102 and the authority server 103 respectively, and the backend 102 is in communication connection with the authority server 103 and the server 104 respectively. Wherein, the implementation and functions of the client 101, the backend 102, the authority server 103 and the server 104 can refer to the above introduction of the data reading system 100, and for the purpose of simplifying the description, the details are not described herein.

[0089] With reference to Figure 7 , Figure 7 is a flow diagram of a data reading method provided by the embodiments of the present application. It should be noted that although the logical order is shown in the flow diagram, in some cases, the steps shown or described herein can be performed in an order different from that shown herein. The data reading method includes steps S701-S703, wherein:

[0090] S701, obtaining first signature information generated by the client 101 according to a first target signature key.

[0091] Wherein, the first target signature key is obtained by the client 101 from the authority server 103 according to a target login credential and a target key acquisition credential of the client 101.

[0092] Wherein, the target login credential refers to the login credential of the client 101. The target key acquisition credential refers to the credential of the client 101 for acquiring the signature key from the authority server 103.

[0093] Wherein, the signature key is the proof of the identity of the sender. The first target signature key refers to the signature key obtained by the client 101 from the authority server 103.

[0094] Wherein, the first signature information is generated by the client 101 according to the first target signature key, and the data reading request carries the target login credential.

[0095] For the purpose of understanding, the following three aspects of the generation of the signature key, the acquisition of the signature key by the client 101 and the generation of the first signature information by the client 101 are described.

[0096] I. Generation of the signature key.

[0097] Exemplarily, the authority server 103 can pre-generate the login credential, the key acquisition credential and the signature key of each client 101. As shown, Figure 2 Figure 2 ​is a schematic diagram illustrating the generation of a signature key by the permission server 103 in the embodiments of the present application. The process of generating the login credential, key acquisition credential and signature key of each client 101 by the permission server 103 specifically includes: verifying the user information of the client 101 through CAS (Central Authentication Service) during the login of the client 101 to the data reading system, and generating a login credential (denoted as Token) through the permission server 103; and generating a signature key (denoted as ValidateKey) and a key acquisition credential (denoted as Validate_Key_Auth) belonging to the current login credential Token during the generation of the login credential Token. After generating the login credential, key acquisition credential and signature key of each client 101, the permission server 103 can store the login credential, key acquisition credential and signature key of each client 101 in association in the local permission server 103, or in association in other terminals or servers in communication connection with the permission server 103.

[0098] Further, in order to avoid the login credential, key acquisition credential and signature key of each client 101 being easily read or leaked, and to improve the security of the login credential, key acquisition credential and signature key of each client 101, and further improve the data reading security in the micro-service architecture, the login credential, key acquisition credential and signature key of each client 101 can be saved in association in the cache of the permission server 103.

[0099] In some embodiments, the target login credential and the target key acquisition credential are saved locally in the client 101, and the client 101 can directly acquire the first target signature key of the client 101 from the permission server 103 based on the target login credential and the target key acquisition credential saved locally in the client 101.

[0100] Further, in order to avoid the target login credential and the target key acquisition credential stored in the client 101 being easily read or leaked, and to avoid an attacker using the acquired target login credential and target key acquisition credential to read the target signature key from the authority server 103, the target login credential and the target key acquisition credential are stored in the client 101 in the form of a cookie, and the security attribute (i.e., the Secure attribute) and the Http transmission attribute (i.e., the HttpOnly attribute) of the target key acquisition credential cookie are set. By setting the security attribute (i.e., the Secure attribute) and the Http transmission attribute (i.e., the HttpOnly attribute) of the target key acquisition credential cookie to an open state, the target key acquisition credential can only be transmitted under the HTTPS protocol and cannot be acquired through a JavaScript script, thereby improving the security of the target key acquisition credential of the client 101, and further improving the security of the target signature key and the security of data reading in the micro-service architecture.

[0101] II. The client 101 acquires a signature key.

[0102] Exemplarily, as shown in Figure 3 , Figure 3 is a description diagram of the client 101 acquiring a signature key in an embodiment of the present application. The process of the client 101 acquiring the first target signature key from the authority server 103 specifically includes the following steps (1) to (3):

[0103] (1) The client 101 sends a first key reading request to the authority server 103 through the HTTPS transmission protocol.

[0104] (2) The authority server 103 acquires the first target signature key matching the target login credential carried by the first key reading request and sends it to the client 101 according to the target login credential.

[0105] Here, the signature key matching the target login credential refers to the signature key stored in the authority server 103 and associated with the target login credential Token carried in the first key reading request. Since the client 101 carries the target login credential Token and the target key acquisition credential Validate_Key_Auth stored in the client 101 when accessing a specific interface of the authority server 103 under the HTTPS protocol, the authority server 103 determines whether the client 101 is logged in by verifying the target login credential Token after receiving the first key reading request. When it is determined that the client 101 is logged in, the authority server 103 searches for the signature key associated with the target login credential Token from the signature keys stored therein and sends it to the client 101 as the first target signature key.

[0106] Alternatively, further, in order to improve the security of the signature key, when it is determined that the client 101 has logged in, the authority server 103 finds the key acquisition credential Validate_Key_Auth stored in association with the target login credential Token carried in the first key reading request from the key acquisition credential stored in the key acquisition credential Validate_Key_Auth, and compares the key acquisition credential Validate_Key_Auth found with the target key acquisition credential Validate_Key_Auth carried in the first key reading request to determine whether they are consistent. When the key acquisition credential Validate_Key_Auth found is consistent with the target key acquisition credential Validate_Key_Auth carried in the first key reading request, the signature key stored in association with the target login credential Token is found from the stored signature keys, and the first target signature key is sent to the client 101. When the key acquisition credential Validate_Key_Auth found is inconsistent with the target key acquisition credential Validate_Key_Auth carried in the first key reading request, the signature key is not sent to the client 101.

[0107] As can be seen from the above, by simultaneously verifying whether the login credential and the signature acquisition credential are consistent, the first target signature key matching the target login credential and the target key acquisition credential carried in the first key reading request is sent to the client 101, so that when the login credential of the client 101 is stolen, the signature key of the client 101 cannot be acquired from the authority server 103 without the key acquisition credential of the client 101, thereby improving the security of the signature key.

[0108] (3) The client 101 receives the first target signature key fed back by the authority server 103 based on the first key reading request, so that the client 101 acquires the first target signature key from the authority server 103.

[0109] III. The client 101 generates the first signature information.

[0110] In some embodiments, the first signature information includes a first signature code of the request information and a first signature code of the parameter information.

[0111] In some embodiments, as shown in FIG. 3, the process of generating the first signature information by the client 101 includes the following steps (1) to (3): Figure 4

[0112] (1) Sign the request information.

[0113] ​Exemplarily, the request information includes a transmitted data type Content-Type, a transmission method HttpMethod, an access path Path, and a current timestamp TimeStamp. The request information (such as the transmitted data type Content-Type, the transmission method HttpMethod, the access path Path, and the current timestamp TimeStamp) is signed by the first target signing key and a signing algorithm to generate a first signature code VCode1 of the request information.

[0114] (ii) signing the parameter information.

[0115] Exemplarily, the parameter information includes QueryParams carried by a uniform resource locator (URL), and information such as JSON (JavaScript Object Notation) carried by a request body Body, and a current timestamp TimeStamp. The parameter information (such as the QueryParams carried by the URL, the information such as the JSON carried by the request body Body, and the current timestamp TimeStamp) is signed by the first target signing key and a signing algorithm to generate a first signature code VCode2 of the parameter information.

[0116] (iii) merging the signed request information and the signed parameter information to form first signature information.

[0117] Exemplarily, the first signature code VCode1 of the request information and the first signature code VCode2 of the parameter information are merged into a Header named ValidateCode with a fixed format according to a preset fixed format of the Header. The fixed format of the Header can be: {signed request information / signed parameter information / timestamp of signature}, that is, the request information and the parameter information signed in (i) and (ii) above are merged to form the Header named ValidateCode: VCode1 / VCode2 / TimeStamp.

[0118] At this point, the data reading system can obtain the first signature information generated by the client 101 according to the first target signing key obtained from the authority server 103.

[0119] S702, sending a data reading request carrying the first signature information to the backend 102.

[0120] Exemplarily, the data reading system can send a data reading request carrying the first signature information to the backend 102 through the client 101.

[0121] For subsequent identification, the target login credential is also carried in the data reading request.

[0122] S703, obtaining second signature information generated by the backend 102 according to a second target signature key.

[0123] The second target signature key is obtained by the backend 102 from the authority server 103 according to the target login credential carried in the data reading request.

[0124] The second target signature key refers to the signature key obtained by the backend 102 from the authority server 103.

[0125] For ease of understanding, the following two aspects of obtaining the signature key by the backend 102 and generating the second signature information by the backend 102 are described to explain the implementation of step S703.

[0126] I. The backend 102 obtains the signature key.

[0127] The client 101 is also configured to send a data reading request carrying the first signature information to the backend 102.

[0128] The backend 102 is configured to obtain a second target signature key matching the target login credential carried in the data reading request from the authority server 103.

[0129] Exemplarily, as shown in Figure 5 , Figure 5 is a schematic diagram for explaining the backend 102 obtaining the signature key in the embodiment of the application. The process of the backend 102 obtaining the second target signature key from the authority server 103 includes the following steps 1) to 3):

[0130] 1) The backend 102 sends a second key reading request to the authority server 103 through the HTTPS transmission protocol.

[0131] The second key reading request refers to the key reading request sent by the backend 102 to the authority server 103.

[0132] The target login credential of the client 101 is also carried in the data reading request sent by the backend 102 to the backend 102. The backend 102 can send the second key reading request to the authority server 103 according to the target login credential carried in the data reading request sent by the backend 102.

[0133] 2) The authority server 103 obtains the second target signature key matching the target login credential according to the target login credential carried in the second key reading request and sends it to the backend 102.

[0134] Here, the signature key matching the target login credential refers to the signature key stored by the authority server 103 in association with the target login credential Token carried in the second signature key reading request.

[0135] Since the backend 102 carries the target login credential Token of the client 101 when accessing the specific interface of the authority server 103 under the HTTPS protocol, after receiving the second signature key reading request sent by the backend 102, the authority server 103 finds the signature key stored in association with the target login credential Token carried in the second signature key reading request from the signature keys stored by the authority server 103, as the second target signature key, and sends it to the backend 102.

[0136] 3) The backend 102 receives the second target signature key fed back by the authority server 103 based on the second signature key reading request, and thus the backend 102 realizes obtaining the second target signature key from the authority server 103.

[0137] II. The backend 102 generates the second signature information.

[0138] In some embodiments, the second signature information includes the second signature code of the request information and the second signature code of the parameter information.

[0139] Similar to the signature method of the client 101, in some embodiments, the process of the backend 102 generating the second signature information is as follows:

[0140] I) Sign the request information.

[0141] Exemplarily, the request information includes the data type Content-Type, the transmission method HttpMethod, the access path Path, and the current timestamp TimeStamp. The request information (such as the data type Content-Type, the transmission method HttpMethod, the access path Path, and the current timestamp TimeStamp) is signed by the second target signature key and the signature algorithm to generate the second signature code VCode1’ of the request information.

[0142] II) Sign the parameter information.

[0143] Exemplarily, the parameter information includes QueryParams carried by a URL, information such as JSON carried by a request body, and a current timestamp TimeStamp. The parameter information (such as QueryParams carried by a URL, information such as JSON carried by a request body, and a current timestamp TimeStamp) is signed by using a second target signature key and a signature algorithm, to generate a second signature code VCode2' of the parameter information.

[0144] At this point, the data reading system can obtain the second signature information generated by the backend 102 according to the second target signature key obtained from the authority server 103.

[0145] S704, when the first signature information and the second signature information are consistent, sending data matched with the data reading request to the client 101.

[0146] Wherein, the data matched with the data reading request is obtained by the backend 102 from the server 104.

[0147] Specifically, the data reading system can obtain the data matched with the data reading request from the server 104 by the backend 102, and send the obtained data matched with the data reading request to the client 101 by the backend 102, so that the client 101 realizes data reading.

[0148] In some embodiments, before step S704, it further includes: detecting whether the first signature information and the second signature information are consistent. The following takes the backend 102 detecting whether the first signature information and the second signature information are consistent as an example, at this time:

[0149] The backend 102 is further configured to generate second signature information according to the second target signature key; and when the first signature information and the second signature information are consistent, send data matched with the data reading request from the server 104 to the client 101.

[0150] The backend 102 is further configured to detect whether the first signature information and the second signature information are consistent. As shown in Figure 6 Figure 6 is a schematic diagram of signature verification of the backend 102 provided in the embodiments of the present application. There are various ways for the backend 102 to detect whether the first signature information and the second signature information are consistent, exemplarily including:

[0151] ​Manner 1: The backend 102 detects whether the first signature code of the request information and the second signature code of the request information are consistent. When the first signature code of the request information and the second signature code of the request information are consistent, it is determined that the first signature information and the second signature information are consistent. When the first signature code of the request information and the second signature code of the request information are inconsistent, it is determined that the first signature information and the second signature information are inconsistent. By comparing whether the first signature code of the request information and the second signature code of the request information are consistent, it can be determined whether the request information of the client 101 is tampered with, so as to determine whether to obtain the data matched with the data reading request from the server 104 and send it to the client 101, thereby ensuring the data reading security in the micro-service architecture to a certain extent.

[0152] Manner 2: The backend 102 detects whether the first signature code of the parameter information and the second signature code of the parameter information are consistent. When the first signature code of the parameter information and the second signature code of the parameter information are consistent, it is determined that the first signature information and the second signature information are consistent. When the first signature code of the parameter information and the second signature code of the parameter information are inconsistent, it is determined that the first signature information and the second signature information are inconsistent. By comparing whether the first signature code of the parameter information and the second signature code of the parameter information are consistent, it can be determined whether the parameter information of the client 101 is tampered with, so as to determine whether to obtain the data matched with the data reading request from the server 104 and send it to the client 101, thereby ensuring the data reading security in the micro-service architecture to a certain extent.

[0153] Manner 3: The backend 102 detects whether the first signature code of the request information and the second signature code of the request information are consistent, and whether the first signature code of the parameter information and the second signature code of the parameter information are consistent. When the first signature code of the request information and the second signature code of the request information are consistent, and the first signature code of the parameter information and the second signature code of the parameter information are consistent, it is determined that the first signature information and the second signature information are consistent. When the first signature code of the request information and the second signature code of the request information are inconsistent, and / or the first signature code of the parameter information and the second signature code of the parameter information are inconsistent, it is determined that the first signature information and the second signature information are inconsistent.

[0154] When it is determined that the first signature information and the second signature information are consistent, the backend 102 is further configured to obtain the data matched with the data reading request from the server 104 and send it to the client 101. The client 101 receives the data matched with the data reading request fed back by the backend 102 based on the data reading request, and thus the client 101 completes the data reading.

[0155] Since even if the request data is encrypted and transmitted, the attacker can still resend the intercepted message to the receiver, causing a replay attack on the server 104 and the client 101. Further, in order to reduce the replay attack of the attacker on the server 104 and the client 101, the backend 102 also verifies the timeliness of the data read request when verifying the signature information (hereinafter referred to as backend 102 verification signature in the embodiments of the present application), such as Figure 6 As shown in the figure, the backend 102 is also used to detect whether the time difference between the request time of the data read request carried in the first signature information and the current time is less than the preset time length based on the request time of the data read request carried in the first signature information; when the time difference is less than the preset time length and the first signature information and the second signature information are consistent, it is proved that the timeliness of the data read request meets the requirements, and the backend 102 obtains the data matched with the data read request from the server 104 and sends it to the client 101. When the time difference is less than the preset time length, it is proved that the timeliness of the data read request does not meet the requirements, and the backend 102 will not send the data matched with the data read request to the client 101, so as to avoid the attacker constantly resending the intercepted message to the receiver, causing a replay attack on the server 104 and the client 101.

[0156] Among them, the time difference refers to the time difference between the request time of the data read request carried in the first signature information and the current time.

[0157] The preset time length can be set according to the actual business scene, and the specific value of the preset time length is not limited here.

[0158] Further, in order to improve the accuracy of the backend 102 verification signature and improve the data read security in the micro-service architecture, the backend 102 also verifies the compliance of the signature algorithm when verifying the signature information, such as Figure 6 As shown in the figure, the backend 102 will also judge whether the data read request sent by the client 101 carries a Header named preset name (such as validateMethod), and judge whether the signature algorithm of the client 101 is compliant through the signature algorithm name carried by the data read request. When the signature algorithm of the client 101 is not compliant, the backend 102 sends an error prompt information or a prompt information that the data cannot be read to the client 101.

[0159] Further, in order to improve the accuracy of the backend 102 verification signature and improve the data read security in the micro-service architecture, the backend 102 also verifies whether the signature information format is correct when verifying the signature information, such as Figure 6As shown, the backend 102 also determines whether the data read request sent by the client 101 carries a Header named a preset name (such as validateMethod), and determines whether the signature information carried by the Header is in a correct format. When the signature information carried by the Header is not in the correct format, the backend 102 sends error prompt information or prompt information that data cannot be read to the client 101. For example, the preset correct format is: signature of request type / signature of parameter information carried / signature of timestamp, and when the signature information carried by the Header is not in the preset correct format "signature of request type / signature of parameter information carried / signature of timestamp", the backend 102 sends error prompt information or prompt information that data cannot be read to the client 101.

[0160] In the embodiment of the application, in a first aspect, the first target signature key of the client 101 is obtained from the authority server 103 for generating the first signature information according to the target login credential and the target key acquisition credential of the client 101, and the data read request carrying the first signature information is sent to the backend 102 through the client 101, so that any one of the target login credential and the target key acquisition credential of the client 101 is missing, and the signature key of the client 101 cannot be obtained, thereby avoiding the problem that the signature key is easily stolen, and the security of data reading in the micro-service architecture is improved to a certain extent.

[0161] In a second aspect, the second target signature key matched with the target login credential carried in the data read request is obtained from the authority server 103 by the backend 102 for generating the second signature information; when the first signature information and the second signature information are consistent, the data matched with the data read request is obtained from the server 104 and sent to the client 101, so that the security problem of the request data caused by the theft of the login identity authentication information of the user or the modification of the request body by an attacker can be avoided; therefore, the security of data reading in the micro-service architecture is also provided to a certain extent.

[0162] It can be seen that, by using the data reading method provided in the embodiment of the application, the problem that the signature key is easily stolen can be avoided, and the security of data reading in the micro-service architecture is improved.

[0163] In addition, in order to better implement the data reading method in the embodiment of the application, based on the data reading method, the embodiment of the application also provides an electronic device, which is described below with reference to Figure 8 , Figure 8 Fig. 1 shows a structural schematic diagram of the electronic device in the embodiment of the application. Specifically, the electronic device provided in the embodiment of the application includes a processor 801, which is used to execute the computer program stored in the memory 802 to realize the steps of the data reading method.

[0164] For example, the computer program can be divided into one or more modules / units, one or more modules / units are stored in the memory 802 and executed by the processor 801 to complete the embodiments of the present application. One or more modules / units can be a series of computer program instruction segments capable of completing a specific function, which is used to describe the execution process of the computer program in the computer device.

[0165] The electronic device can include but not limited to the processor 801, the memory 802. Those skilled in the art can understand that the schematic diagram is only an example of the electronic device and does not constitute a limitation on the electronic device, which can include more or less components than the schematic diagram, or combine certain components, or different components, for example, the electronic device can also include input / output devices, network access devices, buses, etc. The processor 801, the memory 802, the input / output device and the network access device are connected through the bus.

[0166] The processor 801 can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The processor is the control center of the electronic device, which connects all parts of the electronic device through various interfaces and lines.

[0167] The memory 802 can be used to store computer programs and / or modules, and the processor 801 implements various functions of the computer device by running or executing the computer programs and / or modules stored in the memory 802, and calling data stored in the memory 802. The memory 802 can mainly include a program storage area and a data storage area, wherein the program storage area can store operating systems, at least one application program required by a function (such as a sound playing function, an image playing function, etc.), and the like; and the data storage area can store data (such as audio data, video data, etc.) created according to the use of the electronic device, and the like. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, for example, a hard disk, a memory, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, at least one disk storage device, a flash memory device, or other volatile solid-state memory devices.

[0168] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the above-described electronic device specific working process and beneficial effects can refer to the description of the data reading method, and will not be described here in detail.

[0169] Those skilled in the art can understand that all or part of the steps in the various methods of the above-described embodiments can be completed by instructions, or by related hardware controlled by the instructions, which can be stored in a computer readable storage medium and loaded and executed by a processor.

[0170] To this end, the embodiments of the present application provide a computer readable storage medium, which stores a plurality of instructions capable of being loaded by a processor to execute the steps in the data reading method of the present application.

[0171] The computer readable storage medium can include a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0172] Since the instructions stored in the computer readable storage medium can execute the steps in the data reading method of the present application, the beneficial effects that can be achieved by the data reading method of the present application can be achieved, and the details are described in the above description of the data reading method, and will not be described here in detail.

[0173] The above describes in detail the data reading system, method, electronic device and computer readable storage medium provided by the embodiments of the present application. The principles and implementation manners of the present application are described by applying specific examples. The above description of the embodiments is only used to help understand the method of the present application and its core idea. Meanwhile, for those skilled in the art, according to the idea of the present application, the specific implementation manners and application ranges will be changed. In conclusion, the content of the specification should not be understood as a limitation of the present application.

Claims

1. A data reading system, characterized by, The data reading system comprises a client, a backend, an authority server and a server, the client is in communication connection with the backend and the authority server respectively, and the backend is in communication connection with the authority server and the server respectively; The client is configured to obtain a first target signature key of the client from the authority server according to a target login credential and a target key acquisition credential of the client; The first signature code of the request information and the first signature code of the parameter information are generated based on the first target signature key; The first signature information is obtained by merging the first signature code of the request information and the first signature code of the parameter information; The client is further configured to send a data reading request carrying the first signature information to the backend, wherein the first signature information is generated by the client based on the first target signature key, and the data reading request carries the target login credential; The backend is configured to obtain a second target signature key matched with the target login credential carried in the data reading request from the authority server; The backend is further configured to generate second signature information according to the second target signature key, wherein the second signature information comprises a second signature code of request information and a second signature code of parameter information; The backend is further configured to determine that the first signature information and the second signature information are consistent when the first signature code of the request information and the second signature code of the request information are consistent, and the first signature code of the parameter information and the second signature code of the parameter information are consistent; and send data matched with the data reading request from the server to the client when the first signature information and the second signature information are consistent.

2. The data reading system of claim 1, wherein, The authority server is configured to generate a target login credential, a first target signature key and a target key acquisition credential of the client when the client logs in the data reading system.

3. The data reading system of claim 1, wherein, The client is further configured to store the target login credential in the form of a cookie and the target key acquisition credential in the form of a cookie; and send a first key reading request to the authority server through an Http transmission protocol, wherein the security attribute and the Http transmission attribute of the target key acquisition credential stored in the client are set to an open state. The authority server is further configured to obtain a first target signature key matched with the target login credential and the target key acquisition credential from the client according to the target login credential and the target key acquisition credential carried in the first key reading request.

4. The data reading system according to any one of claims 1 to 3, characterized in that, The backend is further configured to detect whether a time length difference between a request time of the data reading request carried in the first signature information and a current time is less than a preset time length based on the request time of the data reading request carried in the first signature information. When the time length difference is less than the preset time length and the first signature information and the second signature information are consistent, data matched with the data reading request is sent from the server to the client.

5. A data reading method characterized by, The data reading method comprises: The client acquires first signature information generated by a first target signature key, wherein the first target signature key is acquired by the client from an authority server according to target login credentials and target key acquisition credentials of the client; the first signature information is obtained by merging a first signature code of request information and a first signature code of parameter information; The client sends a data reading request carrying the first signature information to a backend; The client acquires second signature information generated by a second target signature key, wherein the second target signature key is acquired by the backend from the authority server according to target login credentials carried by the data reading request; When the first signature information and the second signature information are consistent, the client sends data matched with the data reading request to the client, wherein the data matched with the data reading request is acquired by the backend from a server; the first signature information and the second signature information are consistent, including that the first signature code of the request information and the second signature code of the request information are consistent, and the first signature code of the parameter information and the second signature code of the parameter information are consistent.

6. The data reading method according to claim 5, wherein, The first signature information includes a first signature code of request information and a first signature code of parameter information, and the second signature information includes a second signature code of request information and a second signature code of parameter information; Before the client sends the data matched with the data reading request to the client when the first signature information and the second signature information are consistent, the client further includes: The client detects whether the first signature information and the second signature information are consistent; The client detects whether the first signature information and the second signature information are consistent, including: The client detects whether the first signature code of the request information and the second signature code of the request information are consistent; The client detects whether the first signature code of the parameter information and the second signature code of the parameter information are consistent; When the first signature code of the request information and the second signature code of the request information are consistent, and the first signature code of the parameter information and the second signature code of the parameter information are consistent, the client determines that the first signature information and the second signature information are consistent.

7. The data reading method according to claim 5, wherein, The first signature information further includes a request time of the data reading request, and the client sends the data matched with the data reading request to the client when the first signature information and the second signature information are consistent, including: The client detects whether a time difference between the request time and a current time is less than a preset time; When the time difference is less than the preset time, and the first signature information and the second signature information are consistent, the client sends the data matched with the data reading request to the client.

8. The data reading method according to any one of claims 5 to 7, characterized by, The client stores the target login credentials in the form of a Cookie and the target key acquisition credentials in the form of a Cookie, and a security attribute and an Http transmission attribute of the target key acquisition credentials stored in the client are set to an open state.

9. An electronic device, comprising: A computer program product comprising a processor and a memory having stored therein a computer program, the processor executing the computer program in the memory to perform the data reading method of any one of claims 5 to 8.

10. A computer-readable storage medium, characterized in that, A computer program product comprising a processor and a memory having stored therein a computer program, the processor executing the computer program in the memory to perform the data reading method of any one of claims 5 to 8.

Images